Block page if certificate doesn't exists. #2931

certificates/index.php

@@ -1,5 +1,6 @@
 <?php
 /* For licensing terms, see /license.txt */
+
 /**
  * Show specified user certificate.
  *
@@ -9,14 +10,20 @@ require_once '../main/inc/global.inc.php';
 
 $action = isset($_GET['action']) ? $_GET['action'] : null;
 $userId = isset($_GET['user_id']) ? $_GET['user_id'] : 0;
+$certificateId = isset($_GET['id']) ? $_GET['id'] : 0;
+
+$certificate = new Certificate($certificateId, $userId);
+$certificateData = $certificate->get($certificateId);
+if (empty($certificateData)) {
+    api_not_allowed();
+}
 
-$category = Category::findByCertificate($_GET['id']);
+$category = Category::findByCertificate($certificateId);
 
 // Check if the certificate should use the course language
 if (!empty($category) && !empty($category->get_course_code())) {
     $courseInfo = api_get_course_info($category->get_course_code());
     $language = $courseInfo['language'];
-
     $languageFilesToLoad = api_get_language_files_to_load($language);
 
     foreach ($languageFilesToLoad as $languageFile) {
@@ -28,9 +35,7 @@ if (!empty($category) && !empty($category->get_course_code())) {
     $language_interface_initial_value = $language_interface;
 }
 
-$certificate = new Certificate($_GET['id'], $userId);
-
-CustomCertificatePlugin::redirectCheck($certificate, $_GET['id'], $userId);
+CustomCertificatePlugin::redirectCheck($certificate, $certificateId, $userId);
 
 switch ($action) {
     case 'export':