AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Do not expose IDs in forms

Browse Source
This commit is contained in:
Frederic Guillot
2017-09-23 20:56:54 -07:00
parent 074f6c104f
commit 3e0f14ae2b
20 changed files with 112 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
app/Controller/CommentController.php
View File

@@ -13,29 +13,6 @@ use Kanboard\Core\Controller\PageNotFoundException;
*/
class CommentController extends BaseController
{
/**
* Get the current comment
*
* @access protected
* @return array
* @throws PageNotFoundException
* @throws AccessForbiddenException
*/
protected function getComment()
{
$comment = $this->commentModel->getById($this->request->getIntegerParam('comment_id'));
if (empty($comment)) {
throw new PageNotFoundException();
}
if (! $this->userSession->isAdmin() && $comment['user_id'] != $this->userSession->getId()) {
throw new AccessForbiddenException();
}
return $comment;
}
/**
* Add comment form
*
@@ -49,14 +26,6 @@ class CommentController extends BaseController
{
$project = $this->getProject();
$task = $this->getTask();
if (empty($values)) {
$values = array(
'user_id' => $this->userSession->getId(),
'task_id' => $task['id'],
);
}
$values['project_id'] = $task['project_id'];
$this->response->html($this->helper->layout->task('comment/create', array(
@@ -106,7 +75,7 @@ class CommentController extends BaseController
public function edit(array $values = array(), array $errors = array())
{
$task = $this->getTask();
$comment = $this->getComment();
$comment = $this->getComment($task);
if (empty($values)) {
$values = $comment;
@@ -130,9 +99,13 @@ class CommentController extends BaseController
public function update()
{
$task = $this->getTask();
$this->getComment();
$comment = $this->getComment($task);
$values = $this->request->getValues();
$values['id'] = $comment['id'];
$values['task_id'] = $task['id'];
$values['user_id'] = $comment['user_id'];
list($valid, $errors) = $this->commentValidator->validateModification($values);
if ($valid) {
@@ -157,7 +130,7 @@ class CommentController extends BaseController
public function confirm()
{
$task = $this->getTask();
$comment = $this->getComment();
$comment = $this->getComment($task);
$this->response->html($this->template->render('comment/remove', array(
'comment' => $comment,
@@ -175,7 +148,7 @@ class CommentController extends BaseController
{
$this->checkCSRFParam();
$task = $this->getTask();
$comment = $this->getComment();
$comment = $this->getComment($task);
if ($this->commentModel->remove($comment['id'])) {
$this->flash->success(t('Comment removed successfully.'));