From 422427afea1a94496e484821a46595a461ccb67c Mon Sep 17 00:00:00 2001
From: Umputun <umputun@gmail.com>
Date: Fri, 22 Jun 2018 17:33:04 -0500
Subject: [PATCH] don't allow blocked users to vote

---
 app/rest/api/rest_private.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/app/rest/api/rest_private.go b/app/rest/api/rest_private.go
index c0fd9ce8..6349bce1 100644
--- a/app/rest/api/rest_private.go
+++ b/app/rest/api/rest_private.go
@@ -161,6 +161,12 @@ func (s *Rest) voteCtrl(w http.ResponseWriter, r *http.Request) {
 
 	vote := r.URL.Query().Get("vote") == "1"
 
+	// check if user blocked
+	if s.adminService.checkBlocked(locator.SiteID, user) {
+		rest.SendErrorJSON(w, r, http.StatusForbidden, errors.New("rejected"), "user blocked")
+		return
+	}
+
 	comment, err := s.DataService.Vote(locator, id, user.ID, vote)
 	if err != nil {
 		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't vote for comment")