matt/stratos
1
0
Fork 0
mirror of https://github.com/matt-fidd/stratos.git synced 2026-01-02 12:39:28 +00:00
Code Issues Projects Releases Wiki Activity

Added protection against non-teacher deletions, edits etc...

Browse Source
This commit is contained in:
matt
2022-04-22 04:04:35 +00:00
parent c519e1e699
commit b46e7cf7c1
4 changed files with 47 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
routes/singleTest.js
View File

@@ -57,6 +57,9 @@ router.get('/:id', async (req, res) => {
});
router.post('/:id/delete', async (req, res) => {
if (req.session.userType !== 'account')
return res.redirect('/admin/tests');
const t = req.test;
await t.delete();
@@ -65,6 +68,9 @@ router.post('/:id/delete', async (req, res) => {
router.get('/:id/results', async (req, res) => {
if (req.session.userType !== 'account')
return res.redirect('/admin/tests');
const t = req.test;
const linkRoot = `/admin/test/${t.id}/results`;
@@ -85,6 +91,9 @@ router.get('/:id/results', async (req, res) => {
});
router.post('/:id/results/:resultId/edit', async (req, res) => {
if (req.session.userType !== 'account')
return res.redirect('/admin/tests');
const t = req.test;
const tr = await new TestResult(req.db, req.params.resultId);
@@ -108,6 +117,9 @@ router.post('/:id/results/:resultId/edit', async (req, res) => {
});
router.post('/:id/results/:resultId/delete', async (req, res) => {
if (req.session.userType !== 'account')
return res.redirect('/admin/tests');
const t = req.test;
const tr = await new TestResult(req.db, req.params.resultId);
const returnURL = `/admin/test/${t.id}/results`;
@@ -118,6 +130,9 @@ router.post('/:id/results/:resultId/delete', async (req, res) => {
});
router.get('/:id/results/add', async (req, res) => {
if (req.session.userType !== 'account')
return res.redirect('/admin/tests');
const t = req.test;
const linkRoot = `/admin/test/${t.id}/results`;
@@ -139,6 +154,9 @@ router.get('/:id/results/add', async (req, res) => {
});
router.post('/:id/results/add', async (req, res) => {
if (req.session.userType !== 'account')
return res.redirect('/admin/tests');
const t = req.test;
const returnURL = `/admin/test/${t.id}/results`;