From b9aad5580e012978c5eb9bb35e57def4b01d5927 Mon Sep 17 00:00:00 2001 From: schneefux Date: Tue, 7 Jun 2016 18:48:09 +0200 Subject: throw 403 for unauthorized actions --- app.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) (limited to 'app.py') diff --git a/app.py b/app.py index 7f835ca..12f3f2e 100644 --- a/app.py +++ b/app.py @@ -319,8 +319,9 @@ def edit(): text = request.form['text'] page = request.form['redirpage'] objectId = int(request.form['id']) - if objectId in db().getUserJokes(userid()): - db().updateJoke(text, objectId) + if objectId not in db().getUserJokes(userid()): + abort(403) + db().updateJoke(text, objectId) return redirect('/page/' + page) @app.route('/upvote', methods=['POST']) @@ -354,16 +355,18 @@ def report(): def delete(): objectId = int(request.form['id']) page = request.form['redirpage'] - if objectId in db().getUserJokes(userid()): - db().removeJoke(objectId, userid()) + if objectId not in db().getUserJokes(userid()): + abort(403) + db().removeJoke(objectId, userid()) return redirect('/page/' + page) @app.route('/undelete', methods=['POST']) def undelete(): objectId = int(request.form['id']) page = request.form['redirpage'] - if objectId in db().getUserJokes(userid()): - db().unvoteJoke(objectId, userid()) + if objectId not in db().getUserJokes(userid()): + abort(403) + db().unvoteJoke(objectId, userid()) return redirect('/page/' + page) @app.route('/login', methods=['POST']) -- cgit v1.3.1