DontSellMe/richdocuments
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Check token by member type, not by file

Browse Source
This commit is contained in:
Victor Dubiniuk 2014-04-10 20:14:45 +03:00
parent a3cc3b3ce3
commit cd4f4d97f5
1 changed files with 13 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
ajax/sessionController.php
View File

@ -70,6 +70,19 @@ class SessionController extends Controller{
} }
$memberId = @$_SERVER['HTTP_WEBODF_MEMBER_ID']; $memberId = @$_SERVER['HTTP_WEBODF_MEMBER_ID'];
$currentMember = new Db_Member();
$currentMemberData = $currentMember->load($memberId)->getData();
if (isset($currentMemberData['is_guest']) && $currentMemberData['is_guest']){
self::preDispatchGuest();
} else {
self::preDispatch();
}
//check if member belongs to the session
if (!isset($currentMemberData['es_id']) || $esId!=$currentMemberData['es_id']){
throw new \Exception($memberId . ' does not belong to session ' . $esId);
}
$sessionRevision = @$_SERVER['HTTP_WEBODF_SESSION_REVISION']; $sessionRevision = @$_SERVER['HTTP_WEBODF_SESSION_REVISION'];
$stream = fopen('php://input','r'); $stream = fopen('php://input','r');
@ -87,11 +100,6 @@ class SessionController extends Controller{
$sessionData = $session->getData(); $sessionData = $session->getData();
try { try {
$file = new File($sessionData['file_id']); $file = new File($sessionData['file_id']);
if (!$file->isPublicShare()){
self::preDispatch();
} else {
self::preDispatchGuest();
}
list($view, $path) = $file->getOwnerViewAndPath(); list($view, $path) = $file->getOwnerViewAndPath();
} catch (\Exception $e){ } catch (\Exception $e){
//File was deleted or unshared. We need to save content as new file anyway //File was deleted or unshared. We need to save content as new file anyway
@ -112,11 +120,6 @@ class SessionController extends Controller{
$members $members
); );
//check if member belongs to the session
if (!in_array($memberId, $memberIds)){
throw new \Exception($memberId . ' does not belong to session ' . $esId);
}
// Active users except current user // Active users except current user
$memberCount = count($memberIds) - 1; $memberCount = count($memberIds) - 1;