From 5f72174d39d56de65bac753803c772104342aba0 Mon Sep 17 00:00:00 2001
From: Beluzsar Peter <beluzsarp@gmail.com>
Date: Tue, 18 Aug 2026 18:38:08 +0200
Subject: [PATCH] =?UTF-8?q?add=20some=20pamp=C3=A1r=20protection?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/Http/Controllers/TlaController.php | 81 ++++++++++++++------------
 1 file changed, 43 insertions(+), 38 deletions(-)

diff --git a/app/Http/Controllers/TlaController.php b/app/Http/Controllers/TlaController.php
index 0ae2b43..c6f8d4a 100644
--- a/app/Http/Controllers/TlaController.php
+++ b/app/Http/Controllers/TlaController.php
@@ -31,13 +31,13 @@ class TlaController extends Controller
     public function session_flush(Request $request, string $language)
     {
         $session = $request->session();
-        if ($session->get('date'.$language, NULL) != date('Y-m-d'))
+        if ($session->get('date-'.$language, NULL) != date('Y-m-d'))
         {
-            $session->forget('guesses-'.$language);
-            $session->forget('tla'.$language);
-            $session->forget('correct'.$language);
-            $session->forget('review'.$language);
-            $session->put('date'.$language, date('Y-m-d'));
+            $session->forget('guesses--'.$language);
+            $session->forget('tla-'.$language);
+            $session->forget('correct-'.$language);
+            $session->forget('review-'.$language);
+            $session->put('date-'.$language, date('Y-m-d'));
         }
     }
 
@@ -53,11 +53,11 @@ class TlaController extends Controller
 
         return response()->json([
             'hint' => $tla->hint,
-            'guesses' => $session->get('guesses-'.$language, []),
-            'date' => $session->get('date'.$language),
-            'tla' => $session->get('tla'.$language) == $tla->acronym ? $tla->acronym : NULL,
-            'context' => $session->get('tla'.$language) == $tla->acronym ? $tla->context : NULL,
-            'correct' => $session->get('correct'.$language),
+            'guesses' => $session->get('guesses--'.$language, []),
+            'date' => $session->get('date--'.$language),
+            'tla' => $session->get('tla-'.$language) == $tla->acronym ? $tla->acronym : NULL,
+            'context' => $session->get('tla-'.$language) == $tla->acronym ? $tla->context : NULL,
+            'correct' => $session->get('correct-'.$language),
         ]);
     } 
 
@@ -107,21 +107,21 @@ class TlaController extends Controller
            $score += $guess_array[$i + 3];
         }
 
-        $session->push('guesses-'.$language, $guess_array);
-        $guesses = $session->get('guesses-'.$language, NULL);
+        $session->push('guesses--'.$language, $guess_array);
+        $guesses = $session->get('guesses--'.$language, NULL);
 
         if ($score == 12 || count($guesses) == env('MAX_GUESSES', 10)) {
-            $session->put('tla'.$language, $tla_object->acronym);
-            if ($score == 12) $session->put('correct'.$language, true);
+            $session->put('tla-'.$language, $tla_object->acronym);
+            if ($score == 12) $session->put('correct-'.$language, true);
         }
 
         return response()->json([
             'guesses' => $guesses,
             'date' => $session->get('date'),
-            'tla' => $session->get('tla'.$language) == $tla_object->acronym ? $tla_object->acronym : NULL,
-            'context' => $session->get('tla'.$language) == $tla_object->acronym ? $tla_object->context : NULL,
+            'tla' => $session->get('tla-'.$language) == $tla_object->acronym ? $tla_object->acronym : NULL,
+            'context' => $session->get('tla-'.$language) == $tla_object->acronym ? $tla_object->context : NULL,
             'score' => $score,
-            'correct' => $session->get('correct'.$language),
+            'correct' => $session->get('correct-'.$language),
         ]);
     }
 
@@ -131,30 +131,35 @@ class TlaController extends Controller
 
     public function review(Request $request, String $language, int $type) {
         $session = $request->session();
-        $current = $session->get('review'.$language);
-        $tla = Tla::GetCurrentTla($language);
+        if ($session->get('correct-'.$language) == true) {
+            $current = $session->get('review-'.$language);
+            $tla = Tla::GetCurrentTla($language);
 
-        if ($type != 2) {
-            if ($current == $type) {
-                if ($current == 1) $tla->likes--;
-                else if ($current == -1) $tla->dislikes--;
-                $type = 2;
-            } else {
-                if ($current == 1) $tla->likes--;
-                else if ($current == -1) $tla->dislikes--;
+            if ($type != 2) {
+                if ($current == $type) {
+                    if ($current == 1) $tla->likes--;
+                    else if ($current == -1) $tla->dislikes--;
+                    $type = 2;
+                } else {
+                    if ($current == 1) $tla->likes--;
+                    else if ($current == -1) $tla->dislikes--;
 
-                if ($type == 1) $tla->likes++;
-                else if ($type == -1) $tla->dislikes++;
-            } 
-            $tla->save();
-            $session->put('review'.$language, $type);
+                    if ($type == 1) $tla->likes++;
+                    else if ($type == -1) $tla->dislikes++;
+                } 
+                $tla->save();
+                $session->put('review-'.$language, $type);
+            }
+
+            return response()->json([
+                'likes' => $tla->likes,
+                'dislikes' => $tla->dislikes,
+                'current' => $type,
+            ]);
         }
 
-        return response()->json([
-            'likes' => $tla->likes,
-            'dislikes' => $tla->dislikes,
-            'current' => $type,
-        ]);
+        else return response(null, 403);
+        
     }
 
     public function update(Request $request, Tla $tla): RedirectResponse