mirror of
https://github.com/HolgerHatGarKeineNode/einundzwanzig-app.git
synced 2026-05-05 17:04:54 +00:00
9b81f6cd92
- Add 60 req/min throttle to the public API group and a stricter 10 req/min throttle to POST /highscores. - Replace mass-assigned $guarded=[] with explicit $fillable on User, Meetup, Course, Lecturer, and SelfHostedService. created_by stays out of the whitelist; the existing creating() hooks continue to populate it. - Require authenticated user on Api/MeetupController::index instead of trusting the user_id query parameter (IDOR). - Constrain the /img and /img-public route paths to a safe character set and reject any path containing ".." in ImageController. - Add rel="noopener noreferrer" to every target="_blank" link on the meetup and course landing pages.
92 lines
2.2 KiB
PHP
92 lines
2.2 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers\Api;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use App\Models\Meetup;
|
|
use Illuminate\Database\Eloquent\Builder;
|
|
use Illuminate\Http\Request;
|
|
|
|
class MeetupController extends Controller
|
|
{
|
|
public function ical()
|
|
{
|
|
abort(404);
|
|
}
|
|
|
|
public function index(Request $request)
|
|
{
|
|
$user = $request->user();
|
|
abort_unless($user, 401);
|
|
|
|
$myMeetupIds = $user->meetups->pluck('id');
|
|
|
|
return Meetup::query()
|
|
->select('id', 'name', 'city_id', 'slug')
|
|
->with([
|
|
'city.country',
|
|
])
|
|
->whereIn('id', $myMeetupIds->toArray())
|
|
->orderBy('name')
|
|
->when(
|
|
$request->search,
|
|
fn(Builder $query)
|
|
=> $query
|
|
->where('name', 'like', "%{$request->search}%")
|
|
->orWhereHas('city',
|
|
fn(Builder $query) => $query->where('cities.name', 'ilike', "%{$request->search}%")),
|
|
)
|
|
->when(
|
|
$request->exists('selected'),
|
|
fn(Builder $query) => $query->whereIn('id', $request->input('selected', [])),
|
|
fn(Builder $query) => $query->limit(10),
|
|
)
|
|
->get()
|
|
->map(function (Meetup $meetup) {
|
|
$meetup->profile_image = $meetup->getFirstMediaUrl('logo', 'thumb');
|
|
|
|
return $meetup;
|
|
});
|
|
}
|
|
|
|
/**
|
|
* Store a newly created resource in storage.
|
|
*
|
|
* @return \Illuminate\Http\Response
|
|
*/
|
|
public function store(Request $request)
|
|
{
|
|
//
|
|
}
|
|
|
|
/**
|
|
* Display the specified resource.
|
|
*
|
|
* @return \Illuminate\Http\Response
|
|
*/
|
|
public function show(meetup $meetup)
|
|
{
|
|
//
|
|
}
|
|
|
|
/**
|
|
* Update the specified resource in storage.
|
|
*
|
|
* @return \Illuminate\Http\Response
|
|
*/
|
|
public function update(Request $request, meetup $meetup)
|
|
{
|
|
//
|
|
}
|
|
|
|
/**
|
|
* Remove the specified resource from storage.
|
|
*
|
|
* @return \Illuminate\Http\Response
|
|
*/
|
|
public function destroy(meetup $meetup)
|
|
{
|
|
//
|
|
}
|
|
}
|