Login user can view other record which is not created by the same user

Login user can view other record which is not created by the same user

1 week 5 days ago #9811 by Lee Chen

Hi everyone

I am wondering whether anyone has same problem as mine. The code below suppose if the user is Super User or login user id matches record created_by user id. However, if I changed the table id etc from 9 to 8 on the link /index.php/en/component/orders/order/9 to /index.php/en/component/orders/order/8 , where record 8 is not created by login user and still be able to view the record details.

if(empty($result) || $this->isAdminOrSuperUser() || $table->created_by == JFactory::getUser()->id){

}

any ideas?

many thanks.

Please Log in or Create an account to join the conversation.

Time to create page: 0.154 seconds
Powered by Kunena Forum

We use cookies so that you can place orders and we can provide a better service. You can control the use of cookies at the individual browser level. If you reject cookies, you may still use our website, but your ability to use some features or areas of our website may be limited.