From 38694bef55d77cc1434f3477d8abf318faee03ba Mon Sep 17 00:00:00 2001
From: Luke Tainton <luke@tainton.uk>
Date: Mon, 10 Aug 2020 17:42:19 +0100
Subject: [PATCH] :sparkles: Only allow creator to modify subscribers

Signed-off-by: Luke Tainton <luke@tainton.uk>
---
 app/public/actions/addsub.php | 4 ++--
 app/public/actions/delsub.php | 4 ++--
 app/public/editsub.php        | 4 ++--
 app/public/view.php           | 4 +++-
 4 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/app/public/actions/addsub.php b/app/public/actions/addsub.php
index 5ae591b..df448ed 100644
--- a/app/public/actions/addsub.php
+++ b/app/public/actions/addsub.php
@@ -1,10 +1,10 @@
 <?php
-    $PAGE_NAME = "Add subscriber";
+    $PAGE_NAME = "Add Subscriber";
     require_once __DIR__ . "/../../includes/prereqs.php";
 
     $request = get_request($db, $_POST['rid']);
     $authorised_users = get_subscribers($db, $request);
-    $is_authorised = isAuthorised($_SESSION['uuid'], $authorised_users, $request);
+    $is_authorised = if ($_SESSION['uuid'] == $request['created_by']) {return true} else {return false};
 
     // Add subscriber
     if ($is_authorised == true) {
diff --git a/app/public/actions/delsub.php b/app/public/actions/delsub.php
index ada6d02..f88787e 100644
--- a/app/public/actions/delsub.php
+++ b/app/public/actions/delsub.php
@@ -1,10 +1,10 @@
 <?php
-    $PAGE_NAME = "Delete subscribers";
+    $PAGE_NAME = "Delete Subscribers";
     require_once __DIR__ . "/../../includes/prereqs.php";
 
     $request = get_request($db, $_POST['rid']);
     $authorised_users = get_subscribers($db, $request);
-    $is_authorised = isAuthorised($_SESSION['uuid'], $authorised_users, $request);
+    $is_authorised = if ($_SESSION['uuid'] == $request['created_by']) {return true} else {return false};
 
     if (!empty($_POST['delSubSelector'])) {
       $subs_to_remove = implode(",", $_POST['delSubSelector']);
diff --git a/app/public/editsub.php b/app/public/editsub.php
index 4057135..1280be6 100644
--- a/app/public/editsub.php
+++ b/app/public/editsub.php
@@ -1,10 +1,10 @@
 <?php
-    $PAGE_NAME = "Manage request subscribers";
+    $PAGE_NAME = "Manage Subscribers";
     require_once __DIR__ . "/../includes/header.php";
 
     $request = get_request($db, $_GET['rid']);
     $authorised_users = get_subscribers($db, $request);
-    $is_authorised = isAuthorised($_SESSION['uuid'], $authorised_users, $request);
+    $is_authorised = if ($_SESSION['uuid'] == $request['created_by']) {return true} else {return false};
 
     $all_users = get_all_users($db);
 
diff --git a/app/public/view.php b/app/public/view.php
index e30403d..1224e54 100644
--- a/app/public/view.php
+++ b/app/public/view.php
@@ -51,7 +51,9 @@
           <p style="color: gray; font-style: italic;"><?php echo("#" . sprintf("%'.05d\n", $request["id"])); ?></p>
           <p class="lead text-muted"><?php echo($request['description']); ?></p>
             <p>
-              <a href='/editsub?rid=<?php echo($request["uuid"]); ?>' class='btn btn-secondary my-2'>Manage subscribers</a>
+              <?php if ($_SESSION['uuid'] == $request['created_by']) { ?>
+                <a href='/editsub?rid=<?php echo($request["uuid"]); ?>' class='btn btn-secondary my-2'>Manage subscribers</a>
+              <?php } ?>
               <?php if ($request['status'] != 'Closed') { ?>
                 <a href='/update?rid=<?php echo($request["uuid"]); ?>' class='btn btn-primary my-2'>Update the request</a>
                 <a href='/upload?rid=<?php echo($request["uuid"]); ?>' class='btn btn-primary my-2'>Add attachment(s)</a>