Fix moin plugin permissions

2 files changed, 8 insertions, 1 deletions

diff --git a/moin/wiki-common/plugins/_activitybase.py b/moin/wiki-common/plugins/_activitybase.py
index 215212a..e5f1cf0 100644
--- a/moin/wiki-common/plugins/_activitybase.py
+++ b/moin/wiki-common/plugins/_activitybase.py
@@ -83,6 +83,9 @@ class ActivityAction(ActionBase):
         self.page = PageEditor(request, pagename)
         self.use_ticket = True
 
+    def is_allowed(self):
+        return self.request.user.may.write(self.pagename)
+
     def get_user_now(self):
         return FormattedDateTime(moin_user_now(self.request))
 
diff --git a/moin/wiki-common/plugins/action/StopActivity.py b/moin/wiki-common/plugins/action/StopActivity.py
index 94d65bf..7b989bd 100644
--- a/moin/wiki-common/plugins/action/StopActivity.py
+++ b/moin/wiki-common/plugins/action/StopActivity.py
@@ -8,5 +8,9 @@ def execute(pagename, request):
         request.theme.add_msg('This page does not support activities.', 'error')
         return action.page.send_page()
 
-    action.stop_activity()
+    if action.is_allowed():
+        action.stop_activity()
+    else:
+        request.theme.add_msg('You can not write to this page.', 'error')
+
     action.page.send_page()