Use 403 forbidden on shifts json, atom export and ical export

1 files changed, 10 insertions, 7 deletions

diff --git a/includes/pages/user_ical.php b/includes/pages/user_ical.php
index ee3a8340..2f3a7ccc 100644
--- a/includes/pages/user_ical.php
+++ b/includes/pages/user_ical.php
@@ -1,22 +1,25 @@
 <?php
 
+use Engelsystem\Http\Exceptions\HttpForbidden;
+
 /**
  * Controller for ical output of users own shifts or any user_shifts filter.
  */
 function user_ical()
 {
     $request = request();
+    $user = auth()->apiUser('key');
 
-    if (!$request->has('key') || !preg_match('/^[\da-f]{32}$/', $request->input('key'))) {
-        engelsystem_error('Missing key.');
+    if (
+        !$request->has('key')
+        || !preg_match('/^[\da-f]{32}$/', $request->input('key'))
+        || !$user
+    ) {
+        throw new HttpForbidden('Missing or invalid key', ['content-type' => 'text/text']);
     }
 
-    $user = auth()->apiUser('key');
-    if (!$user) {
-        engelsystem_error('Key invalid.');
-    }
     if (!auth()->can('ical')) {
-        engelsystem_error('No privilege for ical.');
+        throw new HttpForbidden('Not allowed', ['content-type' => 'text/text']);
     }
 
     $ical_shifts = load_ical_shifts();