Implement administrator access checks

public_html/classes/campaign.php

@@ -25,7 +25,7 @@ class Campaign extends CPHPDatabaseRecordClass
 			'UrlName'		=> "UrlName"
 		),
 		'numeric' => array(
-			'OwnerId'		=> "UserId",
+			'OwnerId'		=> "OwnerId",
 			'DonationRate'		=> "DonationRate",
 			'SubscriberCount'	=> "SubscriberCount",
 			'MonthlyTotal'		=> "TotalMonthlyDonations",
@@ -39,7 +39,7 @@ class Campaign extends CPHPDatabaseRecordClass
 			'LastStatisticsUpdate'	=> "LastStatisticsUpdate"
 		),
 		'user' => array(
-			'Owner'			=> "Owner"
+			'Owner'			=> "OwnerId"
 		)
 	);
 	
@@ -61,6 +61,11 @@ class Campaign extends CPHPDatabaseRecordClass
 		return self::CreateFromQuery("SELECT * FROM campaigns WHERE `UrlName` = :UrlName", array(':UrlName' => $urlname), 0, true);
 	}
 	
+	public function VerifyAdministratorAccess($userid)
+	{
+		return ($this->sOwnerId == $userid);
+	}
+	
 	public function UpdateStatistics()
 	{
 		global $database;

public_html/modules/campaign/addmethod.php

@@ -23,6 +23,11 @@ catch (NotFoundException $e)
 	throw new RouterException("Campaign does not exist.");
 }
 
+if($sCampaign->VerifyAdministratorAccess($_SESSION['user_id']) === false)
+{
+	throw new RouterException("Not authorized to administrate this campaign.");
+}
+
 if(!empty($_POST['submit']))
 {
 	if(empty($_POST['address']))

public_html/modules/campaign/dashboard.php

@@ -23,6 +23,11 @@ catch (NotFoundException $e)
 	throw new RouterException("Campaign does not exist.");
 }
 
+if($sCampaign->VerifyAdministratorAccess($_SESSION['user_id']) === false)
+{
+	throw new RouterException("Not authorized to administrate this campaign.");
+}
+
 $sPaymentMethods = array();
 
 try

public_html/modules/campaign/removemethod.php

@@ -23,6 +23,11 @@ catch (NotFoundException $e)
 	throw new RouterException("Campaign does not exist.");
 }
 
+if($sCampaign->VerifyAdministratorAccess($_SESSION['user_id']) === false)
+{
+	throw new RouterException("Not authorized to administrate this campaign.");
+}
+
 try
 {
 	$sPaymentMethod = new PaymentMethod($router->uParameters[2]);