liquid_feedback_frontend
view app/main/draft/_action/add.lua @ 9:0ee1e0c42d4c
Version beta5
Minor security fix: Added missing security filter for admin section. Reading of member listing including login names was possible for all users. Write access has not been possible though.
Changing of name and login is possible while a history of these changes is written and accessible by all users.
Statistics shown in area list
Trimming of user input also converts multiple whitespaces to single space character.
Minor security fix: Added missing security filter for admin section. Reading of member listing including login names was possible for all users. Write access has not been possible though.
Changing of name and login is possible while a history of these changes is written and accessible by all users.
Statistics shown in area list
Trimming of user input also converts multiple whitespaces to single space character.
| author | bsw |
|---|---|
| date | Mon Jan 04 12:00:00 2010 +0100 (2010-01-04) |
| parents | afd9f769c7ae |
| children | 72c5e0ee7c98 |
line source
1 local tmp = db:query({ "SELECT text_entries_left FROM member_contingent_left WHERE member_id = ?", app.session.member.id }, "opt_object")
2 if tmp and tmp.text_entries_left and tmp.text_entries_left < 1 then
3 slot.put_into("error", _"Sorry, you have reached your personal flood limit. Please be slower...")
4 return false
5 end
7 local initiative = Initiative:by_id(param.get("initiative_id", atom.integer))
9 -- TODO important m1 selectors returning result _SET_!
10 local issue = initiative:get_reference_selector("issue"):for_share():single_object_mode():exec()
12 if issue.closed then
13 slot.put_into("error", _"This issue is already closed.")
14 return false
15 elseif issue.half_frozen then
16 slot.put_into("error", _"This issue is already frozen.")
17 return false
18 end
20 if Initiator:by_pk(initiative.id, app.session.member.id) then
21 local draft = Draft:new()
22 draft.author_id = app.session.member.id
23 draft.initiative_id = initiative.id
24 local formatting_engine = param.get("formatting_engine")
25 local formatting_engine_valid = false
26 for fe, dummy in pairs(config.formatting_engine_executeables) do
27 if formatting_engine == fe then
28 formatting_engine_valid = true
29 end
30 end
31 if not formatting_engine_valid then
32 error("invalid formatting engine!")
33 end
34 draft.formatting_engine = formatting_engine
35 draft.content = param.get("content")
36 draft:save()
38 slot.put_into("notice", _"New draft has been added to initiative")
40 else
41 error('access denied')
42 end