投稿作成、編集、削除

app/Http/Controllers/SiteController.php

@@ -302,20 +302,32 @@ class SiteController extends Controller {
   }
 
   public function newPost(Request $request) { // /api/rpc/site/post/new
+    $check = $this->objAuth->checkLegit($request->username, $request->password);
+
+    if ($check == 0) {
+      return \Response::json(array('error' => 'ログインされませんでした。'));
+    }
+    else {
+      $valid = $this->objAuth->getPermissions($request->username, $request->password);
+
+      if ($valid['blg_addpost'] == 1) {
         $pubdate = 0;
 
         if ($request->public_status == 1) {
           if ($request->publish_date <= time()) {
-        return \Response::json(array('error' => 'Publish date can\'t be older than post date.'));
+            return \Response::json(array('error' => '投稿日より公開日の方がもっと古いだと不許可です。'));
+          }
+          else {
+            $pubdate = $request->publish_date;
           }
         }
-
-    if ($request->public_status == 1) $pubdate = $request->publish_date;
-    else $pubdate = time();
+        else {
+          $pubdate = time();
+        }
 
         $add = DB::table('blg_content')
           ->insert([
-        'user_id' => $request->user_id,
+            'user_id' => $check,
             'isPost' => 1,
             'title' => $request->title,
             'slug' => $request->slug,
@@ -329,8 +341,22 @@ class SiteController extends Controller {
 
         return \Response::json($add);
       }
+      else {
+        return \Response::json(array('error' => '不許可。'));
+      }
+    }
+  }
 
   public function editPost(Request $request) { // /api/rpc/site/post/edit
+    $check = $this->objAuth->checkLegit($request->username, $request->password);
+
+    if ($check == 0) {
+      return \Response::json(array('error' => 'ログインされませんでした。'));
+    }
+    else {
+      $valid = $this->objAuth->getPermissions($request->username, $request->password);
+
+      if ($valid['blg_editpost'] == 1) {
         return DB::table('blg_content')
           ->where('id', $request->id)
           ->update([
@@ -340,10 +366,29 @@ class SiteController extends Controller {
             'message' => $request->message
           ]);
       }
+      else {
+        return \Response::json(array('error' => '不許可。'));
+      }
+    }
+  }
 
   public function deletePost(Request $request) { // /api/rpc/site/post/delete
+    $check = $this->objAuth->checkLegit($request->username, $request->password);
+
+    if ($check == 0) {
+      return \Response::json(array('error' => 'ログインされませんでした。'));
+    }
+    else {
+      $valid = $this->objAuth->getPermissions($request->username, $request->password);
+
+      if ($valid['blg_delpost'] == 1) {
         return DB::table('blg_content')->where('id', $request->id)->delete();
       }
+      else {
+        return \Response::json(array('error' => '不許可。'));
+      }
+    }
+  }
 
   // Comments
   public function getComments($id) { // /api/rpc/site/post/getcomments/id