only owner users with upload rights are allowed to edit albums (Lyche…

…eOrg#2333)
RockyLucky · Mar 27, 2024 · c0be4e4 · c0be4e4
1 parent 5435ba4
commit c0be4e4
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/app/Policies/AlbumPolicy.php b/app/Policies/AlbumPolicy.php
@@ -228,7 +228,7 @@ public function canEdit(User $user, AbstractAlbum|null $album): bool
 		}
 
 		if ($album instanceof BaseAlbum) {
-			return $this->isOwner($user, $album) ||
+			return ($this->isOwner($user, $album) && $user->may_upload) ||
 				$album->current_user_permissions()?->grants_edit === true ||
 				$album->public_permissions()?->grants_edit === true;
 		}