From 8eb6dafe312746ea85ccdd0544b17241b2f95a9c Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Tue, 8 Aug 2017 23:12:08 -0700
Subject: [PATCH] only show upload button to those with write_storage
 permission

---
 Zotlabs/Lib/ThreadItem.php | 1 +
 view/tpl/comment_item.tpl  | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/Zotlabs/Lib/ThreadItem.php b/Zotlabs/Lib/ThreadItem.php
index a705e3c2b..3e76890b6 100644
--- a/Zotlabs/Lib/ThreadItem.php
+++ b/Zotlabs/Lib/ThreadItem.php
@@ -740,6 +740,7 @@ class ThreadItem {
 			'$edvideo' => t('Video'),
 			'$preview' => t('Preview'), // ((feature_enabled($conv->get_profile_owner(),'preview')) ? t('Preview') : ''),
 			'$indent' => $indent,
+			'$can_upload' => perm_is_allowed($conv->get_profile_owner(),get_observer_hash(),'write_storage'),
 			'$feature_encrypt' => ((feature_enabled($conv->get_profile_owner(),'content_encrypt')) ? true : false),
 			'$encrypt' => t('Encrypt text'),
 			'$cipher' => $conv->get_cipher(),
diff --git a/view/tpl/comment_item.tpl b/view/tpl/comment_item.tpl
index 289356107..cba4cd3c5 100755
--- a/view/tpl/comment_item.tpl
+++ b/view/tpl/comment_item.tpl
@@ -47,9 +47,11 @@
 							</button>
 						</div>
 						<div class="btn-group mr-2">
+							{{if $can_upload}}
 							<button class="btn btn-outline-secondary btn-sm" title="{{$edatt}}" onclick="insertCommentAttach('{{$comment}}',{{$id}}); return false;">
 								<i class="fa fa-paperclip comment-icon"></i>
 							</button>
+							{{/if}}
 							<button class="btn btn-outline-secondary btn-sm" title="{{$edurl}}" onclick="insertCommentURL('{{$comment}}',{{$id}}); return false;">
 								<i class="fa fa-link comment-icon"></i>
 							</button>