Security for user editing only their own content

Web/Attributes/LogOwnerAuthorizeAttribute.cs

@@ -0,0 +1,32 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Security;
+using System.Web;
+using System.Web.Mvc;
+using MileageTraker.Web.DAL;
+using MileageTraker.Web.Models;
+
+namespace MileageTraker.Web.Attributes
+{
+	public class LogOwnerAuthorizeAttribute : AuthorizeAttribute
+	{
+		protected override bool AuthorizeCore(HttpContextBase httpContext)
+		{
+			var authorized = base.AuthorizeCore(httpContext);
+			if (!authorized)
+			{
+				return false;
+			}
+
+			var rd = httpContext.Request.RequestContext.RouteData;
+
+			var id = int.Parse(rd.Values["id"].ToString());
+			var dataService = new DataService();
+			var log = dataService.GetLog(id);
+
+			var userName = httpContext.User.Identity.Name;
+			return log.User.Username == userName;
+		}
+	}
+}