From 4c9756deeeb9e87763b55b6daa80795b37280797 Mon Sep 17 00:00:00 2001
From: Hamid Reza Mohammadi <mohammadi.hr@gmail.com>
Date: Thu, 29 Oct 2020 19:01:28 +0330
Subject: [PATCH] checking user session in profile GET (this should generally
 be checked in all protected methods)

---
 .../Controllers/AudioNarrationController.cs   | 21 ++++++++++++++++++-
 RMuseum/RMuseum.xml                           |  8 ++++++-
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/RMuseum/Controllers/AudioNarrationController.cs b/RMuseum/Controllers/AudioNarrationController.cs
index 9c48fc88..ca6a72a7 100644
--- a/RMuseum/Controllers/AudioNarrationController.cs
+++ b/RMuseum/Controllers/AudioNarrationController.cs
@@ -286,6 +286,18 @@ namespace RMuseum.Controllers
         public async Task<IActionResult> GetUserNarrationProfiles()
         {
             Guid loggedOnUserId = new Guid(User.Claims.FirstOrDefault(c => c.Type == "UserId").Value);
+            Guid sessionId = new Guid(User.Claims.FirstOrDefault(c => c.Type == "SessionId").Value);
+
+            RServiceResult<bool> sessionCheckResult = await _appUserService.SessionExists(loggedOnUserId, sessionId);
+            if (!string.IsNullOrEmpty(sessionCheckResult.ExceptionString))
+            {
+                return BadRequest(sessionCheckResult.ExceptionString);
+            }
+
+            if(!sessionCheckResult.Result)
+            {
+                return BadRequest("نشست کاربر معتبر نیست.");
+            }
 
 
             var res = await _audioService.GetUserNarrationProfiles(loggedOnUserId);
@@ -373,10 +385,12 @@ namespace RMuseum.Controllers
         /// </summary>
         /// <param name="audioService">
         /// </param>
+        /// <param name="appUserService"></param>
         /// <param name="userPermissionChecker"></param>
-        public AudioNarrationController(IAudioNarrationService audioService, IUserPermissionChecker userPermissionChecker)
+        public AudioNarrationController(IAudioNarrationService audioService, IAppUserService appUserService, IUserPermissionChecker userPermissionChecker)
         {
             _audioService = audioService;
+            _appUserService = appUserService;
             _userPermissionChecker = userPermissionChecker;
         }
 
@@ -389,5 +403,10 @@ namespace RMuseum.Controllers
         /// IUserPermissionChecker instance
         /// </summary>
         protected IUserPermissionChecker _userPermissionChecker;
+
+        /// <summary>
+        /// IAppUserService instance
+        /// </summary>
+        protected IAppUserService _appUserService;
     }
 }
diff --git a/RMuseum/RMuseum.xml b/RMuseum/RMuseum.xml
index ec8bef4e..0bf911e0 100644
--- a/RMuseum/RMuseum.xml
+++ b/RMuseum/RMuseum.xml
@@ -708,12 +708,13 @@
             <param name="id"></param>
             <returns></returns>
         </member>
-        <member name="M:RMuseum.Controllers.AudioNarrationController.#ctor(RMuseum.Services.IAudioNarrationService,RSecurityBackend.Services.IUserPermissionChecker)">
+        <member name="M:RMuseum.Controllers.AudioNarrationController.#ctor(RMuseum.Services.IAudioNarrationService,RSecurityBackend.Services.IAppUserService,RSecurityBackend.Services.IUserPermissionChecker)">
             <summary>
             constructor
             </summary>
             <param name="audioService">
             </param>
+            <param name="appUserService"></param>
             <param name="userPermissionChecker"></param>
         </member>
         <member name="F:RMuseum.Controllers.AudioNarrationController._audioService">
@@ -726,6 +727,11 @@
             IUserPermissionChecker instance
             </summary>
         </member>
+        <member name="F:RMuseum.Controllers.AudioNarrationController._appUserService">
+            <summary>
+            IAppUserService instance
+            </summary>
+        </member>
         <member name="T:RMuseum.Controllers.AuditLogController">
             <summary>
             Audit Log Controller Base