deleteArticle -> Autorisierungsprüfung

2026-06-05 11:27:43 +02:00
parent 11da418f60
commit d42dff1165
3 changed files with 25 additions and 7 deletions
@@ -147,9 +147,18 @@ class DatabaseArticleManager implements ArticleManagerDAO {
        }
    }

-    public function deleteArticle($id)
+    public function deleteArticle($id, $author)
    {
-        // TODO: Sollte auch die Autorisierung prüfen...
+        $article = getArticle($id);
+        if (empty($article)) {
+            throw new NotFoundException("not_found_article");
+        }
+
+        // Berechtigungsprüfung:
+        if ($article->getAuthor() !== $author) {
+            throw new UnauthorizedAccessException("unauthorized_access");
+        }
+
        try {
            $db = $this->getConnection();
            $sql = "DELETE FROM articles WHERE id = :id;";