blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-21 08:52:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added check in CL/Messages_model->sendReply to check that $receiver_id, $relationmessage_id and $token match in the database to avoid to be able to write to anyone using a token

Browse Source
This commit is contained in:
Paolo
2022-08-30 17:31:04 +02:00
parent 81a33654a4
commit 8e0734ca8c
2 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/models/CL/Messages_model.php
+7
View File
@@ -528,6 +528,13 @@ class Messages_model extends CI_Model
*/
public function sendReply($receiver_id, $subject, $body, $relationmessage_id, $token)
{
// Checks that the receiver_id, relationmessage_id and token belongs to the same message
$crossedDataResult = $this->MessageTokenModel->crossClientData($token, $relationmessage_id, $receiver_id);
if (isError($crossedDataResult)) show_error(getError($crossedDataResult));
if (!hasData($crossedDataResult)) show_error(
'The parameters token, relationmessage_id and receiver_id do not belong to the same message'
);
// Retrieves message sender information
$senderResult = $this->MessageTokenModel->getSenderData($receiver_id);
if (isError($senderResult)) show_error(getError($senderResult));
application/models/system/MessageToken_model.php
+16
View File
@@ -176,4 +176,20 @@ class MessageToken_model extends DB_Model
return $this->execQuery($sql, array($oe_kurzbz));
}
/**
*
*/
public function crossClientData($token, $relationmessage_id, $receiver_id)
{
$sql = 'SELECT mm.message_id
FROM public.tbl_msg_message mm
JOIN public.tbl_msg_recipient mr USING(message_id)
WHERE mr.token = ?
AND mm.message_id = ?
AND mm.person_id = ?';
return $this->execQuery($sql, array($token, $relationmessage_id, $receiver_id));
}
}