bitPickups/friendica_2021.01_tupambae_shared_hosting
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

API: fix sender/recipient of PMs: check api_user before get user info.

Browse source 
To throw ForbiddenException and pass tests
This commit is contained in:
fabrixxm 2018-06-18 11:55:02 +02:00
commit e3ee9ee501
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
include/api.php
View file

@ -3700,7 +3700,9 @@ api_register_func('api/direct_messages/destroy', 'api_direct_messages_destroy',
function api_direct_messages_box($type, $box, $verbose)
{
$a = get_app();
if (api_user() === false) {
throw new ForbiddenException();
}
// params
$count = (x($_GET, 'count') ? $_GET['count'] : 20);
$page = (x($_REQUEST, 'page') ? $_REQUEST['page'] -1 : 0);
@ -3722,7 +3724,7 @@ function api_direct_messages_box($type, $box, $verbose)
unset($_GET["screen_name"]);
$user_info = api_get_user($a);
if (api_user() === false || $user_info === false) {
if ($user_info === false) {
throw new ForbiddenException();
}
$profile_url = $user_info["url"];