Users (without admin perms) are able to create blogs in other user's name

• Feature request
• Patch

With the 1.10b (and latest svn changes) it is meant for admins to be able to change the creator of the forums.

Unfortunately, all users with permission to create blogs, can now create blogs for any other user - even if they can not post to them.

It seems that the latest file templates/tiki-edit_blog.tpl and .php requires that a value for the creator is passed back from the field Creator. Thus, the field has to be present with a valid content.

I'm sure there is an easier way of doing this but here is a solution:

In the file templates/tiki-edit_blog.tpl
Replace:
<tr class="editblogform"><td>{tr}Creator{/tr}</td><td><select name="creator">
{foreach from=$users key=userId item=u}
<option value="{$u|escape}"{if $u eq $creator} selected="selected"{/if}>{$u}</option>
{/foreach}
</select></td></tr>

with:
<tr class="editblogform"><td>{tr}Creator{/tr}</td>
{if $tiki_p_admin eq 'y' or $tiki_p_blog_admin eq 'y'}
<td><select name="creator">
{foreach from=$users key=userId item=u}
<option value="{$u|escape}"{if $u eq $creator} selected="selected"{/if}>{$u}</option>
{/foreach}
</select> </td>
{else}
<td>{$user}</td>
{/if}
</tr>

This solution still shows the menu if the user has admin privs but if the user does not have admin privs, the user name will simply show up as static text next to Creator.

The solution works for previews as well.

This bug has been demonstrated on show2.tiki.org

Please demonstrate your bug on show2.tiki.org