server/AyaNova/biz/ReminderBiz.cs

@@ -67,6 +67,11 @@ namespace AyaNova.Biz
         internal async Task<Reminder> GetAsync(long id, bool logTheGetEvent = true)
         {
             var ret = await ct.Reminder.AsNoTracking().SingleOrDefaultAsync(m => m.Id == id);
+            if (ret.UserId != UserId)
+            {
+                AddError(ApiErrorCode.NOT_AUTHORIZED, "generalerror", "A User may only retrieve their own reminders");
+                return null;
+            }
             if (logTheGetEvent && ret != null)
                 await EventLogProcessor.LogEventToDatabaseAsync(new Event(UserId, id, BizType, AyaEvent.Retrieved), ct);
             return ret;
@@ -113,7 +118,7 @@ namespace AyaNova.Biz
             return putObject;
         }
 
-         ////////////////////////////////////////////////////////////////////////////////////////////////
+        ////////////////////////////////////////////////////////////////////////////////////////////////
         //UPDATE schedule only
         //       
         internal async Task<bool> PutNewScheduleTimeAsync(ScheduleItemAdjustParams p)
@@ -143,7 +148,7 @@ namespace AyaNova.Biz
                 return false;
             }
             await EventLogProcessor.LogEventToDatabaseAsync(new Event(UserId, dbObject.Id, dbObject.AyaType, AyaEvent.Modified), ct);
-          
+
             await HandlePotentialNotificationEvent(AyaEvent.Modified, dbObject, dbObject);
             return true;
         }
@@ -425,7 +430,7 @@ namespace AyaNova.Biz
         public async Task HandlePotentialNotificationEvent(AyaEvent ayaEvent, ICoreBizObjectModel proposedObj, ICoreBizObjectModel currentObj = null)
         {
             ILogger log = AyaNova.Util.ApplicationLogging.CreateLogger<ReminderBiz>();
-            if(ServerBootConfig.SEEDING || ServerBootConfig.MIGRATING) return;
+            if (ServerBootConfig.SEEDING || ServerBootConfig.MIGRATING) return;
             log.LogDebug($"HandlePotentialNotificationEvent processing:  [AyaType:{this.BizType}, AyaEvent:{ayaEvent}]");
 
             bool isNew = currentObj == null;