From 3dae73fcf02a8fc07bd4d80e36bc51d9ca7411ed Mon Sep 17 00:00:00 2001
From: Gregorio Chiko Putra <gregorio@lepisi.ac.id>
Date: Mon, 18 Sep 2017 09:17:03 +0700
Subject: [PATCH] Fixed editing conditions

---
 App/Controllers/Posts.php      | 11 ++++-------
 App/Models/Post.php            |  2 +-
 App/Views/Data/pengumuman.html | 28 +++++++++++++++++-----------
 3 files changed, 22 insertions(+), 19 deletions(-)

diff --git a/App/Controllers/Posts.php b/App/Controllers/Posts.php
index 442416a..38330ae 100644
--- a/App/Controllers/Posts.php
+++ b/App/Controllers/Posts.php
@@ -96,9 +96,7 @@ class Posts
         ]);
 
         $url = 'Data/pengumuman.html';
-
-        $status = '';
-        $privilege = '';
+        $user = [];
 
         if (Session::exists('userid')) {
             $data = $this->model->showJoin();
@@ -107,8 +105,8 @@ class Posts
                     ['pengumuman.status', '=', $args]
                 ]);
             }
-            $privilege = Session::get('privilege');
-            $status = 'loggedin';
+            $user = $_SESSION;
+            unset($user['tokens']);
         }
 
         if ($data !== false) {
@@ -126,8 +124,7 @@ class Posts
 
         View::render($url, [
             'posts' => $datas,
-            'status' => $status,
-            'privilege' => $privilege,
+            'user' => $user,
             'token' => Token::generate()
         ]);
     }
diff --git a/App/Models/Post.php b/App/Models/Post.php
index c1b0e9f..2038a2f 100644
--- a/App/Models/Post.php
+++ b/App/Models/Post.php
@@ -122,7 +122,7 @@ class Post extends \Core\Model
         try {
             $db = static::connectDB();
 
-            $sql = "SELECT pengumuman.id, kategori.background, kategori.foreground, pengumuman.valid_at, pengumuman.expired_at, pengumuman.content, pengumuman.status FROM pengumuman INNER JOIN kategori ON pengumuman.category=kategori.id";
+            $sql = "SELECT pengumuman.id, kategori.background, kategori.foreground, pengumuman.valid_at, pengumuman.expired_at, pengumuman.creator, pengumuman.editor, pengumuman.content, pengumuman.status FROM pengumuman INNER JOIN kategori ON pengumuman.category=kategori.id";
 
             if ($conditions) {
                 $sql .= " WHERE";
diff --git a/App/Views/Data/pengumuman.html b/App/Views/Data/pengumuman.html
index 8f8823b..3b35860 100644
--- a/App/Views/Data/pengumuman.html
+++ b/App/Views/Data/pengumuman.html
@@ -6,8 +6,8 @@
     <input type="checkbox" id="bmenug" class="show">
     <label for="bmenug" class="burger pseudo button"><i class="fa fa-bars" aria-hidden="true"></i></label>
     <div class="menu">
-        {% if privilege != "" %}
-            {% if privilege == 1 %}
+        {% if user.privilege != "" %}
+            {% if user.privilege == 1 %}
                 <a href="/posts/category" class="navy button" data-tooltip="Kategori"><i class="fa fa-list-ul" aria-hidden="true"></i>&nbsp;Kategori</a>
                 <a href="/register" class="navy button" data-tooltip="User Baru"><i class="fa fa-user-plus" aria-hidden="true"></i>&nbsp;User</a>
             {% endif %}
@@ -24,7 +24,7 @@
 <main class="documentation">
     <div style="text-align:left;width:100%;">
 
-        {% if privilege == "" %}
+        {% if user.privilege == "" %}
             {% if not posts %}
             <div style="background:#fff;text-align:left;max-width:100vw;padding:10vh 0 0;">
                 <h1 class="fitty pengumuman">Tidak ada pengumuman</h1>
@@ -63,18 +63,24 @@
                         <form method="post" action="/">
                             <footer class="flex full grow">
                                 {% if post.status != 0 %}
-                                    <div class="half-900">
-                                        <a href="/posts/edit/{{ post.id }}" class="button full">
-                                            <i class="fa fa-edit fa-fw"></i>
-                                            <span style="font-size:smaller;">Ubah</span>
-                                        </a>
-                                    </div>
+                                    {% if user.userid == post.creator %}
+                                        <div class="half-900">
+                                            <a href="/posts/edit/{{ post.id }}" class="button full">
+                                                <i class="fa fa-edit fa-fw"></i>
+                                                <span style="font-size:smaller;">Ubah</span>
+                                            </a>
+                                        </div>
+                                    {% else %}
+                                        <div class="half-900">
+                                            <span class="button pseudo full" style="color:rgba(17,17,17,.3)">Tidak dapat diubah</span>
+                                        </div>
+                                    {% endif %}
                                 {% else %}
                                     <div class="half-900">
                                         <span class="button pseudo full" style="color:rgba(17,17,17,.3)">Nonaktif</span>
                                     </div>
                                 {% endif %}
-                                {% if (post.status == 1 and editor_now.id == creator.id) %}
+                                {% if (post.status == 1 and user.userid == post.creator) %}
                                     <div class="half-900">
                                         <input type="hidden" name="id" value="{{ post.id }}">
                                         <input type="hidden" name="status" value="0">
@@ -87,7 +93,7 @@
                                             <span style="font-size:smaller;">Matikan</span>
                                         </button>
                                     </div>
-                                {% elseif (post.status == 2 and editor_now.id == creator.id) %}
+                                {% elseif (post.status == 2 and user.userid == post.creator) %}
                                     <div class="half-900">
                                         <input type="hidden" name="id" value="{{ post.id }}">
                                         <input type="hidden" name="valid_at" value="##date##">