commit f95d4d7cd103477a5ec1af8e6f380d9f70881e68
Author: Tomáš Pašek <pasek.thomas@gmail.com>
Date:   Mon Apr 26 19:05:49 2021 +0200

    Feature #8636 Zabezpečení metod

diff --git a/application/controller/DeleteUserController.php b/application/controller/DeleteUserController.php
index cc2f94d..62398de 100644
--- a/application/controller/DeleteUserController.php
+++ b/application/controller/DeleteUserController.php
@@ -1,6 +1,9 @@
 <?php
 require "../model/DB.php";
 
-$DB = new DB();
+session_start();
 
-$result = $DB->deleteUser($_POST['userId']);
\ No newline at end of file
+if (array_key_exists("loggedIn", $_SESSION) && $_SESSION['loggedIn'] == "true" && array_key_exists("role", $_SESSION) && $_SESSION['role'] == "admin") {
+    $DB = new DB();
+    $result = $DB->deleteUser($_POST['userId']);
+}
\ No newline at end of file
diff --git a/application/controller/GetChangeRequests.php b/application/controller/GetChangeRequests.php
index 5925e1b..b67763b 100644
--- a/application/controller/GetChangeRequests.php
+++ b/application/controller/GetChangeRequests.php
@@ -1,7 +1,9 @@
 <?php
 require "../model/DB.php";
-$DB = new DB();
+session_start();
+if (array_key_exists("loggedIn", $_SESSION) && $_SESSION['loggedIn'] == "true") {
+    $DB = new DB();
+    $results = $DB->getChangeRequests();
 
-$results = $DB->getChangeRequests();
-
-echo json_encode(count($results)==0 ? null : $results);
\ No newline at end of file
+    echo json_encode(count($results) == 0 ? null : $results);
+}
\ No newline at end of file
diff --git a/application/controller/InsertController.php b/application/controller/InsertController.php
index 9e18ddf..637d345 100644
--- a/application/controller/InsertController.php
+++ b/application/controller/InsertController.php
@@ -1,5 +1,7 @@
 <?php
 require "../model/DB.php";
-
-$DB = new DB();
-$DB->insert();
+session_start();
+if (array_key_exists("loggedIn", $_SESSION) && $_SESSION['loggedIn'] == "true") {
+    $DB = new DB();
+    $DB->insert();
+}
diff --git a/application/controller/RegistrationController.php b/application/controller/RegistrationController.php
index b01d59f..387bea4 100644
--- a/application/controller/RegistrationController.php
+++ b/application/controller/RegistrationController.php
@@ -1,5 +1,8 @@
 <?php
 require "../model/DB.php";
-$DB = new DB();
+session_start();
+if (array_key_exists("loggedIn", $_SESSION) && $_SESSION['loggedIn'] == "true" && array_key_exists("role", $_SESSION) && $_SESSION['role'] == "admin") {
+    $DB = new DB();
 
-$result = $DB->createUser($_POST);
+    $result = $DB->createUser($_POST);
+}
diff --git a/application/controller/RemoveChangeRequest.php b/application/controller/RemoveChangeRequest.php
index 9d1da64..07e77e6 100644
--- a/application/controller/RemoveChangeRequest.php
+++ b/application/controller/RemoveChangeRequest.php
@@ -1,5 +1,8 @@
 <?php
 require "../model/DB.php";
-$DB = new DB();
+session_start();
+if (array_key_exists("loggedIn", $_SESSION) && $_SESSION['loggedIn'] == "true") {
+    $DB = new DB();
 
-$DB->removeChangeRequest($_POST["requestId"]);
+    $DB->removeChangeRequest($_POST["requestId"]);
+}
diff --git a/application/controller/RemoveController.php b/application/controller/RemoveController.php
index c95db65..33ffb96 100644
--- a/application/controller/RemoveController.php
+++ b/application/controller/RemoveController.php
@@ -1,4 +1,8 @@
 <?php
 require "../model/DB.php";
-$DB = new DB();
-$DB->remove();
\ No newline at end of file
+session_start();
+
+if (array_key_exists("loggedIn", $_SESSION) && $_SESSION['loggedIn'] == "true") {
+    $DB = new DB();
+    $DB -> remove();
+}
\ No newline at end of file
diff --git a/application/controller/UpdateController.php b/application/controller/UpdateController.php
index a113373..7022977 100644
--- a/application/controller/UpdateController.php
+++ b/application/controller/UpdateController.php
@@ -1,5 +1,8 @@
 <?php
 require "../model/DB.php";
+session_start();
 
-$DB = new DB();
-$DB->update();
+if (array_key_exists("loggedIn", $_SESSION) && $_SESSION['loggedIn'] == "true") {
+    $DB = new DB();
+    $DB->update();
+}
diff --git a/application/controller/UpdateUserRoleController.php b/application/controller/UpdateUserRoleController.php
index 9ea3d5f..ea4ce8f 100644
--- a/application/controller/UpdateUserRoleController.php
+++ b/application/controller/UpdateUserRoleController.php
@@ -1,10 +1,12 @@
 <?php
 require "../model/DB.php";
 session_start();
-if ($_SESSION['role'] == "admin") {
+
+if (array_key_exists("loggedIn", $_SESSION) && $_SESSION['loggedIn'] == "true" && array_key_exists("role", $_SESSION) && $_SESSION['role'] == "admin") {
     $DB = new DB();
 
     $results = $DB->updateUserRole($_POST["userId"], $_POST["role"]);
 
     echo json_encode(count($results) == 0 ? null : $results);
 }
+
diff --git a/application/controller/UsersListController.php b/application/controller/UsersListController.php
index 1f2feac..fb1b916 100644
--- a/application/controller/UsersListController.php
+++ b/application/controller/UsersListController.php
@@ -2,7 +2,7 @@
 require "../model/DB.php";
 session_start();
 
-if ($_SESSION['role'] == "admin") {
+if (array_key_exists("loggedIn", $_SESSION) && $_SESSION['loggedIn'] == "true" && array_key_exists("role", $_SESSION) && $_SESSION['role'] == "admin") {
     $DB = new DB();
 
     $results = $DB->select("SELECT id, username, role from USERS", array());
diff --git a/application/model/DB.php b/application/model/DB.php
index ced4fd9..c37440d 100644
--- a/application/model/DB.php
+++ b/application/model/DB.php
@@ -703,20 +703,17 @@ class DB {
 
     }
 
+    function remove(){
+        // ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| Tabulka dd_manuscript |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+        if (array_key_exists("id", $_POST) && $_POST['id'] != "") {
+            $query = "DELETE FROM dd_manuscript WHERE";
+            $query .= " wordform_id = :wordform_id ;";
+            $this->stmt = $this->pdo->prepare($query);
+            $this->stmt->bindParam(':wordform_id', $_POST['id'], PDO::PARAM_INT);
+            $this->stmt->execute();
+        }
 
-}
-
-function remove(){
-    // ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| Tabulka dd_manuscript |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-    if (array_key_exists("id", $_POST) && $_POST['id'] != "") {
-        $query = "DELETE FROM dd_manuscript WHERE";
-        $query .= " wordform_id = :wordform_id ;";
-        $this->stmt = $this->pdo->prepare($query);
-        $this->stmt->bindParam(':wordform_id', $_POST['id'], PDO::PARAM_INT);
-        $this->stmt->execute();
-    }
-
-    // ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| Tabulka dd_lemma |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+        // ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| Tabulka dd_lemma |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 
         /*if (array_key_exists("lemma", $_POST) && $_POST['lemma'] != "") {
             $query = "DELETE FROM dd_lemma WHERE";
@@ -725,7 +722,7 @@ function remove(){
             $this->stmt->bindParam(':lemma_id', $lemma["id"], PDO::PARAM_INT);
             $this->stmt->execute();
         } TODO: fix lemma*/
-    // ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| Tabulka dd_tag |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+        // ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| Tabulka dd_tag |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 
         /*if (array_key_exists("tag", $_POST) && $_POST['tag'] != "") {
             $query = "DELETE FROM dd_tag WHERE";
@@ -735,14 +732,16 @@ function remove(){
             $this->stmt->execute();
         } TODO: fix tag */
 
-    // ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| Tabulka dd_wordform |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-    if (array_key_exists("id", $_POST) && $_POST['id'] != "") {
-        $query = "DELETE FROM dd_wordform WHERE";
-        $query .= " id = :id ;";
-        $this->stmt = $this->pdo->prepare($query);
-        $this->stmt->bindParam(':id', $_POST['id'], PDO::PARAM_INT);
-        $this->stmt->execute();
+        // ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| Tabulka dd_wordform |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+        if (array_key_exists("id", $_POST) && $_POST['id'] != "") {
+            $query = "DELETE FROM dd_wordform WHERE";
+            $query .= " id = :id ;";
+            $this->stmt = $this->pdo->prepare($query);
+            $this->stmt->bindParam(':id', $_POST['id'], PDO::PARAM_INT);
+            $this->stmt->execute();
+        }
     }
+
 }
 
 // (D) DATABASE SETTINGS - CHANGE TO YOUR OWN!
@@ -750,4 +749,4 @@ define('DB_HOST', 'localhost');
 define('DB_NAME', 'dalimil2');
 define('DB_CHARSET', 'utf8');
 define('DB_USER', 'postgres');
-define('DB_PASSWORD', 'x');
\ No newline at end of file
+define('DB_PASSWORD', 'a');
\ No newline at end of file
