Don't allow non-GET requests in demo mode

mike-koch · Jun 28, 2017 · e8c0291 · e8c0291
1 parent 991c5cb
commit e8c0291
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/api/index.php b/api/index.php
@@ -16,6 +16,11 @@ function handle404() {
 }
 
 function before() {
+    if (defined('HESK_DEMO') && $_SERVER['REQUEST_METHOD'] !== 'GET') {
+        print_error('Demo Mode', 'Only read-only commands are available in demo mode!', null, 401);
+        die();
+    }
+
     $internalUse = \BusinessLogic\Helpers::getHeader('X-INTERNAL-CALL');
 
     if ($internalUse === 'true') {