From 8a3cfebf55bbc8380034c25741f52682beb2b9aa Mon Sep 17 00:00:00 2001
From: "K. Nobel" <kevlebon@gmailcom>
Date: Thu, 2 Feb 2017 15:34:45 +0100
Subject: [PATCH] Redirect to 404 from profile and group

---
 website/public/group.php       | 9 ++++++++-
 website/public/profile.php     | 7 ++++++-
 website/queries/group_page.php | 7 ++++++-
 website/queries/user.php       | 4 +++-
 4 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/website/public/group.php b/website/public/group.php
index bb393e3..84726fa 100644
--- a/website/public/group.php
+++ b/website/public/group.php
@@ -13,9 +13,16 @@
 
 include_once("../queries/group_page.php");
 
-$group = selectGroupByName($_GET["groupname"]);
+if(!$group = selectGroupByName($_GET["groupname"])) {
+    header("HTTP/1.0 404 Not Found");
+    header("Location: error/404.php");
+    die();
+}
+
+
 $members = selectGroupMembers($group["groupID"]);
 
+
 /*
  * This view adds the main layout over the screen.
  * Header, menu, footer.
diff --git a/website/public/profile.php b/website/public/profile.php
index aa4cf7c..126c87f 100644
--- a/website/public/profile.php
+++ b/website/public/profile.php
@@ -25,7 +25,12 @@ if(empty($_GET["username"])) {
     $userID = getUserID($_GET["username"]);
 }
 
-$user = selectUser($_SESSION["userID"], $userID);
+if(!$user = selectUser($_SESSION["userID"], $userID)) {
+    header("HTTP/1.0 404 Not Found");
+    header("Location: error/404.php");
+    die();
+}
+
 $profile_friends = selectAllFriends($userID);
 $profile_groups = selectAllUserGroups($userID);
 $showProfile = $user["showProfile"] || ($user["status"] == 'confirmed') || $_SESSION["userID"] == $userID;
diff --git a/website/queries/group_page.php b/website/queries/group_page.php
index f2f028f..a6676c4 100644
--- a/website/queries/group_page.php
+++ b/website/queries/group_page.php
@@ -33,7 +33,12 @@ function selectGroupByName($name) {
     if (!$stmt->execute()) {
         return False;
     }
-    return $stmt->fetch();
+    $row = $stmt->fetch();
+    if($row["groupID"] == null) {
+        return False;
+    }
+
+    return $row;
 }
 
 function selectGroupRole(int $groupID) {
diff --git a/website/queries/user.php b/website/queries/user.php
index 972937d..836c956 100644
--- a/website/queries/user.php
+++ b/website/queries/user.php
@@ -101,7 +101,9 @@ function selectUser($me, $other) {
 
     $stmt->bindParam(':me', $me, PDO::PARAM_INT);
     $stmt->bindParam(':other', $other, PDO::PARAM_INT);
-    $stmt->execute();
+    if(!$stmt->execute() || $stmt->rowCount() == 0) {
+        return False;
+    }
     return $stmt->fetch();
 }