CVE-2023-1887: fix: corrected wrong check on user permission · thorsten/phpMyFAQ@400d9cd

@@ -8,12 +8,12 @@

* v. 2.0. If a copy of the MPL was not distributed with this file, You can

* obtain one at http://mozilla.org/MPL/2.0/.

*

* @package phpMyFAQ

* @author Thorsten Rinne [email protected]

* @package phpMyFAQ

* @author Thorsten Rinne [email protected]

* @copyright 2003-2022 phpMyFAQ Team

* @license http://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0

* @link https://www.phpmyfaq.de

* @since 2003-02-23

* @license http://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0

* @link https://www.phpmyfaq.de

* @since 2003-02-23

*/

use Abraham\TwitterOAuth\TwitterOAuth;

@@ -41,7 +41,7 @@

exit();

}

if ($user->perm->hasPermission($user->getUserId(), ‘edit_faq’) || $user->perm->hasPermission($user->getUserId(), ‘add_faq’)) {

if ($user->perm->hasPermission($user->getUserId(), ‘add_faq’)) {

// FAQ data

$dateStart = Filter::filterInput(INPUT_POST, 'dateStart’, FILTER_UNSAFE_RAW);

$dateEnd = Filter::filterInput(INPUT_POST, 'dateEnd’, FILTER_UNSAFE_RAW);