Added Class.hasAccess to validate user input and add security

lib/Class.js

@@ -196,6 +196,14 @@ class Class {
 		return await Promise.all(testObjects);
 	}
 
+	async hasAccess(u) {
+		const userClasses = await u.getClasses();
+
+		return userClasses.filter(c => {
+			return c.id === this.id;
+		}).length;
+	}
+
 	addTeacher() {
 
 	}

routes/class.js

@@ -31,6 +31,9 @@ router.get('/class/:id', async (req, res) => {
 		});
 	}
 
+	if (!await c.hasAccess(await new User(null, req.session.userId)))
+		return res.redirect('/admin/classes');
+
 	const linkRoot = `/class/${c.id}`;
 
 	return res.render('class', {