From 525ec580810ad8f3cf0766cb44527b1c77da534d Mon Sep 17 00:00:00 2001
From: Tom Hacohen <tom@stosb.com>
Date: Tue, 12 Feb 2019 19:29:10 +0000
Subject: [PATCH] Journal edit: disallow editing journals we don't own.

---
 src/Journals/Journal.tsx | 19 +++++++++++--------
 src/Journals/index.tsx   |  3 +++
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/src/Journals/Journal.tsx b/src/Journals/Journal.tsx
index f0168c5..d66d2c9 100644
--- a/src/Journals/Journal.tsx
+++ b/src/Journals/Journal.tsx
@@ -28,6 +28,7 @@ import { historyPersistor } from '../persist-state-history';
 interface PropsType {
   syncInfo: SyncInfo;
   syncJournal: SyncInfoJournal;
+  isOwner: boolean;
 }
 
 interface PropsTypeInner extends PropsType {
@@ -52,7 +53,7 @@ class Journal extends React.PureComponent<PropsTypeInner> {
   }
 
   render() {
-    const { theme, syncJournal } = this.props;
+    const { theme, isOwner, syncJournal } = this.props;
     let currentTab = this.state.tab;
     let journalOnly = false;
 
@@ -85,13 +86,15 @@ class Journal extends React.PureComponent<PropsTypeInner> {
     return (
       <React.Fragment>
         <AppBarOverride title={collectionInfo.displayName}>
-          <IconButton
-            component={Link}
-            title="Edit"
-            {...{to: routeResolver.getRoute('journals._id.edit', { journalUid: journal.uid })}}
-          >
-            <IconEdit />
-          </IconButton>
+          { isOwner &&
+            <IconButton
+              component={Link}
+              title="Edit"
+              {...{to: routeResolver.getRoute('journals._id.edit', { journalUid: journal.uid })}}
+            >
+              <IconEdit />
+            </IconButton>
+          }
         </AppBarOverride>
         <Tabs
           fullWidth={true}
diff --git a/src/Journals/index.tsx b/src/Journals/index.tsx
index 7fb97a7..4691250 100644
--- a/src/Journals/index.tsx
+++ b/src/Journals/index.tsx
@@ -60,6 +60,8 @@ class Journals extends React.PureComponent {
               return (<div>Journal not found!</div>);
             }
 
+            const isOwner = syncJournal.journal.owner === this.props.etesync.credentials.email;
+
             const collectionInfo = syncJournal.collection;
             return (
               <Switch>
@@ -81,6 +83,7 @@ class Journals extends React.PureComponent {
                     <Journal
                       syncInfo={this.props.syncInfo}
                       syncJournal={syncJournal}
+                      isOwner={isOwner}
                     />
                   )}
                 />