Security for user editing only their own content

2014-01-22 21:48:15 -05:00
parent 0ef5199048
commit a441de1a45
4 changed files with 38 additions and 1 deletions
@@ -1,5 +1,6 @@
 using System;
 using System.Linq;
+using System.Security;
 using System.Web.Mvc;
 using MileageTraker.Web.Attributes;
 using MileageTraker.Web.Models;
@@ -36,6 +37,7 @@ namespace MileageTraker.Web.Controllers
 			return View(model);
 		}

+		[LogOwnerAuthorize]
 		public ActionResult EditPast(int id)
 		{
 			var log = DataService.GetLog(id);
@@ -53,6 +55,8 @@ namespace MileageTraker.Web.Controllers
 			if (ModelState.IsValid)
 			{
 				var log = DataService.GetLog(viewModel.LogId);
+				if (log.User.Username != User.Identity.Name)
+					throw new SecurityException();
 				viewModel.SetProperties(log);

 				if (viewModel.Purpose != null)