CVE-2023-1883: fix: added check if news or FAQs are active · thorsten/phpMyFAQ@db77df8

@@ -1258,6 +1258,39 @@ public function hasTranslation(int $recordId, string $recordLang): bool return false; }
public function isActive(int $recordId, string $recordLang, string $commentType = ‘faq’): bool { if (‘news’ === $commentType) { $table = 'faqnews’; } else { $table = 'faqdata’; }
$query = sprintf( " SELECT active FROM %s%s WHERE id = %d AND lang = '%s’", Database::getTablePrefix(), $table, $recordId, $this->config->getDb()->escape($recordLang) );
$result = $this->config->getDb()->query($query);
if ($row = $this->config->getDb()->fetchObject($result)) { return !(($row->active === ‘y’ || $row->active === ‘yes’)); } else { return true; } }
/** * Checks, if comments are disabled for the FAQ record. * @@ -1268,7 +1301,7 @@ public function hasTranslation(int $recordId, string $recordLang): bool */ public function commentDisabled(int $recordId, string $recordLang, string $commentType = ‘faq’): bool { if (‘news’ == $commentType) { if (‘news’ === $commentType) { $table = 'faqnews’; } else { $table = 'faqdata’;