change IsResolved to an function

Add permission check in UpdateResolveConversation

Author: a1012112796

models/issue_comment.go

@@ -121,7 +121,6 @@ type Comment struct {
 	RemovedAssignee  bool
 	Assignee         *User `xorm:"-"`
 	ResolveDoerID    int64
-	IsResolved       bool  `xorm:"-"`
 	ResolveDoer      *User `xorm:"-"`
 	OldTitle         string
 	NewTitle         string
@@ -430,10 +429,14 @@ func (c *Comment) LoadResolveDoer() (err error) {
 	if err != nil {
 		return
 	}
-	c.IsResolved = true
 	return
 }
 
+// IsResolved check if an code comment is resolved
+func (c *Comment) IsResolved() bool {
+	return c.ResolveDoerID != 0 && c.Type == CommentTypeCode
+}
+
 // LoadDepIssueDetails loads Dependent Issue Details
 func (c *Comment) LoadDepIssueDetails() (err error) {
 	if c.DependentIssueID <= 0 || c.DependentIssue != nil {

models/review.go

@@ -631,6 +631,13 @@ func CanMarkConversation(issue *Issue, doer *User) (permResult bool, err error)
 	}
 
 	if doer.ID != issue.PosterID {
+		if issue.Repo == nil {
+			err = issue.LoadRepo()
+			if err != nil {
+				return false, err
+			}
+		}
+
 		perm, err := GetUserRepoPermission(issue.Repo, doer)
 		if err != nil {
 			return false, err

routers/repo/pull_review.go

@@ -73,6 +73,18 @@ func UpdateResolveConversation(ctx *context.Context) {
 		return
 	}
 
+	var permResult bool
+	if permResult, err = models.CanMarkConversation(issue, ctx.User); err != nil {
+		ctx.ServerError("CanMarkConversation", err)
+		return
+	}
+	if !permResult {
+		ctx.ServerError("UpdateResolveConversation",
+			fmt.Errorf("doer can't permission [usser_id: %d, issue_id: %d]",
+				ctx.User.ID, issue.ID))
+		return
+	}
+
 	if !issue.IsPull {
 		return
 	}