ajouter des sécurité sur les URL, les Roles, les mdp

2026-07-20 14:57:12 -04:00
parent 482211e6e0
commit 87a84fd43b
20 changed files with 177 additions and 51 deletions
@@ -283,6 +283,11 @@ def add_player_note(team_id, player_id):
        flash('Can only add notes for players.', 'danger')
        return redirect(url_for('teams.list_teams'))

+    # Verify player belongs to this team
+    if player.team_id != team_id:
+        flash(f'{player.full_name} is not on {team.name}.', 'danger')
+        return redirect(url_for('teams.list_teams'))
+
    content = request.form.get('content', '').strip()

    if content: