From 17118b4595044ef2d52a5c1f05b0d8d1cf86d28d Mon Sep 17 00:00:00 2001
From: mayue <mayue@easycorp.ltd>
Date: Tue, 26 Oct 2021 14:37:42 +0800
Subject: [PATCH] *Fix a bug #15739

---
 module/api/control.php        | 16 +---------------
 module/api/model.php          | 25 ++++++++++++++++++++-----
 module/api/view/edit.html.php |  1 +
 3 files changed, 22 insertions(+), 20 deletions(-)

diff --git a/module/api/control.php b/module/api/control.php
index d601c7ba31..0c3c7253a0 100755
--- a/module/api/control.php
+++ b/module/api/control.php
@@ -414,21 +414,7 @@ class api extends control
     {
         if(helper::isAjaxRequest() && !empty($_POST))
         {
-            $this->loadModel('api');
-
-            $now    = helper::now();
-            $userId = $this->app->user->account;
-            $params = fixer::input('post')
-                ->remove('type')
-                ->skipSpecial('params,response')
-                ->add('addedBy', $userId)
-                ->add('addedDate', $now)
-                ->add('editedBy', $userId)
-                ->add('editedDate', $now)
-                ->setDefault('product,module', 0)
-                ->get();
-
-            $changes = $this->api->update($apiID, $params);
+            $changes = $this->api->update($apiID);
             if(dao::isError()) return $this->sendError(dao::getError());
 
             if($changes)
diff --git a/module/api/model.php b/module/api/model.php
index c5171d84e8..bead5e677a 100644
--- a/module/api/model.php
+++ b/module/api/model.php
@@ -192,14 +192,29 @@ class apiModel extends model
     /**
      * Update an api doc.
      *
-     * @param int $id
-     * @param object $data
+     * @param int $apiID
      * @access public
      * @return void
      */
-    public function update($id, $data)
+    public function update($apiID)
     {
-        $oldApi = $this->dao->findByID($id)->from(TABLE_API)->fetch();
+        $oldApi = $this->dao->findByID($apiID)->from(TABLE_API)->fetch();
+
+        if(!empty($_POST['editedDate']) and $oldApi->editedDate != $this->post->editedDate)
+        {
+            dao::$errors[] = $this->lang->error->editedByOther;
+            return false;
+        }
+
+        $now    = helper::now();
+        $account = $this->app->user->account;
+        $data = fixer::input('post')
+            ->remove('type')
+            ->skipSpecial('params,response')
+            ->add('editedBy', $account)
+            ->add('editedDate', $now)
+            ->setDefault('product,module', 0)
+            ->get();
 
         $data->id      = $oldApi->id;
         $data->version = $oldApi->version + 1;
@@ -212,7 +227,7 @@ class apiModel extends model
             ->data($data)
             ->autoCheck()
             ->batchCheck($this->config->api->edit->requiredFields, 'notempty')
-            ->where('id')->eq($id)
+            ->where('id')->eq($apiID)
             ->exec();
 
         return common::createChanges($oldApi, $data);
diff --git a/module/api/view/edit.html.php b/module/api/view/edit.html.php
index 5441e6b912..0aba1ce526 100644
--- a/module/api/view/edit.html.php
+++ b/module/api/view/edit.html.php
@@ -227,6 +227,7 @@ js::set('api', $api);
             <tr>
               <td colspan='3' class='text-center form-actions'>
                 <?php echo html::submitButton();?>
+                <?php echo html::hidden('editedDate', $api->editedDate);?>
                 <?php if(empty($gobackLink)) echo html::backButton($lang->goback, "data-app='{$app->tab}'");?>
                 <?php if(!empty($gobackLink)) echo html::a($gobackLink, $lang->goback, '', "class='btn btn-back btn-wide'");?>
               </td>