Prevent seeing voters list if user cannot see votes count

FriendsOfFlarum · Jul 15, 2023 · 19f4708 · 19f4708
1 parent 39ff9ff
commit 19f4708
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/src/Access/PollPolicy.php b/src/Access/PollPolicy.php
@@ -30,7 +30,11 @@ public function seeVoteCount(User $actor, Poll $poll)
 
     public function seeVoters(User $actor, Poll $poll)
     {
-        if (($poll->myVotes($actor)->count() || $actor->can('polls.viewResultsWithoutVoting', $poll->post->discussion)) && $poll->public_poll) {
+        if (!$actor->can('seeVoteCount', $poll)) {
+            return $this->deny();
+        }
+
+        if ($poll->public_poll) {
             return $this->allow();
         }
     }