Security: Fix logical flaw allowing unauthenticated users to send data to a specific table

ywarnier · ywarnier · commit 58c54f4631d4 · 2024-09-21T00:38:42.000+02:00
diff --git a/main/lp/storageapi.php b/main/lp/storageapi.php
@@ -67,7 +67,7 @@
 function storage_can_set($sv_user)
 {
     // platform admin can change any user's stored values, other users can only change their own values
-    $allowed = ((api_is_platform_admin()) || ($sv_user == api_get_user_id()));
+    $allowed = ((api_is_platform_admin()) || (!empty($sv_user) && $sv_user == api_get_user_id()));
     if (!$allowed) {
         echo "ERROR : Not allowed";
     }

Original file line number	Diff line number	Diff line change
`@@ -67,7 +67,7 @@`
`67`	`67`	`function storage_can_set($sv_user)`
`68`	`68`	`{`
`69`	`69`	`// platform admin can change any user's stored values, other users can only change their own values`
`70`		`- $allowed = ((api_is_platform_admin()) \|\| ($sv_user == api_get_user_id()));`
	`70`	`+ $allowed = ((api_is_platform_admin()) \|\| (!empty($sv_user) && $sv_user == api_get_user_id()));`
`71`	`71`	`if (!$allowed) {`
`72`	`72`	`echo "ERROR : Not allowed";`
`73`	`73`	`}`