fix: #177 accessing wishlist without permission

src/api/wishlists.php

@@ -108,10 +108,39 @@ switch ($_SERVER['REQUEST_METHOD']) {
         $getOwnWishlists              = $user->isLoggedIn();
 
         if ($getWishlistCardsFromPriority) {
-            $wishlist = Wishlist::getFromId($_GET['wishlist_id']);
+            if (!$user->isLoggedIn()) {
+                http_response_code(403);
+                return;
+            }
 
-            if (false === $wishlist) {
+            $wishlist           = Wishlist::getFromId($_GET['wishlist_id']);
+            $userWishlistsQuery = $database
+            ->query(
+                'SELECT `id`
+                   FROM `wishlists`
+                  WHERE `user` = :wishlist_user_id',
+                array(
+                    'wishlist_user_id' => $user->getId(),
+                )
+            );
+
+            if (false === $wishlist || false === $userWishlistsQuery) {
                 http_response_code(404);
+                return;
+            }
+
+            $userWishlistsResults = \array_map(
+                function ($result) {
+                    return $result['id'];
+                },
+                $userWishlistsQuery->fetchAll()
+            );
+
+            $userOwnsRequestedWishlist = \in_array($wishlist->getId(), $userWishlistsResults, true);
+
+            if (!$userOwnsRequestedWishlist) {
+                http_response_code(403);
+                return;
             }
 
             $priorityAll  = -1;

src/assets/js/default.js

@@ -25,11 +25,18 @@ $(function() {
             modal_failure_content = wishthis.strings.modal.failure.content;
         }
 
+        if (xhr.status && xhr.statusText) {
+            showFailure(
+                xhr.status + ' - ' + xhr.statusText,
+                ''
+            );
+        } else {
             showFailure(
                 wishthis.strings.modal.failure.title,
-            modal_failure_content,
+                modal_failure_content
             );
         }
+    }
     $.fn.api.settings.onError = function(response, element, xhr) {
         var modal_error_content = '';
 
@@ -262,7 +269,7 @@ function showError(title = '', content = '') {
     $('body').modal(modal_error);
 }
 
-function showFailure(title = '', content = '') {
+function showFailure(title = '', content = '', status = 200) {
     var modal_failure = {
         'class'         : 'small',
         'autoShow'      : true,

src/assets/js/parts/wishlists.js

@@ -52,11 +52,6 @@ $(function () {
             wishthis.$_GET.id = wishlist_id;
 
             if (wishlist_id) {
-                /** Get wishlist */
-                fetch('/index.php?page=api&module=wishlists&id=' + wishlist_id, { method: 'GET' })
-                .then(handleFetchError)
-                .then(handleFetchResponse)
-                .then(function(response) {
                 /** Set currently selected wishlist */
                 wishlists.forEach(wishlistI => {
                     if (wishlistI.id === parseInt(wishlist_id)) {
@@ -97,61 +92,6 @@ $(function () {
                         setTimeout(dropdown_wishlists_api, 1);
                     }
                 }, 1);
-                    /** */
-
-                    /*
-                    const get_wishes = new URLSearchParams(
-                        {
-                            'module' : 'wishes',
-                            'page'   : 'api',
-
-                            'wishlist_id'    : wishlist.id,
-                            'wishlist_style' : $('[name="style"]').val(),
-                            'wish_priority'  : -1,
-                        }
-                    );
-                    fetch('/index.php?' + get_wishes, { method: 'GET' })
-                    .then(handleFetchError)
-                    .then(handleFetchResponse)
-                    .then(function(response) {
-                        /** Cards *//*
-                        var wishes         = response.results;
-                        var wishlist_cards = $('.wishlist-cards');
-
-                        wishlist_cards.html('');
-
-                        switch (get_wishes.wishlist_style) {
-                            case 'list':
-                                wishlist_cards.append('<div class="ui one column doubling stackable grid wishlist"></div>');
-                                break;
-
-                            default:
-                                wishlist_cards.append('<div class="ui three column doubling stackable grid wishlist"></div>');
-                                break;
-                        }
-
-                        if (wishes.length > 0) {
-                            wishes.forEach(wish => {
-                                $('.wishlist-cards > .wishlist.grid').append('<div class="column">' + wish.card + '</div>');
-                            });
-                        } else {
-                            $('.wishlist-cards > .wishlist.grid').append(
-                                '<div class="sixteen wide column">' +
-                                    '<div class="ui info icon message">' +
-                                        '<i class="info circle icon"></i> ' +
-                                        '<div class="content">' +
-                                            '<div class="header">' + wishthis.strings.message.wishlist.empty.header + '</div>' +
-                                            '<p>' + wishthis.strings.message.wishlist.empty.content + '</p>' +
-                                        '</div>' +
-                                    '</div>' +
-                                '</div>'
-                            );
-                        }
-
-                        $('.ui.dropdown.wish-options').removeClass('disabled').dropdown();
-                    });
-                    */
-                });
             } else {
                 /** Disable wishlist options buttons */
                 $('.button.wishlist-wish-add').removeClass('disabled');

src/classes/wishthis/Wishlist.php

@@ -28,6 +28,11 @@ class Wishlist
         }
 
         $wishlistData = $wishlistQuery->fetch();
+
+        if (false === $wishlistData) {
+            return false;
+        }
+
         $wishlist = new Wishlist($wishlistData);
 
         return $wishlist;