Authored by 毕凯

修改 uid 校验

... ... @@ -213,7 +213,7 @@ function getNamedCoupon(activityId, couponId, isApp, userIsLogged)
{
$.ajax({
type: 'POST',
url: !isApp ? '/cuxiao/coupon/getnamed' : '/cuxiao/coupon/getnamed?uid=' + GetQueryString('uid'),
url: isApp && uid ? '/cuxiao/coupon/getnamed?uid=' + uid : '/cuxiao/coupon/getnamed',
data: 'activityId=' + activityId + '&couponId=' + couponId,
success: function (data) {
setCookie('_Coupon' + activityId, null, {
... ...
... ... @@ -971,7 +971,7 @@ class CouponController extends HuodongAction
$uid = $this->get('uid'); // session 获取不到 UID,直接获取查询字符串的 uid, 严重问题,不安全,需要修复
}
if (!$uid) {
if (empty($uid)) {
$result['code'] = 400;
$result['message'] = '请先登录';
$result['data'] = Helpers::url('/signin.html', array('refer' => $this->server('HTTP_REFERER', '/')), 'default');
... ...