tyler.durden
/
pandorafms
mirror of https://github.com/pandorafms/pandorafms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

#11791 Prevent any user from changing another user's notification settings in AJAX

This commit is contained in:
miguel angel rasteu 2023-11-10 10:03:13 +01:00
parent c5e30c774b
commit 748238a7ea
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pandora_console/include/ajax/notifications.ajax.php
View File

@ -38,6 +38,10 @@ if ($change_label === '1') {
$source = get_parameter('source', 0);
$user = get_parameter('user', '');
$value = get_parameter('value', 0) ? 1 : 0;
$user_info = get_user_info($config['id_user']);
if ((bool) $user_info['is_admin'] === false && $config['id_user'] !== $user) {
return false;
}
// Update the label value.
ob_clean();

3
pandora_console/include/functions_notifications.php
View File

@ -661,7 +661,8 @@ function notifications_set_user_label_status($source, $user, $label, $value)
{
global $config;
if ((bool) check_acl($config['id_user'], 0, 'PM') === false && $config['id_user'] !== $user) {
$user_info = get_user_info($config['id_user']);
if ((bool) $user_info['is_admin'] === false && $config['id_user'] !== $user) {
return false;
}