From 112d997ca505c86a119904064ff9a28d6bd26b2d Mon Sep 17 00:00:00 2001
From: int2001 <joerg@dj7nt.de>
Date: Mon, 31 Jul 2023 07:16:15 +0000
Subject: [PATCH] Check if QRZ-QSOs belong to user, when triggering via GUI

---
 application/controllers/Qrz.php      |  6 +++---
 application/models/Logbook_model.php | 29 ++++++++++++++++------------
 2 files changed, 20 insertions(+), 15 deletions(-)

diff --git a/application/controllers/Qrz.php b/application/controllers/Qrz.php
index 68eb29db..7dce6900 100644
--- a/application/controllers/Qrz.php
+++ b/application/controllers/Qrz.php
@@ -26,7 +26,7 @@ class Qrz extends CI_Controller {
         if ($station_ids) {
             foreach ($station_ids as $station) {
                 $qrz_api_key = $station->qrzapikey;
-                if($this->mass_upload_qsos($station->station_id, $qrz_api_key)) {
+                if($this->mass_upload_qsos($station->station_id, $qrz_api_key, true)) {
                     echo "QSOs have been uploaded to QRZ.com.";
                     log_message('info', 'QSOs have been uploaded to QRZ.com.');
                 } else{
@@ -53,9 +53,9 @@ class Qrz extends CI_Controller {
      * Function gets all QSOs from given station_id, that are not previously uploaded to qrz.
      * Adif is build for each qso, and then uploaded, one at a time
      */
-    function mass_upload_qsos($station_id, $qrz_api_key) {
+    function mass_upload_qsos($station_id, $qrz_api_key, $trusted = false) {
         $i = 0;
-        $data['qsos'] = $this->logbook_model->get_qrz_qsos($station_id);
+        $data['qsos'] = $this->logbook_model->get_qrz_qsos($station_id, $trusted);
         $errormessages=array();
 
         $CI =& get_instance();
diff --git a/application/models/Logbook_model.php b/application/models/Logbook_model.php
index ee934bc0..fa43b050 100755
--- a/application/models/Logbook_model.php
+++ b/application/models/Logbook_model.php
@@ -1483,19 +1483,24 @@ class Logbook_model extends CI_Model {
     /*
      * Function returns the QSOs from the logbook, which have not been either marked as uploaded to qrz, or has been modified with an edit
      */
-    function get_qrz_qsos($station_id){
-        $sql = 'select *, dxcc_entities.name as station_country from ' . $this->config->item('table_name') . ' thcv ' .
-            ' left join station_profile on thcv.station_id = station_profile.station_id' .
-            ' left outer join dxcc_entities on thcv.col_my_dxcc = dxcc_entities.adif' .
-            ' where thcv.station_id = ' . $station_id .
-            ' and (COL_QRZCOM_QSO_UPLOAD_STATUS is NULL
-            or COL_QRZCOM_QSO_UPLOAD_STATUS = ""
-            or COL_QRZCOM_QSO_UPLOAD_STATUS = "M"
-            or COL_QRZCOM_QSO_UPLOAD_STATUS = "N")';
+  function get_qrz_qsos($station_id, $trusted = false){
+	  $CI =& get_instance();
+	  $CI->load->model('stations');
+	  if ((!$trusted) && (!$CI->stations->check_station_is_accessible($station_id))) {
+		  return;
+	  }
+	  $sql = 'select *, dxcc_entities.name as station_country from ' . $this->config->item('table_name') . ' thcv ' .
+		  ' left join station_profile on thcv.station_id = station_profile.station_id' .
+		  ' left outer join dxcc_entities on thcv.col_my_dxcc = dxcc_entities.adif' .
+		  ' where thcv.station_id = ' . $station_id .
+		  ' and (COL_QRZCOM_QSO_UPLOAD_STATUS is NULL
+		  or COL_QRZCOM_QSO_UPLOAD_STATUS = ""
+		  or COL_QRZCOM_QSO_UPLOAD_STATUS = "M"
+		  or COL_QRZCOM_QSO_UPLOAD_STATUS = "N")';
 
-        $query = $this->db->query($sql);
-        return $query;
-    }
+	  $query = $this->db->query($sql);
+	  return $query;
+  }
 
 	/*
      * Function returns the QSOs from the logbook, which have not been either marked as uploaded to webADIF