Revize f95d4d7c

Feature #8636 Zabezpečení metod

application/controller/UpdateUserRoleController.php

@@ -1 +1 @@
 <?php
 require "../model/DB.php";
 session_start();
-if ($_SESSION['role'] == "admin") {
+
+if (array_key_exists("loggedIn", $_SESSION) && $_SESSION['loggedIn'] == "true" && array_key_exists("role", $_SESSION) && $_SESSION['role'] == "admin") {
     $DB = new DB();
 
     $results = $DB->updateUserRole($_POST["userId"], $_POST["role"]);
 
     echo json_encode(count($results) == 0 ? null : $results);
 }
+