fix version 1

module/base/cms/internal/logic/post/modify.go

@@ -13,13 +13,21 @@ import (
 
 // 修改文章
 func Modify(ctx context.Context, in *pb.PostItem) (reply *pb.StatusReply, err error) {
-	_, err = service.ParseMetaCtx(ctx, nil)
+	auth, err := service.ParseMetaCtx(ctx, nil)
 	if err != nil {
 		return nil, err
 	}
 	if in.GetSiteIdentity() == "" || in.GetIdentity() == "" {
 		return nil, errcode.ErrInvalidArgument
 	}
+	// 校验归属：仅文章作者/所有者可修改
+	post, err := models.GetPostForAuth(in.Identity)
+	if err != nil {
+		return nil, err
+	}
+	if post.AuthorIdentity != auth.Identity && post.OwnerIdentity != auth.Identity {
+		return nil, errcode.ErrPermissionDenied
+	}
 	var data = &models.CmsPost{
 		SiteIdentity: in.SiteIdentity,
 		Title:        in.Title,