Improve access control checks on Perso::cancel()

app/controller/perso.php

@@ -490,8 +490,11 @@ class Perso extends Controller
 
     public function cancel($f3, $params)
     {
+        if (!$f3->exists('SESSION.user')) {
+            $f3->reroute('/login');
+        }
         $db = $f3->get('DB');
-        $result = $db->query("SELECT identifier, user_id from identifiers where identifier like '".$params['id']."'");
+        $result = $db->query("SELECT identifier, user_id from identifiers where identifier like '".$params['id']."' and user_id='".\Utils::asl($f3->get('SESSION.id'))."'");
         $result = $result->fetch(\PDO::FETCH_ASSOC);
         if ($result) {
             $identifier = $result['identifier'];