From 29b989952d2af1861820df2ab24172dd41fe2b39 Mon Sep 17 00:00:00 2001
From: Pierre <pierre@hubert.fr>
Date: Sun, 14 Jan 2018 19:23:10 +0100
Subject: [PATCH] Created a new function to get post ID with full access.

---
 RestControllers/postsController.php | 31 +++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/RestControllers/postsController.php b/RestControllers/postsController.php
index 40f28c2..1aa549c 100644
--- a/RestControllers/postsController.php
+++ b/RestControllers/postsController.php
@@ -337,15 +337,11 @@ class postsController {
 		user_login_required();
 		
 		//Get the post ID
-		$postID = getPostPostID("postID");
-
+		$postID = $this->getFullAccessPostID("postID");
+		
 		//Get the visibility level
 		$new_visibility = $this->getPostVisibilityLevel("new_level");
 
-		//Check if the user is allowed to change the visibility level of the post
-		if(CS::get()->components->posts->access_level($postID, userID) != Posts::FULL_ACCESS)
-			Rest_fatal_error(401, "You are not allowed to change the visibility level of this post !");
-		
 		//Try to update visibility level
 		if(!CS::get()->components->posts->update_level($postID, $new_visibility))
 			Rest_fatal_error(500, "Couldn't update visibility level !");
@@ -405,4 +401,27 @@ class postsController {
 		return $post_visibility[$api_visibility];
 
 	}
+
+	/**
+	 * This function is called to check if the current user has a full access
+	 * other a post specified by its ID in a post request
+	 * 
+	 * @param string $name The name of the POST parameter
+	 * @return int The ID of the POST (an error is thrown if the user can't be
+	 * authenticated as post owner)
+	 */
+	private function getFullAccessPostID(string $name) : int {
+
+		user_login_required();
+		
+		//Get the post ID
+		$postID = getPostPostID($name);
+
+		//Check if the user is allowed to change the visibility level of the post
+		if(CS::get()->components->posts->access_level($postID, userID) != Posts::FULL_ACCESS)
+			Rest_fatal_error(401, "You do not the full control of this post !");
+		
+		//Return post id
+		return $postID;
+	}
 }
\ No newline at end of file