AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Do not expose IDs in forms

Browse Source
This commit is contained in:
Frederic Guillot
2017-09-23 20:56:54 -07:00
parent 074f6c104f
commit 3e0f14ae2b
20 changed files with 112 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
app/Controller/SubtaskController.php
View File

@@ -66,6 +66,7 @@ class SubtaskController extends BaseController
{
$task = $this->getTask();
$values = $this->request->getValues();
$values['task_id'] = $task['id'];
list($valid, $errors) = $this->subtaskValidator->validateCreation($values);
@@ -103,7 +104,7 @@ class SubtaskController extends BaseController
public function edit(array $values = array(), array $errors = array())
{
$task = $this->getTask();
$subtask = $this->getSubtask();
$subtask = $this->getSubtask($task);
$this->response->html($this->template->render('subtask/edit', array(
'values' => empty($values) ? $subtask : $values,
@@ -123,9 +124,12 @@ class SubtaskController extends BaseController
public function update()
{
$task = $this->getTask();
$this->getSubtask();
$subtask = $this->getSubtask($task);
$values = $this->request->getValues();
$values['id'] = $subtask['id'];
$values['task_id'] = $task['id'];
list($valid, $errors) = $this->subtaskValidator->validateModification($values);
if ($valid) {
@@ -149,7 +153,7 @@ class SubtaskController extends BaseController
public function confirm()
{
$task = $this->getTask();
$subtask = $this->getSubtask();
$subtask = $this->getSubtask($task);
$this->response->html($this->template->render('subtask/remove', array(
'subtask' => $subtask,
@@ -166,7 +170,7 @@ class SubtaskController extends BaseController
{
$this->checkCSRFParam();
$task = $this->getTask();
$subtask = $this->getSubtask();
$subtask = $this->getSubtask($task);
if ($this->subtaskModel->remove($subtask['id'])) {
$this->flash->success(t('Sub-task removed successfully.'));