1 files changed, 25 insertions, 0 deletions

diff --git a/modules/likes/likes.go b/modules/likes/likes.go
index 4d69d7b..02cf9d5 100644
--- a/modules/likes/likes.go
+++ b/modules/likes/likes.go
@@ -106,6 +106,13 @@ func (m *Module) isLikedBy(w http.ResponseWriter, r *http.Request, p httprouter.
         w.Write([]byte(fmt.Sprintf("%t", res > 0)))
 }
 func (m *Module) addLike(w http.ResponseWriter, r *http.Request, p httprouter.Params) {
+        user, _ := m.g.Charakterin.GetUserFromRequest(r)
+
+        if user == nil {
+                http.Error(w, "403", http.StatusForbidden)
+                return
+        }
+
         params, err := readBody(r)
         if err != nil {
                 log.Println(err)
@@ -130,6 +137,10 @@ func (m *Module) addLike(w http.ResponseWriter, r *http.Request, p httprouter.Pa
                 http.Error(w, "invalid user id", http.StatusBadRequest)
                 return
         }
+        if user.ID != userId {
+                http.Error(w, "403", http.StatusForbidden)
+                return
+        }
 
         _, err = m.g.DB.Exec(`INSERT INTO grilist.likes(content, "user", type) SELECT $1, $2, $3 WHERE NOT EXISTS (SELECT * FROM grilist.likes WHERE content = $1 AND "user" = $2 AND type = $3)`, contentId, userId, contentType)
         if err != nil {
@@ -142,19 +153,29 @@ func (m *Module) addLike(w http.ResponseWriter, r *http.Request, p httprouter.Pa
 }
 
 func (m *Module) removeLike(w http.ResponseWriter, r *http.Request, p httprouter.Params) {
+        user, _ := m.g.Charakterin.GetUserFromRequest(r)
+
+        if user == nil {
+                http.Error(w, "403", http.StatusForbidden)
+                return
+        }
+
         params, err := readBody(r)
         if err != nil {
+                log.Println(err)
                 http.Error(w, "invalid body", http.StatusBadRequest)
                 return
         }
 
         contentId, err := strconv.Atoi(params.Get("id"))
         if err != nil {
+                log.Println(err)
                 http.Error(w, "invalid content id", http.StatusBadRequest)
                 return
         }
         contentType, err := strconv.Atoi(params.Get("type"))
         if err != nil {
+                log.Println(err)
                 http.Error(w, "invalid content type", http.StatusBadRequest)
                 return
         }
@@ -163,6 +184,10 @@ func (m *Module) removeLike(w http.ResponseWriter, r *http.Request, p httprouter
                 http.Error(w, "invalid user id", http.StatusBadRequest)
                 return
         }
+        if user.ID != userId {
+                http.Error(w, "403", http.StatusForbidden)
+                return
+        }
 
         _, err = m.g.DB.Exec(`DELETE FROM grilist.likes WHERE content = $1 AND "user" = $2 AND type = $3`, contentId, userId, contentType)
         if err != nil {