diff options
| -rw-r--r-- | protected/controllers/MyAngebotController.php | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/protected/controllers/MyAngebotController.php b/protected/controllers/MyAngebotController.php index d0adfd2..cbd74ad 100644 --- a/protected/controllers/MyAngebotController.php +++ b/protected/controllers/MyAngebotController.php @@ -87,8 +87,12 @@ class MyAngebotController extends Controller if(Yii::app()->request->isPostRequest)
{
// we only allow deletion via POST request
- $this->loadModel($id)->delete();
-
+ $model = $this->loadModel($id);
+ if ($model->verein_id != Yii::app()->user->vereinId) { + throw new CHttpException(401,'Illegal Access! Delete your own data!'); + } else { + $model->delete(); + }
// if AJAX request (triggered by deletion via admin grid view), we should not redirect the browser
if(!isset($_GET['ajax']))
$this->redirect(isset($_POST['returnUrl']) ? $_POST['returnUrl'] : array('admin'));
|