Ensure user can only see Post for the jam it's attached to

GameMakersToolkit · Mar 21, 2024 · 5b9345a · 5b9345a
1 parent cac7787
commit 5b9345a
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 3 deletions.
diff --git a/api/src/main/kotlin/com/gmtkgamejam/routing/PostRoutes.kt b/api/src/main/kotlin/com/gmtkgamejam/routing/PostRoutes.kt
@@ -56,7 +56,12 @@ fun Application.configurePostRouting() {
 
             get("{id}") {
                 val post: PostItem? = call.parameters["id"]?.let { service.getPost(it) }
-                if (post?.deletedAt != null) {
+
+                // Simple filter for full page post views
+                val jamId = call.parameters["jamId"]
+                val postBelongsToCurrentJam = jamId == null || post?.jamId == jamId
+
+                if (post?.deletedAt != null || !postBelongsToCurrentJam) {
                     call.respondJSON("Post not found", status = HttpStatusCode.NotFound)
                 }
 

diff --git a/ui/src/pages/post/Post.tsx b/ui/src/pages/post/Post.tsx
@@ -20,12 +20,12 @@ import {JoinDiscordButton} from "./components/JoinDiscordButton.tsx";
 
 export const Post: React.FC<{}> = () => {
 
-    const { postId } = useParams()
+    const { jamId, postId } = useParams()
     const navigate = useNavigate();
     const [post, setPost] = useState<PostModel>()
 
     useEffect(() => {
-        fetch(`${import.meta.env.VITE_API_URL}/posts/${postId}`)
+        fetch(`${import.meta.env.VITE_API_URL}/posts/${postId}?jamId=${jamId}`)
             .then(res => res.json())
             .then(setPost)
     }, [])