diff --git a/RestControllers/friendsController.php b/RestControllers/friendsController.php index bf2894d..f0d580c 100644 --- a/RestControllers/friendsController.php +++ b/RestControllers/friendsController.php @@ -44,6 +44,14 @@ class friendsController{ //Extract informations and process request $friendID = toInt($_POST['friendID']); + //Check friendID validity + if(!check_user_id($friendID)) + Rest_fatal_error(401, "The user ID you specified is invalid !"); + + //Check if the user exists + if(!CS::get()->components->user->exists($friendID)) + Rest_fatal_error(401, "Specifed user does not exist!"); + //Check if the two persons are already friend if(CS::get()->components->friends->are_friend(userID, $friendID)) Rest_fatal_error(401, "The two personns are already friend !"); diff --git a/classes/components/user.php b/classes/components/user.php index c7ee6b1..a8d53e2 100644 --- a/classes/components/user.php +++ b/classes/components/user.php @@ -295,7 +295,7 @@ class User{ * @param Integer $userID The ID of the user to check * @return Boolean Depends of the existence of the user */ - public function exists($userID){ + public function exists(int $userID) : bool { //Perform a request on the database $tableName = $this->userTable; $condition = "WHERE ID = ?"; diff --git a/functions/requests.php b/functions/requests.php index 93f32e4..846d54e 100644 --- a/functions/requests.php +++ b/functions/requests.php @@ -119,4 +119,18 @@ function safe_for_sql(string $input) : string { return $input; +} + +/** + * Check a given user ID + * + * @param int $userID The user ID to check + * @return bool True if userID is valid, false else + */ +function check_user_id(int $userID) : bool { + + if($userID < 1) + return false; //Invalid + + return true; //Valid } \ No newline at end of file