Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
fix: avoid possible email address manipulation
  • Loading branch information
thorsten committed Apr 12, 2023
1 parent de8be82 commit 07552f5
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 1 deletion.
5 changes: 5 additions & 0 deletions phpmyfaq/ajaxservice.php
Expand Up @@ -774,6 +774,11 @@
break;
}

if ($userId !== $user->getUserIdByEmail($email)) {
$message = ['error' => 'User ID / email mismatch!'];
break;
}

if (strlen($password) <= 7 || strlen($confirm) <= 7) {
$message = ['error' => $PMF_LANG['ad_passwd_fail']];
break;
Expand Down
2 changes: 1 addition & 1 deletion phpmyfaq/src/phpMyFAQ/User.php
Expand Up @@ -908,7 +908,7 @@ public function getUserIdByEmail(string $email): int

$userData = $this->userdata->fetchAll('email', $email);

return (int)$userData['user_id'];
return $userData['user_id'];
}

/**
Expand Down

0 comments on commit 07552f5

Please sign in to comment.