Allow users to upload files only when they're logged in to SSW.

1 files changed, 16 insertions, 11 deletions

diff --git a/static/php/upload.php b/static/php/upload.php
index 1bc74c9..9bb9d3f 100644
--- a/static/php/upload.php
+++ b/static/php/upload.php
@@ -1,11 +1,10 @@
 <?php
-session_start();
-
 /**
  * Handles POST uploads, generates filenames, moves files around and commits
  * uploaded metadata to database.
  */
 
+require_once 'classes/Login.class.php';
 require_once 'classes/Response.class.php';
 require_once 'classes/UploadException.class.php';
 require_once 'classes/UploadedFile.class.php';
@@ -206,20 +205,26 @@ function refiles($files)
     return $result;
 }
 
+$login = new Login();
+
 $type = isset($_GET['output']) ? $_GET['output'] : 'json';
 $response = new Response($type);
 
-if (isset($_FILES['files'])) {
-    $uploads = refiles($_FILES['files']);
+if ($login->isLoggedIn()) {
+    if (isset($_FILES['files'])) {
+        $uploads = refiles($_FILES['files']);
 
-    try {
-        foreach ($uploads as $upload) {
-            $res[] = uploadFile($upload);
+        try {
+            foreach ($uploads as $upload) {
+                $res[] = uploadFile($upload);
+            }
+            $response->send($res);
+        } catch (Exception $e) {
+            $response->error($e->getCode(), $e->getMessage());
         }
-        $response->send($res);
-    } catch (Exception $e) {
-        $response->error($e->getCode(), $e->getMessage());
+    } else {
+        $response->error(400, 'No input file(s)');
     }
 } else {
-    $response->error(400, 'No input file(s)');
+    $response->error(403, 'You are not logged in');
 }