keith/friendica
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

API: fix sender/recipient of PMs: check api_user before get user info.

Browse source 
To throw ForbiddenException and pass tests
This commit is contained in:
fabrixxm 2018-06-18 11:55:02 +02:00
parent c015bb1b77
commit e3ee9ee501
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
include/api.php
View file

@ -3700,7 +3700,9 @@ api_register_func('api/direct_messages/destroy', 'api_direct_messages_destroy',
function api_direct_messages_box($type, $box, $verbose) function api_direct_messages_box($type, $box, $verbose)
{ {
$a = get_app(); $a = get_app();
if (api_user() === false) {
throw new ForbiddenException();
}
// params // params
$count = (x($_GET, 'count') ? $_GET['count'] : 20); $count = (x($_GET, 'count') ? $_GET['count'] : 20);
$page = (x($_REQUEST, 'page') ? $_REQUEST['page'] -1 : 0); $page = (x($_REQUEST, 'page') ? $_REQUEST['page'] -1 : 0);
@ -3722,7 +3724,7 @@ function api_direct_messages_box($type, $box, $verbose)
unset($_GET["screen_name"]); unset($_GET["screen_name"]);
$user_info = api_get_user($a); $user_info = api_get_user($a);
if (api_user() === false || $user_info === false) { if ($user_info === false) {
throw new ForbiddenException(); throw new ForbiddenException();
} }
$profile_url = $user_info["url"]; $profile_url = $user_info["url"];