Commit c1d4186c authored by Evan Prodromou's avatar Evan Prodromou

Disallow access to events and RSVPs out of scope

parent 7b8fc701
......@@ -77,6 +77,16 @@ class ShoweventAction extends ShownoticeAction
throw new ClientException(_('No such event.'), 404);
}
if (!empty($cur)) {
$curProfile = $cur->getProfile();
} else {
$curProfile = null;
}
if (!$this->notice->inScope($curProfile)) {
throw new ClientException(_('Not available.'), 403);
}
$this->user = User::staticGet('id', $this->event->profile_id);
if (empty($this->user)) {
......
......@@ -83,6 +83,16 @@ class ShowrsvpAction extends ShownoticeAction
throw new ClientException(_('No such RSVP.'), 404);
}
if (!empty($cur)) {
$curProfile = $cur->getProfile();
} else {
$curProfile = null;
}
if (!$this->notice->inScope($curProfile)) {
throw new ClientException(_('Not available.'), 403);
}
$this->user = User::staticGet('id', $this->rsvp->profile_id);
if (empty($this->user)) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment