diff --git a/.idea/workspace.xml b/.idea/workspace.xml
index f243989..c839e7f 100755
--- a/.idea/workspace.xml
+++ b/.idea/workspace.xml
@@ -19,13 +19,11 @@
-
+
-
-
-
-
+
+
@@ -36,7 +34,7 @@
-
+
@@ -80,7 +78,7 @@
1601618466935
-
+
1601618764031
@@ -131,7 +129,14 @@
1601724613157
-
+
+ 1601747583143
+
+
+
+ 1601747583143
+
+
@@ -155,7 +160,8 @@
-
+
+
@@ -194,10 +200,10 @@
-
+
-
+
diff --git a/config.inc.php b/config.inc.php
index 7bbd0ba..80f4dd5 100644
--- a/config.inc.php
+++ b/config.inc.php
@@ -8,4 +8,4 @@ define( 'MYSQL_DB', 'online-faq' );
define( 'CODE_LENGTH', 4 );
define( 'SHARE_URL_PREFIX', 'https://faq.hw-table.de/?code=' );
-define( 'WASTED_TIME', '32hrs and 32mins' );
+define( 'WASTED_TIME', '33hrs and 7mins' );
diff --git a/model/DefaultModel.class.inc.php b/model/DefaultModel.class.inc.php
index 947947a..5fa1e37 100755
--- a/model/DefaultModel.class.inc.php
+++ b/model/DefaultModel.class.inc.php
@@ -31,11 +31,13 @@ class DefaultModel
public function createRoom(string $room_name)
{
- $room_owner = session_id();
- $stmnt = Database::getConnection()->prepare( 'INSERT INTO rooms ( name, owner_sid, code ) VALUES ( :name, :owner, :code )' );
- $stmnt->execute( array( 'name' => $room_name, 'owner' => $room_owner, 'code' => $this->generateRandomStr( CODE_LENGTH ) ) );
+ $secret = $this->generateRandomStr( 15 );
+ $stmnt = Database::getConnection()->prepare( 'INSERT INTO rooms ( name, owner_sid, code ) VALUES ( :name, :owner_sid, :code )' );
+ $stmnt->execute( array( 'name' => $room_name, 'owner_sid' => $secret, 'code' => $this->generateRandomStr( CODE_LENGTH ) ) );
+
$id = Database::getConnection()->lastInsertId( );
+ setcookie( 'owner_room_' . $id, $secret, time()+60*60*24*365 );
if( empty( $id ) )
{
return false;
diff --git a/model/FaqModel.class.inc.php b/model/FaqModel.class.inc.php
index d0b80e8..6d3b86d 100644
--- a/model/FaqModel.class.inc.php
+++ b/model/FaqModel.class.inc.php
@@ -89,7 +89,8 @@ class FaqModel
{
return false;
}
- if( $result['owner_sid'] === session_id() )
+ $secret = empty( $_COOKIE['owner_room_' . $a_room['id'] ] ) ? null : $_COOKIE['owner_room_' . $a_room['id'] ];
+ if( $result['owner_sid'] === $secret )
{
return true;
}