#477

intelliants · Jul 3, 2017 · 8c08d7b · 8c08d7b · rudSarkar · Jul 6, 2017
1 parent 4abfe96
commit 8c08d7b
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 6 deletions.
diff --git a/modules/blog/index.php b/modules/blog/index.php
@@ -89,8 +89,7 @@
                     $messages[] = iaLanguage::get('title_is_empty');
                 }
 
-                $entry['body'] = iaUtil::safeHTML($_POST['body']);
-                utf8_is_valid($entry['body']) || $entry['body'] = utf8_bad_replace($entry['body']);
+                $entry['body'] = iaUtil::safeHTML(utf8_bad_replace($_POST['body']));
 
                 if (empty($entry['body'])) {
                     $messages[] = iaLanguage::getf('field_is_empty', ['field' => iaLanguage::get('body')]);
@@ -151,13 +150,21 @@
                 return iaView::errorPage(iaView::ERROR_NOT_FOUND);
             }
 
+            if (!iaUsers::hasIdentity()) {
+                return iaView::errorPage(iaView::ERROR_UNAUTHORIZED);
+            }
+
             $id = (int)$iaCore->requestPath[0];
-            $entry = $iaDb->row(iaDb::ALL_COLUMNS_SELECTION, iaDb::convertIds($id));
+            $entry = $iaBlog->getById($id);
 
             if (!$entry) {
                 return iaView::errorPage(iaView::ERROR_NOT_FOUND);
             }
 
+            if ($entry['member_id'] != iaUsers::getIdentity()->id) {
+                return iaView::errorPage(iaView::ERROR_FORBIDDEN);
+            }
+
             $result = $iaBlog->delete($id);
 
             $iaView->setMessages(iaLanguage::get($result ? 'deleted' : 'db_error'), $result ? iaView::SUCCESS : iaView::ERROR);

diff --git a/modules/blog/install.xml b/modules/blog/install.xml
@@ -31,9 +31,9 @@
 		<object meta_object="admin_page" id="blog" action="delete" access="1">Delete blog entry</object>
 
 		<object id="blog" access="1">View blog entries</object>
-		<object id="blog" action="add" access="0">Add blog entry</object>
-		<object id="blog" action="edit" access="0">Edit blog entry</object>
-		<object id="blog" action="delete" access="0">Delete blog entry</object>
+		<object id="blog" action="add" access="1">Add blog entry</object>
+		<object id="blog" action="edit" access="1">Edit blog entry</object>
+		<object id="blog" action="delete" access="1">Delete blog entry</object>
 	</permissions>
 
 	<phrases>