Fixed security based on customer id on add and edit book

TeamEver · Nov 30, 2020 · e91deb9 · e91deb9
1 parent 82b6962
commit e91deb9
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 10 deletions.
diff --git a/controllers/front/addbook.php b/controllers/front/addbook.php
@@ -67,13 +67,6 @@ public function initContent()
                 $link->getPageLink('authentication', true)
             );
         }
-
-        if ($cart->id_customer == 0
-            || !$this->module->active) {
-            Tools::redirect(
-                $link->getPageLink('my-account', true)
-            );
-        }
         if ((bool)EverPsBookstoreSeller::isBookstoreSeller() === false) {
             Tools::redirect(
                 $link->getPageLink('my-account', true)
@@ -136,7 +129,7 @@ public function postProcess()
                 );
             }
             $bookstore_seller = EverPsBookstoreSeller::getBookstoreSellerByCustomerId(
-                (int)Tools::getValue('id_bookstore_seller')
+                (int)Context::getContext()->customer->id
             );
             if (!Validate::isLoadedObject($bookstore_seller)
                 || (int)$bookstore_seller->id <= 0

diff --git a/controllers/front/editbook.php b/controllers/front/editbook.php
@@ -162,7 +162,7 @@ public function postProcess()
             }
             // Secure also on submit AND getting customer id
             $bookstore_seller = EverPsBookstoreSeller::getBookstoreSellerByCustomerId(
-                (int)Tools::getValue('id_bookstore_seller')
+                (int)Context::getContext()->customer->id
             );
             if (!Validate::isLoadedObject($bookstore_seller)
                 || (int)$bookstore_seller->id <= 0

diff --git a/everpsbookstore.php b/everpsbookstore.php
@@ -34,7 +34,7 @@ public function __construct()
     {
         $this->name = 'everpsbookstore';
         $this->tab = 'others';
-        $this->version = '2.1.4';
+        $this->version = '2.1.5';
         $this->author = 'Team Ever';
         $this->need_instance = 0;
         $this->bootstrap = true;
@@ -560,6 +560,7 @@ protected function postProcess()
         EverPsBookstoreSeller::cleanBookstoreSellers(
             (int)Context::getContext()->shop->id
         );
+        Tools::clearAllCache();
     }
 
     /**