CVE-2023-1762: fix: privilege escalation for users with insufficient permissions · thorsten/phpMyFAQ@ae6c1d8

@@ -121,6 +121,10 @@

$isSuperAdmin = Filter::filterInput(INPUT_POST, 'is_superadmin’, FILTER_UNSAFE_RAW);

$isSuperAdmin = $isSuperAdmin === 'on’;

if (!$user->isSuperAdmin()) {

$isSuperAdmin = false;

}

// Sanity check

if (is_null($userData[‘email’])) {

$message .= sprintf('<p class="alert alert-danger">%s</p>’, $PMF_LANG[‘err_noMailAdress’]);

@@ -705,6 +709,7 @@ class="form-control">

</div>

</div>

<?php if ($user->isSuperAdmin()) { ?>

<div class="form-group row">

<div class="col-lg-4"></div>

<div class="col-lg-8">

@@ -716,6 +721,7 @@ class="form-control">

</div>

</div>

</div>

<?php } ?>

</form>

</div>