AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Avoid people to alter other projects by changing form data

Browse Source
This commit is contained in:
Frederic Guillot
2017-09-23 18:48:45 -07:00
parent 8ecaa60340
commit 074f6c104f
26 changed files with 154 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
app/Controller/CategoryController.php
View File

@@ -12,24 +12,6 @@ use Kanboard\Core\Controller\PageNotFoundException;
*/
class CategoryController extends BaseController
{
/**
* Get the category (common method between actions)
*
* @access private
* @return array
* @throws PageNotFoundException
*/
private function getCategory()
{
$category = $this->categoryModel->getById($this->request->getIntegerParam('category_id'));
if (empty($category)) {
throw new PageNotFoundException();
}
return $category;
}
/**
* List of categories for a given project
*
@@ -72,8 +54,9 @@ class CategoryController extends BaseController
public function save()
{
$project = $this->getProject();
$values = $this->request->getValues();
$values['project_id'] = $project['id'];
list($valid, $errors) = $this->categoryValidator->validateCreation($values);
if ($valid) {
@@ -100,7 +83,7 @@ class CategoryController extends BaseController
public function edit(array $values = array(), array $errors = array())
{
$project = $this->getProject();
$category = $this->getCategory();
$category = $this->getCategory($project);
$this->response->html($this->template->render('category/edit', array(
'values' => empty($values) ? $category : $values,
@@ -117,8 +100,12 @@ class CategoryController extends BaseController
public function update()
{
$project = $this->getProject();
$category = $this->getCategory($project);
$values = $this->request->getValues();
$values['project_id'] = $project['id'];
$values['id'] = $category['id'];
list($valid, $errors) = $this->categoryValidator->validateModification($values);
if ($valid) {
@@ -141,7 +128,7 @@ class CategoryController extends BaseController
public function confirm()
{
$project = $this->getProject();
$category = $this->getCategory();
$category = $this->getCategory($project);
$this->response->html($this->helper->layout->project('category/remove', array(
'project' => $project,
@@ -158,7 +145,7 @@ class CategoryController extends BaseController
{
$this->checkCSRFParam();
$project = $this->getProject();
$category = $this->getCategory();
$category = $this->getCategory($project);
if ($this->categoryModel->remove($category['id'])) {
$this->flash->success(t('Category removed successfully.'));