File tree Expand file tree Collapse file tree 2 files changed +12
-3
lines changed Expand file tree Collapse file tree 2 files changed +12
-3
lines changed Original file line number Diff line number Diff line change @@ -117,6 +117,7 @@ public static function get_note_information($notebook_id)
117
117
$ notebook_id = (int ) $ notebook_id ;
118
118
119
119
$ sql = "SELECT
120
+ user_id,
120
121
notebook_id AS notebook_id,
121
122
title AS note_title,
122
123
description AS note_comment,
Original file line number Diff line number Diff line change @@ -35,7 +35,8 @@ function setFocus(){
35
35
// Tracking
36
36
Event::event_access_tool (TOOL_NOTEBOOK );
37
37
38
- $ action = isset ($ _GET ['action ' ]) ? $ _GET ['action ' ] : '' ;
38
+ $ currentUserId = api_get_user_id ();
39
+ $ action = $ _GET ['action ' ] ?? '' ;
39
40
40
41
$ logInfo = [
41
42
'tool ' => TOOL_NOTEBOOK ,
@@ -137,6 +138,15 @@ function setFocus(){
137
138
exit ;
138
139
}
139
140
141
+ // Setting the defaults
142
+ $ defaults = NotebookManager::get_note_information ((int ) $ _GET ['notebook_id ' ]);
143
+
144
+ if ($ currentUserId !== (int ) $ defaults ['user_id ' ]) {
145
+ echo Display::return_message (get_lang ('NotAllowed ' ), 'error ' );
146
+ Display::display_footer ();
147
+ exit ();
148
+ }
149
+
140
150
// Initialize the object
141
151
$ form = new FormValidator (
142
152
'note ' ,
@@ -159,8 +169,6 @@ function setFocus(){
159
169
);
160
170
$ form ->addButtonUpdate (get_lang ('ModifyNote ' ), 'SubmitNote ' );
161
171
162
- // Setting the defaults
163
- $ defaults = NotebookManager::get_note_information (Security::remove_XSS ($ _GET ['notebook_id ' ]));
164
172
$ form ->setDefaults ($ defaults );
165
173
166
174
// Setting the rules
You can’t perform that action at this time.
0 commit comments