fix: access create & update event admin only

47dd071f · Mifkiyan · 20d1e741 · 47dd071f · 47dd071f
Commit 47dd071f authored 1 year ago by Mifkiyan
--- a/app/Views/event/create.php
+++ b/app/Views/event/create.php
+<?php
+    session_start();
+    ob_start();
+    if (!isset($_SESSION["user_id"])) {
+        echo "here";
+        // User is not authenticated; redirect to login page
+        header("Location: /app/Views/login/login.php");
+        ob_end_flush();
+    }
+
+    require_once '../../Controllers/UserController.php';
+    $userController = new UserController();
+    $isAdmin = $userController->getUser($_SESSION['user_id'])['isAdmin'];
+    
+    // Allow only admin to access this page
+    if (!$isAdmin){
+        header("Location: /app/Views/home/home.php");
+        ob_end_flush();
+    }
+?>
+
 <!DOCTYPE html>
 <html lang="en">


--- a/app/Views/event/update.php
+++ b/app/Views/event/update.php
+<?php
+    session_start();
+    ob_start();
+    if (!isset($_SESSION["user_id"])) {
+        echo "here";
+        // User is not authenticated; redirect to login page
+        header("Location: /app/Views/login/login.php");
+        ob_end_flush();
+    }
+
+    require_once '../../Controllers/UserController.php';
+    $userController = new UserController();
+    $isAdmin = $userController->getUser($_SESSION['user_id'])['isAdmin'];
+    
+    // Allow only admin to access this page
+    if (!$isAdmin){
+        header("Location: /app/Views/home/home.php");
+        ob_end_flush();
+    }
+?>
+
 <!DOCTYPE html>
 <html lang="en">