mirror/wakapi
1
0
Fork 0
mirror of https://github.com/muety/wakapi.git synced 2023-08-10 21:12:56 +03:00
Code Issues Projects Releases Wiki Activity

fix: permissions bug related to deleting language mappings

Browse Source
This commit is contained in:
Ferdinand Mütsch 2021-01-20 20:49:27 +01:00
parent acda62488d
commit 16b683fcbd
2 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
routes/settings.go
View File

@ -115,13 +115,17 @@ func (h *SettingsHandler) DeleteLanguageMapping(w http.ResponseWriter, r *http.R
return
}
mapping := &models.LanguageMapping{
ID: uint(id),
UserID: user.ID,
if mapping, err := h.languageMappingSrvc.GetById(uint(id)); err != nil || mapping == nil {
w.WriteHeader(http.StatusNotFound)
templates[conf.SettingsTemplate].Execute(w, h.buildViewModel(r).WithError("mapping not found"))
return
} else if mapping.UserID != user.ID {
w.WriteHeader(http.StatusForbidden)
templates[conf.SettingsTemplate].Execute(w, h.buildViewModel(r).WithError("not allowed to delete mapping"))
return
}
err = h.languageMappingSrvc.Delete(mapping)
if err != nil {
if err := h.languageMappingSrvc.Delete(&models.LanguageMapping{ID: uint(id)}); err != nil {
w.WriteHeader(http.StatusInternalServerError)
templates[conf.SettingsTemplate].Execute(w, h.buildViewModel(r).WithError("could not delete mapping"))
return

2
views/settings.tpl.html
View File

@ -89,7 +89,7 @@
<form class="float-right" action="settings/language_mappings/delete" method="post">
<input type="hidden" id="mapping_id" name="mapping_id" required value="{{ $mapping.ID }}">
<button type="submit" class="py-1 px-3 rounded bg-red-500 hover:bg-red-600 text-white text-sm">
Remove
X
</button>
</form>
</div>