diff --git a/src/Ombi.Core/Engine/BaseMediaEngine.cs b/src/Ombi.Core/Engine/BaseMediaEngine.cs index 8d195594e..be857c4ae 100644 --- a/src/Ombi.Core/Engine/BaseMediaEngine.cs +++ b/src/Ombi.Core/Engine/BaseMediaEngine.cs @@ -78,23 +78,23 @@ namespace Ombi.Core.Engine return _dbTv; } - protected async Task CheckOwnRequests(BaseRequest request) { + protected async Task CheckCanManageRequest(BaseRequest request) { - var isRequestedBySameUser = ( await GetUser() ).Equals(request.RequestedUser); + // Admins can always manage requests var isAdmin = await IsInRole(OmbiRoles.PowerUser) || await IsInRole(OmbiRoles.Admin); - - if (!isRequestedBySameUser && !isAdmin) - { - return new RequestEngineResult - { - Result = false, - ErrorCode = ErrorCode.NoPermissions - }; - } + if (isAdmin) + return new RequestEngineResult { Result = true }; + + // Users with 'ManageOwnRequests' can only manage their own requests + var isRequestedBySameUser = ( await GetUser() ).Equals(request.RequestedUser); + var canManageOwnRequests = await IsInRole(OmbiRoles.ManageOwnRequests); + if(canManageOwnRequests && isRequestedBySameUser) + return new RequestEngineResult { Result = true }; return new RequestEngineResult { - Result = true, + Result = false, + ErrorCode = ErrorCode.NoPermissions }; } diff --git a/src/Ombi.Core/Engine/MovieRequestEngine.cs b/src/Ombi.Core/Engine/MovieRequestEngine.cs index fbdc34a0e..0d0234fc6 100644 --- a/src/Ombi.Core/Engine/MovieRequestEngine.cs +++ b/src/Ombi.Core/Engine/MovieRequestEngine.cs @@ -658,7 +658,7 @@ namespace Ombi.Core.Engine { var request = await MovieRepository.GetAll().FirstOrDefaultAsync(x => x.Id == requestId); - var result = await CheckOwnRequests(request); + var result = await CheckCanManageRequest(request); if (result.IsError) return result; diff --git a/src/Ombi.Core/Engine/MusicRequestEngine.cs b/src/Ombi.Core/Engine/MusicRequestEngine.cs index b263683a4..b9aa183d2 100644 --- a/src/Ombi.Core/Engine/MusicRequestEngine.cs +++ b/src/Ombi.Core/Engine/MusicRequestEngine.cs @@ -408,7 +408,7 @@ namespace Ombi.Core.Engine { var request = await MusicRepository.GetAll().FirstOrDefaultAsync(x => x.Id == requestId); - var result = await CheckOwnRequests(request); + var result = await CheckCanManageRequest(request); if (result.IsError) return result; diff --git a/src/Ombi.Core/Engine/TvRequestEngine.cs b/src/Ombi.Core/Engine/TvRequestEngine.cs index 7d5121a02..c05a23a48 100644 --- a/src/Ombi.Core/Engine/TvRequestEngine.cs +++ b/src/Ombi.Core/Engine/TvRequestEngine.cs @@ -753,7 +753,7 @@ namespace Ombi.Core.Engine { var request = await TvRepository.GetChild().FirstOrDefaultAsync(x => x.Id == requestId); - var result = await CheckOwnRequests(request); + var result = await CheckCanManageRequest(request); if (result.IsError) return result;