#I8XDG7 修复不能越权删除他人的文章

layui升级到2.9.6
2024-01-25 18:53:57 +08:00 · 2024-01-25 18:53:57 +08:00 · e5233a0096
commit e5233a0096
parent d2ea9239d3
1 changed files with 4 additions and 0 deletions
--- a/app/article/controller/Index.php
+++ b/app/article/controller/Index.php
@ -238,6 +238,10 @@ class Index extends BaseController
    public function delete()
    {
        $id = get_params("id");
+		$admin_id = Db::name('Article')->where('id',$id).value('uid');
+		if($admin_id!=$this->uid){
+			return to_assign(1, "你不是该知识的创建人，没权限删除");
+		}
        $data['id'] = $id;
        $data['delete_time'] = time();
        if (Db::name('Article')->update($data) !== false) {