arno/lychee
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Detect accesses to admin functions by guests.

Browse Source 
This commit detects accesses to admin functions when the user is a guest
and returns a corresponding error. This is now used to redirect the user
to the start page instead of "non-existing function". It has the
advantage that a bug in Lychee, that causes a non-existing function
to be called, can be spotted easier.
This commit is contained in:
Nils Asmussen 2016-08-20 11:42:37 +02:00
parent 0f1de0738c
commit 21b2f587d5
2 changed files with 33 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
php/Access/Guest.php
View File

@ -34,12 +34,43 @@ final class Guest extends Access {
case 'Album::getArchive': self::getAlbumArchiveAction(); break;
case 'Photo::getArchive': self::getPhotoArchiveAction(); break;
// Admin functions
case 'Album::add':
case 'Album::setTitle':
case 'Album::setDescription':
case 'Album::setPublic':
case 'Album::delete':
case 'Album::merge':
case 'Photo::setTitle':
case 'Photo::setDescription':
case 'Photo::setStar':
case 'Photo::setPublic':
case 'Photo::setAlbum':
case 'Photo::setTags':
case 'Photo::duplicate':
case 'Photo::delete':
case 'Photo::add':
case 'Import::url':
case 'Import::server':
case 'search':
case 'Settings::setLogin':
case 'Settings::setSorting':
case 'Settings::setDropboxKey':
self::adminAction();
break;
}
self::fnNotFound();
}
private static function adminAction() {
Response::error('Function not available for guests.');
}
// Albums functions
private static function getAlbumsAction() {

4
src/scripts/lychee.js
View File

@ -424,8 +424,8 @@ lychee.html = function(literalSections, ...substs) {
lychee.error = function(errorThrown, params, data) {
// if the requested function was not found, our cookie has probably expired
if (data.startsWith('Error: Function not found!')) {
// in this case, our cookie has probably expired
if (data.startsWith('Error: Function not available for guests.')) {
lychee.restart()
return
}