soeren/fotospiel-app
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Fix 401 errors for Guest PWA API endpoints: Remove global tenant middleware from bootstrap/app.php and apply only to tenant routes; add throttle:100,1 to guest routes in api.php; enhance EventPublicController with published status validation for all methods to ensure secure public access without auth.

Browse Source
This commit is contained in:
SEB Fotografie - soeren
2025-09-17 20:15:08 +02:00
parent 42d6e98dff
commit c8a9224ab0
5 changed files with 2843 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
app/Http/Controllers/Api/EventPublicController.php
View File

@@ -47,11 +47,11 @@ class EventPublicController extends BaseController
}
public function event(string $slug)
{
$event = DB::table('events')->where('slug', $slug)->first([
$event = DB::table('events')->where('slug', $slug)->where('status', 'published')->first([
'id', 'slug', 'name', 'default_locale', 'created_at', 'updated_at'
]);
if (! $event) {
return response()->json(['error' => ['code' => 'not_found', 'message' => 'Event not found']], 404);
return response()->json(['error' => ['code' => 'not_found', 'message' => 'Event not found or not public']], 404);
}
$locale = request()->query('locale', 'de');
@@ -88,9 +88,9 @@ class EventPublicController extends BaseController
public function stats(string $slug)
{
$event = DB::table('events')->where('slug', $slug)->first(['id']);
$event = DB::table('events')->where('slug', $slug)->where('status', 'published')->first(['id']);
if (! $event) {
return response()->json(['error' => ['code' => 'not_found', 'message' => 'Event not found']], 404);
return response()->json(['error' => ['code' => 'not_found', 'message' => 'Event not found or not public']], 404);
}
$eventId = $event->id;
@@ -127,9 +127,9 @@ class EventPublicController extends BaseController
public function emotions(string $slug)
{
$event = DB::table('events')->where('slug', $slug)->first(['id']);
$event = DB::table('events')->where('slug', $slug)->where('status', 'published')->first(['id']);
if (! $event) {
return response()->json(['error' => ['code' => 'not_found', 'message' => 'Event not found']], 404);
return response()->json(['error' => ['code' => 'not_found', 'message' => 'Event not found or not public']], 404);
}
$rows = DB::table('emotions')
@@ -176,9 +176,9 @@ class EventPublicController extends BaseController
public function tasks(string $slug, Request $request)
{
$event = DB::table('events')->where('slug', $slug)->first(['id']);
$event = DB::table('events')->where('slug', $slug)->where('status', 'published')->first(['id']);
if (! $event) {
return response()->json(['error' => ['code' => 'not_found', 'message' => 'Event not found']], 404);
return response()->json(['error' => ['code' => 'not_found', 'message' => 'Event not found or not public']], 404);
}
$query = DB::table('tasks')
@@ -260,9 +260,9 @@ class EventPublicController extends BaseController
public function photos(Request $request, string $slug)
{
$event = DB::table('events')->where('slug', $slug)->first(['id']);
$event = DB::table('events')->where('slug', $slug)->where('status', 'published')->first(['id']);
if (! $event) {
return response()->json(['error' => ['code' => 'not_found', 'message' => 'Event not found']], 404);
return response()->json(['error' => ['code' => 'not_found', 'message' => 'Event not found or not public']], 404);
}
$eventId = $event->id;
@@ -327,6 +327,7 @@ class EventPublicController extends BaseController
public function photo(int $id)
{
$row = DB::table('photos')
->join('events', 'photos.event_id', '=', 'events.id')
->leftJoin('tasks', 'photos.task_id', '=', 'tasks.id')
->select([
'photos.id',
@@ -340,9 +341,10 @@ class EventPublicController extends BaseController
'tasks.title as task_title'
])
->where('photos.id', $id)
->where('events.status', 'published')
->first();
if (! $row) {
return response()->json(['error' => ['code' => 'not_found', 'message' => 'Photo not found']], 404);
return response()->json(['error' => ['code' => 'not_found', 'message' => 'Photo not found or event not public']], 404);
}
$row->file_path = $this->toPublicUrl((string)($row->file_path ?? ''));
$row->thumbnail_path = $this->toPublicUrl((string)($row->thumbnail_path ?? ''));
@@ -364,9 +366,13 @@ class EventPublicController extends BaseController
$deviceId = 'anon';
}
$photo = DB::table('photos')->where('id', $id)->first(['id', 'event_id']);
$photo = DB::table('photos')
->join('events', 'photos.event_id', '=', 'events.id')
->where('photos.id', $id)
->where('events.status', 'published')
->first(['photos.id', 'photos.event_id']);
if (! $photo) {
return response()->json(['error' => ['code' => 'not_found', 'message' => 'Photo not found']], 404);
return response()->json(['error' => ['code' => 'not_found', 'message' => 'Photo not found or event not public']], 404);
}
// Idempotent like per device
@@ -401,9 +407,9 @@ class EventPublicController extends BaseController
public function upload(Request $request, string $slug)
{
$event = DB::table('events')->where('slug', $slug)->first(['id']);
$event = DB::table('events')->where('slug', $slug)->where('status', 'published')->first(['id']);
if (! $event) {
return response()->json(['error' => ['code' => 'not_found', 'message' => 'Event not found']], 404);
return response()->json(['error' => ['code' => 'not_found', 'message' => 'Event not found or not public']], 404);
}
$deviceId = (string) $request->header('X-Device-Id', 'anon');