mirror of
https://github.com/friendica/friendica
synced 2024-10-08 16:01:55 +02:00
prevent admin hijacks
This commit is contained in:
parent
45c1559b38
commit
bb0c24bd4f
|
@ -127,7 +127,7 @@ function notifications_content(&$a) {
|
|||
notice( t('No notifications.') . EOL);
|
||||
|
||||
if ($a->config['register_policy'] = REGISTER_APPROVE &&
|
||||
$a->config['admin_email'] = $a->user['email']){
|
||||
$a->config['admin_email'] === $a->user['email']){
|
||||
$o .= load_view_file('view/registrations-top.tpl');
|
||||
|
||||
$r = q("SELECT `register`.*, `contact`.`name`, `user`.`email`
|
||||
|
|
|
@ -12,6 +12,11 @@ function regmod_content(&$a) {
|
|||
return $o;
|
||||
}
|
||||
|
||||
if((! (x($a->config,'admin_email'))) || ($a->config['admin_email'] !== $a->user['email'])) {
|
||||
notice( t('Permission denied.') . EOL);
|
||||
return '';
|
||||
}
|
||||
|
||||
if($a->argc != 3)
|
||||
killme();
|
||||
|
||||
|
|
|
@ -95,6 +95,10 @@ function settings_post(&$a) {
|
|||
$email_changed = true;
|
||||
if(! valid_email($email))
|
||||
$err .= t(' Not valid email.');
|
||||
if((x($a->config,'admin_email')) && (strcasecmp($email,$a->config['admin_email']) == 0)) {
|
||||
$err .= t(' Cannot change to that email.');
|
||||
$email = $a->user['email'];
|
||||
}
|
||||
}
|
||||
|
||||
if(strlen($err)) {
|
||||
|
|
Loading…
Reference in a new issue