🐛 fix(functions.rs): add authorization check in do_cancel_offer function to ensure only admin or offer creator can cancel the offer

🐛 fix(lib.rs): remove redundant authorization check in cancel_offer function

Author: tlacloc

pallets/afloat/src/functions.rs

@@ -859,11 +859,14 @@ impl<T: Config> Pallet<T> {
     Ok(())
   }
 
-  pub fn do_cancel_offer(order_id: StorageId) -> DispatchResult {
+  pub fn do_cancel_offer(who: T::AccountId, order_id: StorageId) -> DispatchResult {
 	// ensure offer exists
     ensure!(<AfloatOffers<T>>::contains_key(order_id), Error::<T>::OfferNotFound);
     //get offer details
     let offer = <AfloatOffers<T>>::get(order_id).unwrap();
+	let is_admin_or_owner = Self::is_admin_or_owner(who.clone())?;
+    ensure!(is_admin_or_owner || offer.creator_id == who, Error::<T>::Unauthorized);
+
 	match offer.status {
 		OfferStatus::CREATED => {
 			<AfloatOffers<T>>::try_mutate(order_id, |offer| -> DispatchResult {

pallets/afloat/src/lib.rs

@@ -433,9 +433,7 @@ pub mod pallet {
     #[pallet::weight(Weight::from_parts(10_000,0) + T::DbWeight::get().reads_writes(1,1))]
     pub fn cancel_offer(origin: OriginFor<T>, order_id: StorageId) -> DispatchResult {
       let who = ensure_signed(origin.clone())?;
-      let is_admin_or_owner = Self::is_admin_or_owner(who.clone())?;
-      ensure!(is_admin_or_owner, Error::<T>::Unauthorized);
-	  Self::do_cancel_offer(order_id)
+	  Self::do_cancel_offer(who, order_id)
     }
   }
 }