PrivateCoffee/wishthis
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Forbid unauthorised access to user wishlists

Browse source
This commit is contained in:
grandeljay 2022-12-14 16:48:33 +01:00
parent 9d477c6019
commit 68976b70fe
2 changed files with 11 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/api/wishlists.php
View file

@ -133,7 +133,11 @@ switch ($_SERVER['REQUEST_METHOD']) {
/**
* Get user wishlists
*/
$user = isset($_GET['userid']) ? User::getFromID($_GET['userid']) : $_SESSION['user'];
$user = $_SESSION['user'];
if (!$user->isLoggedIn()) {
$this->response(403);
}
$wishlists = array();
$wishlists_items = array();

6
src/classes/api.php
View file

@ -72,4 +72,10 @@ class API
return $request_variables;
}
private function response(int $http_code): void
{
http_response_code($http_code);
die();
}
}