diff --git a/src/controllers/groups.js b/src/controllers/groups.js index bd52cb09e0..ce6c4e0728 100644 --- a/src/controllers/groups.js +++ b/src/controllers/groups.js @@ -173,8 +173,10 @@ api.deleteChatMessage = function(req, res, next){ if(message === undefined) return res.json(500, {err: "Message not found!"}); - if(user.id !== message.uuid || (user.backer && !user.backer.admin)){ - return res.json(500, {err: "Not authorized to delete this message!"}); + if(user.id !== message.uuid){ + if(!user.backer || (user.backer && !user.backer.admin)){ + return res.json(500, {err: "Not authorized to delete this message!"}) + } } group.chat = _.without(group.chat, message);