diff --git a/src/server/admin/adminAPIRoutes.js b/src/server/admin/adminAPIRoutes.js index ea28f85..35ed113 100644 --- a/src/server/admin/adminAPIRoutes.js +++ b/src/server/admin/adminAPIRoutes.js @@ -49,26 +49,43 @@ module.exports = ( app ) => { } ); app.post( '/admin/events/uploadImages', multer.array( 'image', 2 ), ( req, res ) => { - if ( req.query.event.includes( '/' ) || req.query.event.includes( '.' ) ) { - res.status( 400 ).send( 'fp_wrong' ); - } else { - for ( let file in req.files ) { - if ( req.files[ file ].originalname === req.body.logo ) { - fs.writeFileSync( path.join( __dirname + '/../assets/events/' + req.query.event + 'Logo.jpg' ), req.files[ file ].buffer ); - } else { - fs.writeFileSync( path.join( __dirname + '/../assets/events/' + req.query.event + 'Banner.jpg' ), req.files[ file ].buffer ); + if ( req.session.loggedInAdmin ) { + if ( req.query.event.includes( '/' ) || req.query.event.includes( '.' ) ) { + res.status( 400 ).send( 'fp_wrong' ); + } else { + for ( let file in req.files ) { + if ( req.files[ file ].originalname === req.body.logo ) { + fs.writeFileSync( path.join( __dirname + '/../assets/events/' + req.query.event + 'Logo.jpg' ), req.files[ file ].buffer ); + } else { + fs.writeFileSync( path.join( __dirname + '/../assets/events/' + req.query.event + 'Banner.jpg' ), req.files[ file ].buffer ); + } } + res.send( 'ok' ); } - res.send( 'ok' ); + } else { + res.status( 403 ).send( 'unauthorized' ); } } ); app.post( '/admin/pages/uploadImages', multer.array( 'image', 1 ), ( req, res ) => { - if ( req.query.image.includes( '/' ) || req.query.image.includes( '.' ) || req.query.template.includes( '/' ) || req.query.template.includes( '.' ) ) { - res.status( 400 ).send( 'fp_wrong' ); + if ( req.session.loggedInAdmin ) { + if ( req.query.image.includes( '/' ) || req.query.image.includes( '.' ) || req.query.template.includes( '/' ) || req.query.template.includes( '.' ) ) { + res.status( 400 ).send( 'fp_wrong' ); + } else { + fs.writeFileSync( path.join( __dirname + '/../ui/home/templates/' + req.query.template + '/assets/' + req.query.image + '.jpg' ), req.files[ 0 ].buffer ); + res.send( 'ok' ); + } } else { - fs.writeFileSync( path.join( __dirname + '/../ui/home/templates/' + req.query.template + '/' + req.query.image + '.jpg' ), req.files[ 0 ].buffer ); + res.status( 403 ).send( 'unauthorized' ); + } + } ); + + app.post( '/admin/logo/upload', multer.array( 'image', 1 ), ( req, res ) => { + if ( req.session.loggedInAdmin ) { + fs.writeFileSync( path.join( __dirname + '/../assets/logo.png' ), req.files[ 0 ].buffer ); res.send( 'ok' ); + } else { + res.status( 403 ).send( 'unauthorized' ); } } ); }; \ No newline at end of file diff --git a/src/server/backend/helperRoutes.js b/src/server/backend/helperRoutes.js index e8b689a..3a57858 100644 --- a/src/server/backend/helperRoutes.js +++ b/src/server/backend/helperRoutes.js @@ -26,7 +26,10 @@ module.exports = ( app, settings ) => { } ); app.get( '/startPage/preview/:template', ( req, res ) => { - // TODO: only allow when logged in - res.sendFile( path.join( __dirname + '/../ui/home/templates/' + req.params.template + '/index.html' ) ); + if ( req.session.loggedInAdmin ) { + res.sendFile( path.join( __dirname + '/../ui/home/templates/' + req.params.template + '/index.html' ) ); + } else { + res.status( 403 ).send( 'unauthorized' ); + } } ); }; \ No newline at end of file diff --git a/src/server/ui/home/templates/default/assets/README.md b/src/server/ui/home/templates/default/assets/README.md new file mode 100644 index 0000000..5c3f617 --- /dev/null +++ b/src/server/ui/home/templates/default/assets/README.md @@ -0,0 +1,3 @@ +# Assets directory + +Inside of the assets directory, the start page assets can be found. \ No newline at end of file diff --git a/src/server/ui/home/templates/fancy/assets/README.md b/src/server/ui/home/templates/fancy/assets/README.md new file mode 100644 index 0000000..5c3f617 --- /dev/null +++ b/src/server/ui/home/templates/fancy/assets/README.md @@ -0,0 +1,3 @@ +# Assets directory + +Inside of the assets directory, the start page assets can be found. \ No newline at end of file diff --git a/src/server/ui/home/templates/modern/assets/README.md b/src/server/ui/home/templates/modern/assets/README.md new file mode 100644 index 0000000..5c3f617 --- /dev/null +++ b/src/server/ui/home/templates/modern/assets/README.md @@ -0,0 +1,3 @@ +# Assets directory + +Inside of the assets directory, the start page assets can be found. \ No newline at end of file diff --git a/src/webapp/main/src/views/admin/PagesView.vue b/src/webapp/main/src/views/admin/PagesView.vue index f83a5dd..2e46492 100644 --- a/src/webapp/main/src/views/admin/PagesView.vue +++ b/src/webapp/main/src/views/admin/PagesView.vue @@ -15,6 +15,23 @@ +