diff options
| author | Danail Dimitrov <danaildimitrov321@gmail.com> | 2021-01-03 21:49:47 +0200 |
|---|---|---|
| committer | Danail Dimitrov <danaildimitrov321@gmail.com> | 2021-01-03 21:49:47 +0200 |
| commit | be9c9e7721610536259f1ea997c259956c894bbd (patch) | |
| tree | 57db31d4fe42376d3e45cfba59d4b6bd21ec1329 /src/DevHive.Web/Controllers | |
| parent | 278130d86378a6b2db6ba443631f303fb7d7e207 (diff) | |
| download | DevHive-be9c9e7721610536259f1ea997c259956c894bbd.tar DevHive-be9c9e7721610536259f1ea997c259956c894bbd.tar.gz DevHive-be9c9e7721610536259f1ea997c259956c894bbd.zip | |
added user validation for deleting and updating comments
Diffstat (limited to 'src/DevHive.Web/Controllers')
| -rw-r--r-- | src/DevHive.Web/Controllers/PostController.cs | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/src/DevHive.Web/Controllers/PostController.cs b/src/DevHive.Web/Controllers/PostController.cs index 397ddbc..60c3935 100644 --- a/src/DevHive.Web/Controllers/PostController.cs +++ b/src/DevHive.Web/Controllers/PostController.cs @@ -92,8 +92,11 @@ namespace DevHive.Web.Controllers [HttpPut] [Route("Comment")] - public async Task<IActionResult> UpdateComment(Guid id, [FromBody] CommentWebModel commentWebModel) + public async Task<IActionResult> UpdateComment(Guid id, [FromBody] CommentWebModel commentWebModel, [FromHeader] string authorization) { + if (!await this._postService.ValidateJwtForComment(id, authorization)) + return new UnauthorizedResult(); + UpdateCommentServiceModel updateCommentServiceModel = this._postMapper.Map<UpdateCommentServiceModel>(commentWebModel); updateCommentServiceModel.Id = id; @@ -119,8 +122,11 @@ namespace DevHive.Web.Controllers [HttpDelete] [Route("Comment")] - public async Task<IActionResult> DeleteComment(Guid id) + public async Task<IActionResult> DeleteComment(Guid id, [FromHeader] string authorization) { + if (!await this._postService.ValidateJwtForComment(id, authorization)) + return new UnauthorizedResult(); + bool result = await this._postService.DeleteComment(id); if (!result) |