Ooops, only you should be able to start and stop following people

steveyen · May 24, 2009 · 74df792 · 74df792
1 parent db6e1e4
commit 74df792
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/app.rb b/app.rb
@@ -45,13 +45,15 @@ def redis
 get '/:follower/follow/:followee' do |follower_username, followee_username|
   follower = User.find_by_username(follower_username)
   followee = User.find_by_username(followee_username)
+  redirect '/' unless @logged_in_user == follower
   follower.follow(followee)
   redirect "/" + followee_username
 end
 
 get '/:follower/stopfollow/:followee' do |follower_username, followee_username|
   follower = User.find_by_username(follower_username)
   followee = User.find_by_username(followee_username)
+  redirect '/' unless @logged_in_user == follower
   follower.stop_following(followee)
   redirect "/" + followee_username
 end