only allow event managers to view future events

RetroAchievements · Feb 1, 2025 · 2681fd2 · 2681fd2
1 parent d1c5576
commit 2681fd2
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 3 deletions.
diff --git a/app/Filament/Resources/EventResource.php b/app/Filament/Resources/EventResource.php
@@ -114,7 +114,7 @@ public static function form(Form $form): Form
                     ->schema([
                         Forms\Components\TextInput::make('Title')
                             ->label('Title')
-                            ->unique()
+                            ->unique(ignoreRecord: true)
                             ->required()
                             ->minLength(2)
                             ->maxLength(80),
@@ -135,7 +135,7 @@ public static function form(Form $form): Form
                             ->rules(['alpha_dash'])
                             ->minLength(4)
                             ->maxLength(20)
-                            ->unique()
+                            ->unique(ignoreRecord: true)
                             ->required()
                             ->columnSpan(2),
 

diff --git a/app/Filament/Resources/EventResource/Pages/Create.php b/app/Filament/Resources/EventResource/Pages/Create.php
@@ -38,7 +38,7 @@ protected function handleRecordCreation(array $data): Model
         // these fields don't actually exist on the event record. don't pass to create().
         $numberOfAchievements = (int) $data['numberOfAchievements'];
         unset($data['numberOfAchievements']);
-        $user_id = $data['user_id'];
+        $user_id = (int) $data['user_id'];
         unset($data['user_id']);
 
         // create the event record

diff --git a/resources/views/pages-legacy/gameInfo.blade.php b/resources/views/pages-legacy/gameInfo.blade.php
@@ -110,6 +110,13 @@
 $isFullyFeaturedGame = System::isGameSystem($gameData['ConsoleID']);
 $isEventGame = $gameData['ConsoleID'] == System::Events;
 
+// future events can only be viewed by users who can manage events.
+if ($isEventGame && $gameModel->event?->active_from != null
+    && $gameModel->event->active_from > Carbon::now()
+    && !$userModel?->can('manage', $gameModel->event)) {
+    abort(401);
+}
+
 $pageTitle = "$gameTitle ($consoleName)";
 
 $unlockedAchievements = array_filter($achievementData, function ($achievement) {