archives/FHeD
1
0
Fork 0
Code Issues Pull Requests Actions Packages Releases 40 Activity

🐛 Fix request authorisation

Browse Source 
Signed-off-by: Luke Tainton <luke@tainton.uk>
This commit is contained in:
Luke Tainton
2020-08-09 17:09:50 +01:00
parent 07eaf4d05d
commit 671e1826d0
7 changed files with 14 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
app/includes/prereqs.php
View File

@@ -136,6 +136,6 @@ function get_subscribers($db, $request) {
return $users_result; return $users_result;
} }
function isAuthorised($authorised_users, $request) { function isAuthorised($user, $authorised_users, $request) {
if (in_array($authorised_users, $_SESSION['uuid']) || $_SESSION['uuid'] == $request['created_by']) { return true; } else { return false; } if ( in_array($user, $authorised_users) || $_SESSION['uuid'] == $request['created_by']) { return true; } else { return false; }
} }

6
app/public/actions/close.php
View File

@@ -4,8 +4,8 @@
$request = get_request($db, $_GET['rid']); $request = get_request($db, $_GET['rid']);
$authorised_users = get_subscribers($db, $request); $authorised_users = get_subscribers($db, $request);
$is_authorised = isAuthorised($authorised_users, $request); $is_authorised = isAuthorised($_SESSION['uuid'], $authorised_users, $request);
// Close request // Close request
if ($is_authorised == true) { if ($is_authorised == true) {
if($_SERVER['REQUEST_METHOD'] == 'POST') { if($_SERVER['REQUEST_METHOD'] == 'POST') {
@@ -25,4 +25,4 @@
header('Location: /view?rid=' . $request['uuid'], true); header('Location: /view?rid=' . $request['uuid'], true);
} }
?> ?>

4
app/public/actions/update.php
View File

@@ -4,7 +4,7 @@
$request = get_request($db, $_POST['rid']); $request = get_request($db, $_POST['rid']);
$authorised_users = get_subscribers($db, $request); $authorised_users = get_subscribers($db, $request);
$is_authorised = isAuthorised($authorised_users, $request); $is_authorised = isAuthorised($_SESSION['uuid'], $authorised_users, $request);
// If form submitted, save to database // If form submitted, save to database
if($_SERVER['REQUEST_METHOD'] == 'POST') { if($_SERVER['REQUEST_METHOD'] == 'POST') {
@@ -26,4 +26,4 @@
} }
} }
?> ?>

4
app/public/actions/upload.php
View File

@@ -4,7 +4,7 @@
$request = get_request($db, $_POST['rid']); $request = get_request($db, $_POST['rid']);
$authorised_users = get_subscribers($db, $request); $authorised_users = get_subscribers($db, $request);
$is_authorised = isAuthorised($authorised_users, $request); $is_authorised = isAuthorised($_SESSION['uuid'], $authorised_users, $request);
// If form submitted, save to database // If form submitted, save to database
if($_SERVER['REQUEST_METHOD'] == 'POST') { if($_SERVER['REQUEST_METHOD'] == 'POST') {
@@ -35,4 +35,4 @@
} }
} }
?> ?>

6
app/public/update.php
View File

@@ -1,11 +1,11 @@
<?php <?php
$PAGE_NAME = "Update Request"; $PAGE_NAME = "Update Request";
require_once __DIR__ . "/../includes/header.php"; require_once __DIR__ . "/../includes/header.php";
$request = get_request($db, $_GET['rid']); $request = get_request($db, $_GET['rid']);
$updates = get_updates($db, $request); $updates = get_updates($db, $request);
$authorised_users = get_subscribers($db, $request); $authorised_users = get_subscribers($db, $request);
$is_authorised = isAuthorised($authorised_users, $request); $is_authorised = isAuthorised($_SESSION['uuid'], $authorised_users, $request);
?> ?>
@@ -138,7 +138,7 @@
</div> </div>
</div> </div>
</section> </section>
<?php } else if ($is_authorised == false) { ?> <?php } else if ($is_authorised == false) { ?>
<section class="jumbotron text-center"> <section class="jumbotron text-center">
<div class="container"> <div class="container">

2
app/public/upload.php
View File

@@ -5,7 +5,7 @@
$request = get_request($db, $_GET['rid']); $request = get_request($db, $_GET['rid']);
$updates = get_updates($db, $request); $updates = get_updates($db, $request);
$authorised_users = get_subscribers($db, $request); $authorised_users = get_subscribers($db, $request);
$is_authorised = isAuthorised($authorised_users, $request); $is_authorised = isAuthorised($_SESSION['uuid'], $authorised_users, $request);
?> ?>

2
app/public/view.php
View File

@@ -5,7 +5,7 @@
$request = get_request($db, $_GET['rid']); $request = get_request($db, $_GET['rid']);
$updates = get_updates($db, $request); $updates = get_updates($db, $request);
$authorised_users = get_subscribers($db, $request); $authorised_users = get_subscribers($db, $request);
$is_authorised = isAuthorised($authorised_users, $request); $is_authorised = isAuthorised($_SESSION['uuid'], $authorised_users, $request);
?> ?>