Auth within add_player api call

PennyDreadfulMTG · Jan 27, 2024 · 391aff2 · 391aff2
1 parent 57d3d14
commit 391aff2
Showing 1 changed file with 8 additions and 3 deletions.
diff --git a/gatherling/api.php b/gatherling/api.php
@@ -26,11 +26,15 @@
 
     case 'eventinfo':
     case 'event_info':
-        $eventname = $_REQUEST['event'];
-        $event = new Event($eventname);
-        $result = repr_json_event($event);
+        if (Event::exists(arg('event'))) {
+            $event = new Event(arg('event'));
+            $result = repr_json_event($event);
+        } else {
+            $result['error'] = 'Event not found';
+        }
         break;
 
+
     case 'seriesinfo':
     case 'series_info':
         $seriesname = $_REQUEST['series'];
@@ -47,6 +51,7 @@
 
     case 'addplayer':
     case 'add_player':
+        auth();
         $event = new Event(arg('event'));
         $player = arg('addplayer');
         $decklist = arg('decklist', '');