goodspeed/Cloudlog
1
0
派生 0
代码 工单 合并请求 项目 版本发布 软件包 百科 动态 Actions

Merge pull request #2287 from int2001/user_auth_fix

浏览代码 
SecFix: Added checking for session when editing or watching profile
这个提交包含在：
Peter Goodhall 2023-07-14 12:04:38 +01:00 提交者 GitHub
当前提交 cfdbf29c78
找不到此签名对应的密钥
GPG 密钥 ID: 4AEE18F83AFDEB23
共有 1 个文件被更改，包括 2 次插入 和 1 次删除
显示统计信息 下载 Patch 文件 下载 Diff 文件 展开所有文件 折叠所有文件

3
application/controllers/User.php
查看文件

@ -178,7 +178,7 @@ class User extends CI_Controller {
function edit() {
$this->load->model('user_model');
if((!$this->user_model->authorize(99)) && ($this->session->userdata('user_id') != $this->uri->segment(3))) { $this->session->set_flashdata('notice', 'You\'re not allowed to do that!'); redirect('dashboard'); }
if ( ($this->session->userdata('user_id') == '') || ((!$this->user_model->authorize(99)) && ($this->session->userdata('user_id') != $this->uri->segment(3))) ) { $this->session->set_flashdata('notice', 'You\'re not allowed to do that!'); redirect('dashboard'); }
$query = $this->user_model->get_by_id($this->uri->segment(3));
$this->load->model('bands');
@ -494,6 +494,7 @@ class User extends CI_Controller {
function profile() {
$this->load->model('user_model');
if(!$this->user_model->authorize(2)) { $this->session->set_flashdata('notice', 'You\'re not allowed to do that!'); redirect('dashboard'); }
$query = $this->user_model->get_by_id($this->session->userdata('user_id'));
$q = $query->row();
$data['page_title'] = "Profile";