Avoid people to alter other projects by changing form data

2017-09-23 18:48:45 -07:00
parent 8ecaa60340
commit 074f6c104f
26 changed files with 154 additions and 111 deletions
--- a/app/Controller/ProjectEditController.php
+++ b/app/Controller/ProjectEditController.php
@@ -65,6 +65,8 @@ class ProjectEditController extends BaseController
     */
    private function prepareValues(array $project, array $values)
    {
+        $values['id'] = $project['id'];
+
        if (isset($values['is_private'])) {
            if (! $this->helper->user->hasProjectAccess('ProjectCreationController', 'create', $project['id'])) {
                unset($values['is_private']);