ajout de sécurité pour le URL

routes/users.py

@@ -19,7 +19,7 @@ users_bp = Blueprint('users', __name__, url_prefix='/users')
 
 def update_user_gamertags(user, selected_games):
     """Update gamertags for a user based on form input.
-    
+
     Handles creating, updating, and deleting gamertag records for the specified games.
     Used by both edit_user and edit_profile routes to avoid code duplication.
     
@@ -1050,15 +1050,20 @@ def delete_coach_availability(availability_id):
 @login_required
 def api_get_coach_availability(coach_id):
     """API endpoint to get coach availability.
-
+    
     Args:
         coach_id: The ID of the coach.
-
+        
     Returns:
         Response: JSON with availability data.
     """
     if current_user.role != 'player':
         return jsonify({'error': 'Unauthorized'}), 403
+    
+    # Players can only view their own coach's availability
+    org_team = OrgTeam.query.get(current_user.team_id) if current_user.team_id else None
+    if org_team and org_team.coach_id != coach_id:
+        return jsonify({'error': 'Unauthorized'}), 403
 
     availability = CoachAvailability.query.filter_by(coach_id=coach_id).all()
 
@@ -1324,24 +1329,29 @@ def add_personal_note():
         # Validate context - ensure coach can access the match/tryout/team
         if match_id:
             match = Match.query.get(match_id)
-            match_tryout = None
             if match:
                 match_tryout = Tryout.query.get(match.tryout_id)
-                if match_tryout and match_tryout.target_org_team_id and match_tryout.target_org_team_id != org_team.id:
-                    flash('You can only add notes for matches in your team\'s tryouts.', 'danger')
-                    return redirect(url_for('users.add_personal_note'))
-        if tryout_id and org_team:
+                # For coaches, verify the match is in their team's tryout
+                if current_user.role == 'coach' and org_team:
+                    if match_tryout and match_tryout.target_org_team_id and match_tryout.target_org_team_id != org_team.id:
+                        flash('You can only add notes for matches in your team\'s tryouts.', 'danger')
+                        return redirect(url_for('users.add_personal_note'))
+        if tryout_id:
             tryout = Tryout.query.get(tryout_id)
-            if tryout and tryout.target_org_team_id and tryout.target_org_team_id != org_team.id:
-                flash('You can only add notes for your team\'s tryouts.', 'danger')
-                return redirect(url_for('users.add_personal_note'))
-        if team_id and org_team:
-            team = Team.query.get(team_id)
-            if team:
-                tryout = Tryout.query.get(team.tryout_id)
+            # For coaches, verify the tryout targets their team
+            if current_user.role == 'coach' and org_team:
                 if tryout and tryout.target_org_team_id and tryout.target_org_team_id != org_team.id:
                     flash('You can only add notes for your team\'s tryouts.', 'danger')
                     return redirect(url_for('users.add_personal_note'))
+        if team_id:
+            team = Team.query.get(team_id)
+            if team:
+                team_tryout = Tryout.query.get(team.tryout_id)
+                # For coaches, verify the team is in their tryout
+                if current_user.role == 'coach' and org_team:
+                    if team_tryout and team_tryout.target_org_team_id and team_tryout.target_org_team_id != org_team.id:
+                        flash('You can only add notes for your team\'s tryouts.', 'danger')
+                        return redirect(url_for('users.add_personal_note'))
 
         note = PersonalNote(
             player_id=player_id,