Apps/NotePost
2
0
Fork 0
Code Issues 3 Pull Requests Releases Wiki Activity

Improve isManagerOf() error handling to prevent possible security bug

Browse Source
This commit is contained in:
Skylar Ittner 2018-01-03 21:55:48 -07:00
parent abb306a36e
commit ce8e0fb4e3
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/userinfo.php
View File

@ -1,4 +1,5 @@
<?php <?php
/** /**
* Get user info for the given username. * Get user info for the given username.
* @param int $u username * @param int $u username
@ -85,10 +86,10 @@ function isManagerOf($m, $e) {
$resp = json_decode($response->getBody(), TRUE); $resp = json_decode($response->getBody(), TRUE);
if ($resp['status'] == "OK") { if ($resp['status'] == "OK") {
return $resp['managerof']; return $resp['managerof'] === true;
} else { } else {
// this shouldn't happen, but in case it does just fake it. // this shouldn't happen, but in case it does just fake it.
return ["name" => $u, "username" => $u, "uid" => $u]; return false;
} }
} }