MLAB-227: prevent HFT account to access "security" page

routes/methods.js

@@ -69,7 +69,7 @@ var methods = {
         })
     },
     getUserByEmail: function(email, callback) {
-        dbconn.user.query('SELECT verificationStatus, salutation, title, firstname, lastname, industry, organisation, speciality FROM user WHERE email = "' +email+'"', function (err, rows, fields) {
+        dbconn.user.query('SELECT verificationStatus, salutation, title, firstname, lastname, industry, organisation, speciality, m4lab_idp FROM user WHERE email = "' +email+'"', function (err, rows, fields) {
             if (err) {
                 throw err;
             }

routes/routes-account.js

@@ -240,8 +240,7 @@ module.exports = function (app, config, passport, i18n) {
     if (req.isAuthenticated()) {
       methods.getUserByEmail(req.user.email, function(data, err){
         if (!err) {
-          if (data.verificationStatus == 1) {
-            console.log(data)
+          if (data.verificationStatus == 1 && data.m4lab_idp == 1) {
             res.render(lang+'/account/security', {
               user: data
             })

views/DE/account/home.pug

@@ -29,10 +29,11 @@ html(lang="de")
                                     a(class="nav-link pl-0" href="/account/profile")
                                         i(class="fa fa-user fa-fw")
                                         span(class="d-none d-md-inline") Benutzerprofil
-                                li(class="nav-item")
-                                    a(class="nav-link pl-0" href="/account/security")
-                                        i(class="fa fa-lock fa-fw")
-                                        span(class="d-none d-md-inline") Sicherheitseinstellungen
+                                if user.m4lab_idp == 1
+                                    li(class="nav-item")
+                                        a(class="nav-link pl-0" href="/account/security")
+                                            i(class="fa fa-lock fa-fw")
+                                            span(class="d-none d-md-inline") Sicherheitseinstellungen
                                 li(class="nav-item")
                                     a(class="nav-link pl-0" href="/account/services")
                                         i(class="fa fa-tasks fa-fw")

views/DE/account/profile.pug

@@ -20,10 +20,11 @@ html(lang="de")
                                 a(class="nav-link pl-0" href="/account/profile")
                                     i(class="fa fa-user fa-fw" style="color:black;")
                                     span(class="d-none d-md-inline" style="color:black;") Benutzerprofil
-                            li(class="nav-item")
-                                a(class="nav-link pl-0" href="/account/security")
-                                    i(class="fa fa-lock fa-fw")
-                                    span(class="d-none d-md-inline") Sicherheitseinstellungen
+                            if user.m4lab_idp == 1
+                                li(class="nav-item")
+                                    a(class="nav-link pl-0" href="/account/security")
+                                        i(class="fa fa-lock fa-fw")
+                                        span(class="d-none d-md-inline") Sicherheitseinstellungen
                             li(class="nav-item")
                                 a(class="nav-link pl-0" href="/account/services")
                                     i(class="fa fa-tasks fa-fw")

views/DE/account/services.pug

@@ -20,10 +20,11 @@ html(lang="de")
                                 a(class="nav-link pl-0" href="/account/profile")
                                     i(class="fa fa-user fa-fw")
                                     span(class="d-none d-md-inline") Benutzerprofil
-                            li(class="nav-item")
-                                a(class="nav-link pl-0" href="/account/security")
-                                    i(class="fa fa-lock fa-fw")
-                                    span(class="d-none d-md-inline") Sicherheitseinstellungen
+                            if user.m4lab_idp == 1
+                                li(class="nav-item")
+                                    a(class="nav-link pl-0" href="/account/security")
+                                        i(class="fa fa-lock fa-fw")
+                                        span(class="d-none d-md-inline") Sicherheitseinstellungen
                             li(class="nav-item")
                                 a(class="nav-link pl-0" href="/account/services")
                                     i(class="fa fa-tasks fa-fw" style="color:black;")