diff options
author | msquare <msquare@notrademark.de> | 2019-10-13 12:59:54 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2019-10-13 12:59:54 +0200 |
commit | b581da01a3dff2e6e8fbb748050442b22a4af213 (patch) | |
tree | 9bf0dcbdb372a9fc66b7273b01b4c24c0f416acf /includes/pages/user_ical.php | |
parent | 592222c4012c833ef8d8a1503988d7e478f68a46 (diff) | |
parent | 35b820cd7de904e50bd78cee197ebd379985ec58 (diff) |
Merge pull request #653 from MyIgel/403-forbidden-exports
Return 403 forbidden on shifts json, atom export and ical export if api key is missing or invalid
Diffstat (limited to 'includes/pages/user_ical.php')
-rw-r--r-- | includes/pages/user_ical.php | 17 |
1 files changed, 10 insertions, 7 deletions
diff --git a/includes/pages/user_ical.php b/includes/pages/user_ical.php index ee3a8340..2f3a7ccc 100644 --- a/includes/pages/user_ical.php +++ b/includes/pages/user_ical.php @@ -1,22 +1,25 @@ <?php +use Engelsystem\Http\Exceptions\HttpForbidden; + /** * Controller for ical output of users own shifts or any user_shifts filter. */ function user_ical() { $request = request(); + $user = auth()->apiUser('key'); - if (!$request->has('key') || !preg_match('/^[\da-f]{32}$/', $request->input('key'))) { - engelsystem_error('Missing key.'); + if ( + !$request->has('key') + || !preg_match('/^[\da-f]{32}$/', $request->input('key')) + || !$user + ) { + throw new HttpForbidden('Missing or invalid key', ['content-type' => 'text/text']); } - $user = auth()->apiUser('key'); - if (!$user) { - engelsystem_error('Key invalid.'); - } if (!auth()->can('ical')) { - engelsystem_error('No privilege for ical.'); + throw new HttpForbidden('Not allowed', ['content-type' => 'text/text']); } $ical_shifts = load_ical_shifts(); |