group invite auth check

web/db.py

@@ -58,8 +58,16 @@ class MomokoDB:
 		return group_id
 
 	@tornado.gen.coroutine
-	def invite_user_group(self, email, group_id):
+	def invite_user_group(self, user_id, email, group_id):
+		cursor = yield self.execute('''
+			SELECT 1 FROM user_groups WHERE user_id = %s AND group_id = %s;
+		''', user_id, group_id)
+		if not cursor.fetchone():
+			return
 		cursor = yield self.execute('SELECT id FROM users WHERE email = %s;', email)
+		user = cursor.fetchone()
+		if not user:
+			return
 		user_id = cursor.fetchone()['id']
 		yield self.execute('INSERT INTO user_groups (user_id, group_id) VALUES(%s, %s);', user_id, group_id)
 

web/sysvitals_web.py

@@ -129,7 +129,7 @@ class GroupInviteHandler(BaseHandler):
 	@tornado.gen.coroutine
 	def post(self):
 		group_id = int(self.get_body_argument('group'))
-		yield self.db.invite_user_group(self.get_body_argument('email'), group_id)
+		yield self.db.invite_user_group(self.current_user['id'], self.get_body_argument('email'), group_id)
 		self.redirect('/groups')
 
 class CSSHandler(tornado.web.RequestHandler):