diff --git a/api_v1_threads.php b/api_v1_threads.php
index 8ddc361..f2610cd 100644
--- a/api_v1_threads.php
+++ b/api_v1_threads.php
@@ -13,6 +13,12 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
exit;
}
+ require_once 'includes/permissions.php';
+ if (!Permissions::canSendInChannel($user_id, $channel_id)) {
+ echo json_encode(['success' => false, 'error' => 'You do not have permission to create threads in this channel.']);
+ exit;
+ }
+
$tag_ids = $_POST['tag_ids'] ?? [];
if (is_string($tag_ids)) {
$tag_ids = array_filter(explode(',', $tag_ids));
diff --git a/assets/js/main.js b/assets/js/main.js
index c0f664c..053a8e4 100644
--- a/assets/js/main.js
+++ b/assets/js/main.js
@@ -1123,8 +1123,9 @@ document.addEventListener('DOMContentLoaded', () => {
// Load existing permissions for this role
const p = channelPermissionsData.find(perm => perm.role_id == roleId) || { allow_permissions: 0, deny_permissions: 0 };
- // Update toggles (for now only bit 1: View Channel)
- updateToggleUI(1, p.allow_permissions, p.deny_permissions);
+ // Update toggles
+ updateToggleUI(1, p.allow_permissions, p.deny_permissions); // View Channel
+ updateToggleUI(2, p.allow_permissions, p.deny_permissions); // Send Messages
}
function updateToggleUI(bit, allowPerms, denyPerms) {
diff --git a/index.php b/index.php
index d588389..d4fcae6 100644
--- a/index.php
+++ b/index.php
@@ -923,19 +923,26 @@ $emote_html = '