fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-06 18:21:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

본인의 회원 정보만 저장하도록 개선함

Browse source 
만약 member_srl 를 파라미터로 넘겼을 때 본인이 아닌 경우 차단설정을 조회할 수 있는 문제점이 있다.
이를 막고 조회하지 못하도록 개선
This commit is contained in:
BJRambo 2020-03-02 02:58:44 +00:00
parent c627aa9e7c
commit ce03006e3f
2 changed files with 22 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

24
modules/ncenterlite/ncenterlite.view.php
View file

@ -71,7 +71,11 @@ class ncenterliteView extends ncenterlite
Context::set('user_config', $output->data);
$this->setTemplateFile('userconfig');
}
/**
* Get to unsubscribe list.
* @throws \Rhymix\Framework\Exception
*/
function dispNcenterliteUnsubscribeList()
{
/** @var ncenterliteModel $oNcenterliteModel */
@ -95,6 +99,11 @@ class ncenterliteView extends ncenterlite
$member_srl = $this->user->member_srl;
}
if($this->user->is_admin !== 'Y' && $this->user->member_srl != $member_srl)
{
throw new \Rhymix\Framework\Exception('msg_unsubscribe_not_permission');
}
$args = new stdClass();
$args->page = Context::get('page');
$args->list_count = '20';
@ -121,6 +130,16 @@ class ncenterliteView extends ncenterlite
$member_srl = Context::get('member_srl');
if(!$member_srl)
{
$member_srl = $this->user->member_srl;
}
if($this->user->is_admin !== 'Y' && $member_srl !== $this->user->member_srl)
{
throw new \Rhymix\Framework\Exception('msg_invalid_request');
}
if($unsubscribe_srl)
{
$output = $oNcenterliteModel->getUserUnsubscribeConfigByUnsubscribeSrl($unsubscribe_srl);
@ -130,8 +149,7 @@ class ncenterliteView extends ncenterlite
$output = $oNcenterliteModel->getUserUnsubscribeConfigByTargetSrl($target_srl, $member_srl);
}
if((!$target_srl || !$unsubscribe_type) && !$output)
if((!$target_srl || !$unsubscribe_type) && empty($output))
{
throw new Rhymix\Framework\Exceptions\InvalidRequest;
}