diff --git a/Changelog b/Changelog index 3544ac5aa..f3049c7dc 100755 --- a/Changelog +++ b/Changelog @@ -1,4 +1,5 @@ 2018-02-01 DariusIII + * Chg: Add check for users when deleting profile so they do not delete another users profile * Chg: Remove occurences of ROLE_GUEST as that role is removed 2018-01-31 DariusIII * Chg: Add option to users to delete their account from profile page diff --git a/public/pages/BasePage.php b/public/pages/BasePage.php index 773e25845..dc02d3e0e 100644 --- a/public/pages/BasePage.php +++ b/public/pages/BasePage.php @@ -277,6 +277,14 @@ class BasePage die(view('errors.503')); } + /** + * Show 503 page. + */ + public function showBadBoy(): void + { + die(view('errors.badboy')); + } + /** * Show maintenance page. */ diff --git a/public/pages/profile_delete.php b/public/pages/profile_delete.php index b42b5793b..6cef3703c 100644 --- a/public/pages/profile_delete.php +++ b/public/pages/profile_delete.php @@ -8,8 +8,10 @@ if (! User::isLoggedIn()) { $userId = $_GET['id']; -if ($userId !== null) { +if ($userId !== null && (int) $userId === User::currentUserId()) { User::logout(); User::deleteUser($userId); header('Location: '.WWW_TOP.'/'); +} else { + $page->showBadBoy(); } diff --git a/resources/views/errors/badboy.blade.php b/resources/views/errors/badboy.blade.php new file mode 100644 index 000000000..c77d68abf --- /dev/null +++ b/resources/views/errors/badboy.blade.php @@ -0,0 +1,11 @@ +@extends('errors.layout') + +@section('title') + You bad boy! +@endsection + +@section('content') + You tried to delete another users account! +@endsection + + diff --git a/resources/views/errors/layout.blade.php b/resources/views/errors/layout.blade.php index 38f21433c..269bd33b7 100755 --- a/resources/views/errors/layout.blade.php +++ b/resources/views/errors/layout.blade.php @@ -41,9 +41,7 @@
-
- @yield('content') -
+ @yield('content')
\ No newline at end of file