reworked logic to stem from post

api/context.go

@@ -265,8 +265,8 @@ func (c *Context) IsSystemAdmin() bool {
 	return false
 }
 
-func (c *Context) IsTeamAdmin() bool {
+func (c *Context) IsTeamAdmin(userId string) bool {
-	if uresult := <-Srv.Store.User().Get(c.Session.UserId); uresult.Err != nil {
+	if uresult := <-Srv.Store.User().Get(userId); uresult.Err != nil {
 		c.Err = uresult.Err
 		return false
 	} else {

api/post.go

@@ -620,10 +620,6 @@ func deletePost(c *Context, w http.ResponseWriter, r *http.Request) {
 	cchan := Srv.Store.Channel().CheckPermissionsTo(c.Session.TeamId, channelId, c.Session.UserId)
 	pchan := Srv.Store.Post().Get(postId)
 
-	if !c.HasPermissionsToChannel(cchan, "deletePost") && !c.IsTeamAdmin(){
-		return
-	}
-
 	if result := <-pchan; result.Err != nil {
 		c.Err = result.Err
 		return
@@ -631,6 +627,10 @@ func deletePost(c *Context, w http.ResponseWriter, r *http.Request) {
 
 		post := result.Data.(*model.PostList).Posts[postId]
 
+	if !c.HasPermissionsToChannel(cchan, "deletePost") && !c.IsTeamAdmin(post.UserId){
+		return
+	}
+
 		if post == nil {
 			c.SetInvalidParam("deletePost", "postId")
 			return