You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
if ($userid != $created_by) { // We're dealing with a Club Member/Member ADIF or Clubofficer
133
+
if ((($club_perm ?? 0) == 3) || (($club_perm ?? 0) == 6)) { // Member or ADIF-Member? DENY
134
+
$this->output->set_status_header(401)->set_content_type('application/json')->set_output(json_encode(['status' => 'error', 'message' => 'Auth Error, not enough grants for this operation']));
135
+
return;
136
+
}
137
+
}
138
+
126
139
try {
127
140
$raw = file_get_contents("php://input");
128
141
if ($raw === false) {
@@ -149,8 +162,7 @@ function create_station($key = '') {
* As the API key user could use it also for clubstations we need to do an additional check here. Only if clubstations are enabled
@@ -260,12 +274,11 @@ function qso($dryrun = false) {
260
274
* If the user is not the creator of the API key, it's likely a clubstation. In this case the callsign of the clubstation
261
275
* can not be the same as the callsign of the user (operator call provided by the user). If this is the case, we need to use the callsign of the creator of the API key
262
276
*/
263
-
$real_operator = null;
277
+
$real_operator = null;// real_operator is only filled if its a clubstation and the used key is created by an OP. otherwise its null
// TODO: It would be possible to check here if operator is allowed to use the clubstation, but this can be added later if needed
269
282
} else {
270
283
$real_operator = null;
271
284
}
@@ -327,6 +340,11 @@ function qso($dryrun = false) {
327
340
$record['operator'] = $real_operator;
328
341
}
329
342
343
+
// in case the caller is an OP for a clubstation (real_operator is filled - see above) and the OP only has level 3 or 6 - take the OP from real_operator!
0 commit comments