Security: Fix logical flaw allowing unauthenticated users to send data to a specific table

12 months ago · 58c54f4631
parent dc24215029
commit 58c54f4631
1 changed files with 1 additions and 1 deletions
--- a/main/lp/storageapi.php
+++ b/main/lp/storageapi.php
@ -67,7 +67,7 @@ switch ($_REQUEST['action']) {
 function storage_can_set($sv_user)
 {
    // platform admin can change any user's stored values, other users can only change their own values
-    $allowed = ((api_is_platform_admin()) || ($sv_user == api_get_user_id()));
+    $allowed = ((api_is_platform_admin()) || (!empty($sv_user) && $sv_user == api_get_user_id()));
    if (!$allowed) {
        echo "ERROR : Not allowed";
    }