niklas.ortmann/webprogrammierung
0
0
Fork 0
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Update updateArticle-controller.php

Browse Source
This commit is contained in:
NOrtmann1
2026-07-19 16:00:07 +02:00
parent 0427d52a58
commit d5fc5f3065
1 changed files with 20 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
php/controller/updateArticle-controller.php
+20 -3
View File
@@ -8,6 +8,7 @@ require_once '../model/ArticleManager.php';
require_once '../model/Article.php'; require_once '../model/Article.php';
require_once '../validator/article-validator.php'; require_once '../validator/article-validator.php';
require_once '../../includes/article-block-helper.php'; require_once '../../includes/article-block-helper.php';
require_once '../../includes/csrf.php'; // NEU: CSRF-Schutz
if (!isset($_SESSION["user"])) { if (!isset($_SESSION["user"])) {
header("Location: index.php?pfad=login"); header("Location: index.php?pfad=login");
@@ -16,9 +17,17 @@ if (!isset($_SESSION["user"])) {
if ($_SERVER["REQUEST_METHOD"] === "POST") { if ($_SERVER["REQUEST_METHOD"] === "POST") {
if (isset($_GET["id"]) && !empty($_GET["id"])) { // CSRF-Token prüfen, bevor irgendeine Änderung vorgenommen wird
$id = $_GET["id"]; if (!csrf_verify()) {
} else { $_SESSION["message"] = "invalid_csrf_token";
header("location: ../../index.php?pfad=updateArticle");
exit();
}
// Die Beitrags-ID muss eine gültige numerische ID sein
$id = filter_input(INPUT_GET, "id", FILTER_VALIDATE_INT);
if ($id === false || $id === null) {
$_SESSION["message"] = "missing_id"; $_SESSION["message"] = "missing_id";
header("location: ../../index.php?pfad=updateArticle"); header("location: ../../index.php?pfad=updateArticle");
exit(); exit();
@@ -27,6 +36,14 @@ if ($_SERVER["REQUEST_METHOD"] === "POST") {
try { try {
$articleManager = ArticleManager::getInstance(); $articleManager = ArticleManager::getInstance();
$article = $articleManager->getArticle($id); $article = $articleManager->getArticle($id);
// Existenz des Beitrags prüfen, bevor auf $article zugegriffen wird.
if ($article === null) {
$_SESSION["message"] = "missing_id";
header("location: ../../index.php?pfad=updateArticle");
exit();
}
if ($article->getAuthor() != $_SESSION["user_email"]) { if ($article->getAuthor() != $_SESSION["user_email"]) {
$_SESSION["message"] = "unauthorized_access"; $_SESSION["message"] = "unauthorized_access";
header("location: ../../index.php"); header("location: ../../index.php");