diff --git a/src/controllers/PostsController.ts b/src/controllers/PostsController.ts index 55b96b0..b519e45 100644 --- a/src/controllers/PostsController.ts +++ b/src/controllers/PostsController.ts @@ -203,8 +203,17 @@ export class PostsController { break; - + // Personnal movies + case PostKind.POST_KIND_MOVIE: + const movieID = h.postInt("movieID"); + + if(!await MoviesHelper.DoesUserHas(h.getUserId(), movieID)) + h.error(401, "You are not authorized to use this movie!"); + + newPost.movieID = movieID; + + break; default: diff --git a/src/helpers/MoviesHelper.ts b/src/helpers/MoviesHelper.ts index ac738fc..bdd8a75 100644 --- a/src/helpers/MoviesHelper.ts +++ b/src/helpers/MoviesHelper.ts @@ -1,4 +1,3 @@ -import { RequestHandler } from "../entities/RequestHandler"; import { Movie } from "../entities/Movies"; import { DatabaseHelper } from "./DatabaseHelper"; @@ -46,6 +45,20 @@ export class MoviesHelper { return this.DBToMovie(row); } + /** + * Check out whether a movie belongs to a user or not + * + * @param userID Target user ID + * @param movieID The ID of the movie to check + */ + public static async DoesUserHas(userID: number, movieID: number): Promise { + try { + return (await this.GetInfo(movieID)).userID == userID; + } catch (error) { + return false; + } + } + /** * Turn a database entry into a movie object *