1 files changed, 52 insertions, 34 deletions

diff --git a/modules/lists/lists.go b/modules/lists/lists.go
index b40ee18..e1b806d 100644
--- a/modules/lists/lists.go
+++ b/modules/lists/lists.go
@@ -69,6 +69,7 @@ func (m *Module) Init(g *grilist.Grilist) {
         m.g.Router.GET("/list/:id", m.viewList)
     m.g.Router.POST("/list/:id/order", m.updateGrilOrder)
         m.g.Router.POST("/list/:id", m.addGrilToList)
+        m.g.Router.DELETE("/list/:id/order", m.removeGrilFromList)
         m.g.Router.GET("/new/list", m.displayCreateList)
         m.g.Router.POST("/new/list", m.createList)
 }
@@ -248,6 +249,12 @@ func (m *Module) viewList(w http.ResponseWriter, r *http.Request, p httprouter.P
 
 func (m *Module) addGrilToList(w http.ResponseWriter, r *http.Request, p httprouter.Params) {
         slistID := p.ByName("id")
+    
+    user, err := m.g.Charakterin.GetUserFromRequest(r)
+    if err != nil {
+        http.Error(w, "403", http.StatusForbidden)
+        return
+    }
 
         listID, err := strconv.Atoi(slistID)
         if err != nil {
@@ -272,6 +279,11 @@ func (m *Module) addGrilToList(w http.ResponseWriter, r *http.Request, p httprou
                 http.Error(w, "invalid list", 404)
                 return
         }
+    
+    if list.Owner.ID != user.ID {
+        http.Error(w, "403", http.StatusForbidden)
+        return
+    }
 
         rank := 0
         if len(list.Grils) > 0 {
@@ -369,52 +381,58 @@ func (m *Module) updateGrilOrder(w http.ResponseWriter, r *http.Request, p httpr
                 return
         }
     
-    diff, err := strconv.Atoi(values.Get("pos"))
+    pos, err := strconv.Atoi(values.Get("pos"))
     if err != nil {
-        http.Error(w, "invalid position diff", 400)
+        http.Error(w, "invalid position", 400)
         return
     }
+    
+        // rein in die DB damit
+        _, err = m.g.DB.Query(`SELECT grilist.set_gril_order($1, $2, $3, $4)`, user.ID, listID, grilID, pos)
+        if err != nil {
+                log.Println("error reordering gril:", err)
+                http.Error(w, "could not update gril order", 500)
+                return
+        }
 
-        list, err := m.FromID(listID)
+    w.WriteHeader(200)
+    w.Write([]byte("ok"))
+        return
+}
+
+func (m *Module) removeGrilFromList(w http.ResponseWriter, r *http.Request, p httprouter.Params) {
+        slistID := p.ByName("id")
+
+        listID, err := strconv.Atoi(slistID)
         if err != nil {
-                http.Error(w, "invalid list", 404)
+                http.Error(w, "invalid list ID (type mismatch)", 400)
                 return
         }
 
-        // find the gril in our list
-    var lgril *ListGril = nil
-    log.Println(list.Grils)
-    for _, g := range list.Grils {
-        if g.Gril.ID == grilID {
-            lgril = g
-            break
-        }
-    }
-    if lgril == nil {
-        http.Error(w, "gril not found in the list", 404)
-        return
-    }
-    
-    newPos := lgril.Order + diff
-    
-    if newPos < 0 {
-        newPos = 0
-    } else if newPos >= len(list.Grils) {
-        newPos = len(list.Grils) - 1
-    }
-    
-    if newPos == lgril.Order {
-        http.Error(w, "no change in order", 400)
-        return
-    }
+        values, err := readBody(r)
+        if err != nil {
+                http.Error(w, "invalid POST data", 400)
+                return
+        }
 
-        // rein in die DB damit
-        _, err = m.g.DB.Query(`SELECT grilist.set_gril_order($1, $2, $3, $4)`, user.ID, listID, grilID, newPos)
+        grilID, err := strconv.Atoi(values.Get("gril"))
         if err != nil {
-                log.Println("error reordering gril:", err)
-                http.Error(w, "could not update gril order", 500)
+                http.Error(w, "invalid gril ID", 404)
                 return
         }
+    
+    res, err := m.g.DB.Exec(`DELETE FROM grilist.lists_grils WHERE list_id=$1 AND gril_id=$2`, listID, grilID)
+        if err != nil {
+                log.Println("error removing gril:", err)
+                http.Error(w, "could not remove gril", 500)
+                return
+        }
+    
+    if r, err := res.RowsAffected(); err != nil || r == 0 {
+        log.Println("invalid rows affected in removing gril")
+        http.Error(w, "gril not in list / other error", 500)
+        return
+    }
 
     w.WriteHeader(200)
     w.Write([]byte("ok"))