karsten/scattport-web
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Check userrights for projects correctly and update the last access

Browse Source
This commit is contained in:
Eike Foken
2011-09-21 00:18:56 +02:00
parent 37daf6a6b4
commit 3edd0ace88
2 changed files with 24 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
application/controllers/projects.php
View File

@@ -118,10 +118,14 @@ class Projects extends MY_Controller {
show_404();
}
if (!$this->_checkAccess($project['id'])) { // check if the user has access
// check if the user has access
if (!$this->_checkAccess($project['id'])) {
show_error(_("Sorry, you don't have access to this project."), 403);
}
// updates the last access
$this->project->updateLastAccess($project['id']);
// mark a shared project as seen
$this->share->markSeen($project['id']);
@@ -186,18 +190,23 @@ class Projects extends MY_Controller {
*/
public function delete($id) {
$project = $this->project->getById($id);
if (!$project || $project['owner'] != $this->session->userdata('user_id')) {
if (!$project) {
show_404();
}
// check if the user has access
if ($project['owner'] != $this->session->userdata('user_id') && !$this->access->isAdmin()) {
show_error(_("Sorry, you don't have access to this project."), 403);
}
$this->load->helper('file');
$projectPath = FCPATH . 'uploads/' . $id;
$projectPath = FCPATH . 'uploads/' . $project['id'];
if (delete_files($projectPath, true)) {
rmdir($projectPath);
}
if ($this->project->delete($id)) {
if ($this->project->delete($project['id'])) {
$this->messages->add(_('The project was deleted.'), 'success');
}
redirect('projects', 303);