Skip to content

Commit f9a17bf

Browse files
committed
Notebook: Validate that only the author can edit the note
1 parent 80d1a8c commit f9a17bf

File tree

2 files changed

+12
-3
lines changed

2 files changed

+12
-3
lines changed

main/inc/lib/notebook.lib.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,7 @@ public static function get_note_information($notebook_id)
117117
$notebook_id = (int) $notebook_id;
118118

119119
$sql = "SELECT
120+
user_id,
120121
notebook_id AS notebook_id,
121122
title AS note_title,
122123
description AS note_comment,

main/notebook/index.php

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,8 @@ function setFocus(){
3535
// Tracking
3636
Event::event_access_tool(TOOL_NOTEBOOK);
3737

38-
$action = isset($_GET['action']) ? $_GET['action'] : '';
38+
$currentUserId = api_get_user_id();
39+
$action = $_GET['action'] ?? '';
3940

4041
$logInfo = [
4142
'tool' => TOOL_NOTEBOOK,
@@ -137,6 +138,15 @@ function setFocus(){
137138
exit;
138139
}
139140

141+
// Setting the defaults
142+
$defaults = NotebookManager::get_note_information((int) $_GET['notebook_id']);
143+
144+
if ($currentUserId !== (int) $defaults['user_id']) {
145+
echo Display::return_message(get_lang('NotAllowed'), 'error');
146+
Display::display_footer();
147+
exit();
148+
}
149+
140150
// Initialize the object
141151
$form = new FormValidator(
142152
'note',
@@ -159,8 +169,6 @@ function setFocus(){
159169
);
160170
$form->addButtonUpdate(get_lang('ModifyNote'), 'SubmitNote');
161171

162-
// Setting the defaults
163-
$defaults = NotebookManager::get_note_information(Security::remove_XSS($_GET['notebook_id']));
164172
$form->setDefaults($defaults);
165173

166174
// Setting the rules

0 commit comments

Comments
 (0)