Fixed sec-issues at stations (edit / delete / empty / copy)

application/controllers/Station.php

@@ -31,8 +31,7 @@ class Station extends CI_Controller {
 		$this->load->view('interface_assets/footer');
 	}
 
-	public function create()
-	{
+	public function create() {
 		$this->load->model('stations');
 		$this->load->model('dxcc');
 		$data['dxcc_list'] = $this->dxcc->list();
@@ -59,8 +58,9 @@ class Station extends CI_Controller {
 		}
 	}
 
-	public function edit($id)
-	{
+	public function edit($id) {
+		$this->load->model('stations');
+		if ($this->stations->check_station_is_accessible($id)) {
 			$data = $this->load_station_for_editing($id);
 			$data['page_title'] = "Edit Station Location: {$data['my_station_profile']->station_profile_name}";
 
@@ -73,12 +73,16 @@ class Station extends CI_Controller {
 
 				$data['notice'] = "Station Profile " . $this->security->xss_clean($this->input->post('station_profile_name', true)) . " Updated";
 
+				redirect('station');
+			}
+		} else {
 			redirect('station');
 		}
 	}
 
-	public function copy($id)
-	{
+	public function copy($id) {
+		$this->load->model('stations');
+		if ($this->stations->check_station_is_accessible($id)) {
 			$data = $this->load_station_for_editing($id);
 			$data['page_title'] = "Duplicate Station Location: {$data['my_station_profile']->station_profile_name}";
 
@@ -97,12 +101,14 @@ class Station extends CI_Controller {
 			{
 				$this->stations->add();
 
+				redirect('station');
+			}
+		} else {
 			redirect('station');
 		}
 	}
 
-	function load_station_for_editing($id): array
-	{
+	function load_station_for_editing($id): array {
 		$this->load->library('form_validation');
 
 		$this->load->model('stations');
@@ -159,15 +165,17 @@ class Station extends CI_Controller {
 
 	public function delete($id) {
 		$this->load->model('stations');
+		if ($this->stations->check_station_is_accessible($id)) {
 			$this->stations->delete($id);
-
+		}
 		redirect('station');
 	}
 
     public function deletelog($id) {
         $this->load->model('stations');
+	if ($this->stations->check_station_is_accessible($id)) {
         	$this->stations->deletelog($id);
-
+	}
         redirect('station');
     }