Pro-Idler/BinStack
1
0
Fork 0
forked from Business/BinStack
Code Issues Pull Requests Projects Releases Wiki Activity

Improve isManagerOf() error handling to prevent possible security bug

Browse Source
This commit is contained in:
Skylar Ittner 2018-01-03 21:56:25 -07:00
parent d749564a53
commit 112599d162
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/userinfo.php
View File

@ -90,10 +90,10 @@ function isManagerOf($m, $e) {
$resp = json_decode($response->getBody(), TRUE);
if ($resp['status'] == "OK") {
return $resp['managerof'];
return $resp['managerof'] === true;
} else {
// this shouldn't happen, but in case it does just fake it.
return ["name" => $u, "username" => $u, "uid" => $u];
return false;
}
}

2
required.php
View File

@ -82,7 +82,7 @@ function sendError($error) {
. "<h1>A fatal application error has occurred.</h1>"
. "<i>(This isn't your fault.)</i>"
. "<h2>Details:</h2>"
. "<p>". htmlspecialchars($error) . "</p>");
. "<p>" . htmlspecialchars($error) . "</p>");
}
date_default_timezone_set(TIMEZONE);