Be more paranoid with param in list context

[ndwebbie.git] / lib / NDWeb / Controller / Root.pm

diff --git a/lib/NDWeb/Controller/Root.pm b/lib/NDWeb/Controller/Root.pm
index 29a0cbcb1a665a029c2709cbc07d84609eedf465..f1b020a0779eada5a0f203add13251ec975c5bf4 100644 (file)
--- a/lib/NDWeb/Controller/Root.pm
+++ b/lib/NDWeb/Controller/Root.pm
@@ -105,10 +105,14 @@ UPDATE sms SET status = $2, cost = $3
 WHERE msgid = $1
                });
 
-       $sms->execute($c->req->param('apiMsgId')
-               ,$clickatellstatus{$c->req->param('status')}
-               ,$c->req->param('charge')
-               ,$c->req->param('timestamp'));
+       my $apiMsgId = $c->req->param('apiMsgId');
+       my $status = $c->req->param('status');
+       my $charge = $c->req->param('charge');
+       my $timestamp = $c->req->param('timestamp');
+       $sms->execute($apiMsgId
+               ,$clickatellstatus{$status}
+               ,$charge
+               ,$timestamp);
 
 }
 
@@ -129,8 +133,8 @@ sub listTargets : Private {
 
        my $dbh = $c ->model;
 
-       my $query = $dbh->prepare(q{SELECT t.id, r.id AS raid, r.tick+c.wave-1 AS landingtick, 
-               (released_coords AND old_claim(timestamp)) AS released_coords, coords(x,y,z),c.launched,c.wave,c.joinable
+       my $query = $dbh->prepare(q{SELECT t.id, r.id AS raid, r.tick+c.wave-1 AS landingtick,
+               released_coords, coords(x,y,z),c.launched,c.wave,c.joinable
 FROM raid_claims c
        JOIN raid_targets t ON c.target = t.id
        JOIN raids r ON t.raid = r.id
@@ -220,6 +224,10 @@ sub end : ActionClass('RenderView') {
                        $c->stash->{template} = 'access_denied.tt2';
                        $c->res->status(403);
                        $c->clear_errors;
+               }elsif ($c->error->[0] =~ m/No logged in user, and none supplied as argument/){
+                       $c->stash->{template} = 'access_denied.tt2';
+                       $c->res->status(403);
+                       $c->clear_errors;
                }
        }
 
@@ -243,10 +251,7 @@ AND mission = 'Full fleet' AND name IN ('Main','Advanced Unit');
                        newposts => $newposts,
                        unreadposts => $unread
                });
-               $c->stash->{user}->{attacker} = $c->check_user_roles(qw/attack_menu/)
-                       && (!$c->check_user_roles(qw/member_menu/)
-                               || ($c->user->planet && (($c->stash->{TICK} - $fleetupdate < 24)
-                                       || $c->check_user_roles(qw/no_fleet_update/)))),
+               $c->stash->{user}->{attacker} = $c->check_user_roles(qw/attack_menu/);
                $c->forward('listTargets');
        }
        my $birthdays = $dbh->prepare(q{SELECT username