diff options
| author | astaf <astaf@proxy.ccwn.org.ccwn.org> | 2013-05-15 10:59:30 +0200 |
|---|---|---|
| committer | astaf <astaf@proxy.ccwn.org.ccwn.org> | 2013-05-15 10:59:30 +0200 |
| commit | 91907913ffae859611b2316fbc55543ed3183889 (patch) | |
| tree | d4886eaf67c52477e04f441343ba6a874613024c | |
| parent | 9de2cb93d7b70a9f015187060ee856d561023469 (diff) | |
| parent | 90cd9ea89a1e9efffba0eeffadb57d1d37ef98b9 (diff) | |
Merge branch 'master' of ssh://proxy:9044/home/ccwn/git-repos/admin.astaf.de
| -rw-r--r-- | protected/controllers/MyAngebotController.php | 8 | ||||
| -rw-r--r-- | protected/views/myAngebot/_form.php | 2 |
2 files changed, 7 insertions, 3 deletions
diff --git a/protected/controllers/MyAngebotController.php b/protected/controllers/MyAngebotController.php index d0adfd2..cbd74ad 100644 --- a/protected/controllers/MyAngebotController.php +++ b/protected/controllers/MyAngebotController.php @@ -87,8 +87,12 @@ class MyAngebotController extends Controller if(Yii::app()->request->isPostRequest)
{
// we only allow deletion via POST request
- $this->loadModel($id)->delete();
-
+ $model = $this->loadModel($id);
+ if ($model->verein_id != Yii::app()->user->vereinId) { + throw new CHttpException(401,'Illegal Access! Delete your own data!'); + } else { + $model->delete(); + }
// if AJAX request (triggered by deletion via admin grid view), we should not redirect the browser
if(!isset($_GET['ajax']))
$this->redirect(isset($_POST['returnUrl']) ? $_POST['returnUrl'] : array('admin'));
diff --git a/protected/views/myAngebot/_form.php b/protected/views/myAngebot/_form.php index 0ee91d5..25ffad2 100644 --- a/protected/views/myAngebot/_form.php +++ b/protected/views/myAngebot/_form.php @@ -46,7 +46,7 @@ if ($einheiten !== null && '' != $einheiten) { echo Html::einheitenDropDownList($model, 'einheit', $einheiten); } else { - ?><select id="AngebotVerein_einheit" style="display:none;"></select><?php + ?><select id="AngebotVerein_einheit" name="AngebotVerein[einheit]" style="display:none;"></select><?php } ?> <span id="emptyEinheitenTxt" style="display: <?php echo ($einheiten !== null && '' != $einheiten) ? "none" : "inline"?>">Bitte zuerst das Angebot eingeben.</span> |