Merge branch '3.2' into 'main'

Author: thorsten

phpmyfaq/admin/assets/src/dashboard.js

@@ -214,16 +214,25 @@ export const getLatestVersion = () => {
         if (response.ok) {
           const version = await response.json();
           loader.classList.add('d-none');
-          versionText.insertAdjacentElement(
-            'afterend',
-            addElement('div', {
-              classList: 'alert alert-success',
-              innerText: version.success,
-            })
-          );
-        } else {
-          throw new Error('Network response was not ok: ', { cause: { response } });
+          if (version.success) {
+            versionText.insertAdjacentElement(
+              'afterend',
+              addElement('div', {
+                classList: 'alert alert-success',
+                innerText: version.success,
+              })
+            );
+          } else {
+            versionText.insertAdjacentElement(
+              'afterend',
+              addElement('div', {
+                classList: 'alert alert-info',
+                innerText: version.info,
+              })
+            );
+          }
         }
+        throw new Error('Network response was not ok: ', { cause: { response } });
       })
       .catch(async (error) => {
         const errorMessage = await error.cause.response;

phpmyfaq/api.service.php

@@ -981,6 +981,7 @@
             break;
         }
 
+        $userId = Filter::filterVar($postData['userId'], FILTER_VALIDATE_INT);
         $author = trim((string) Filter::filterVar($postData['name'], FILTER_SANITIZE_SPECIAL_CHARS));
         $loginName = trim((string) Filter::filterVar($postData['loginname'], FILTER_SANITIZE_SPECIAL_CHARS));
         $email = trim((string) Filter::filterVar($postData['email'], FILTER_VALIDATE_EMAIL));
@@ -991,6 +992,19 @@
             $email = $faqConfig->getAdminEmail();
         }
 
+        // Validate User ID, Username and email
+        $user = new User($faqConfig);
+        if (
+            !$user->getUserById($userId) ||
+            $userId !== $user->getUserId() ||
+            $loginName !== $user->getLogin() ||
+            $email !== $user->getUserData('email')
+        ) {
+            $response->setStatusCode(Response::HTTP_BAD_REQUEST);
+            $response->setData(['error' => Translation::get('ad_user_error_loginInvalid')]);
+            break;
+        }
+
         if (!empty($author) && !empty($email) && !empty($question) && $stopWords->checkBannedWord($question)) {
             $question = sprintf(
                 "%s %s\n%s %s\n%s %s\n\n %s",

phpmyfaq/assets/themes/default/templates/request-removal.html

@@ -18,7 +18,8 @@ <h1>{{ pageHeader }}</h1>
   </div>
 
   <form id="formValues" action="#" method="post" class="needs-validation" novalidate>
-    <input type="hidden" name="lang" id="lang" value="{{ lang }}" />
+    <input type="hidden" name="lang" id="lang" value="{{ lang }}">
+    <input type="hidden" name="userId" id="userId" value="{{ userId }}">
     {{ csrf }}
 
     <div class="row mb-2">

phpmyfaq/request-removal.php

@@ -47,6 +47,7 @@
         'ad_user_loginname' => Translation::get('ad_user_loginname'),
         'csrf' => Token::getInstance()->getTokenInput('request-removal'),
         'lang' => $Language->getLanguage(),
+        'userId' => $user->getUserId(),
         'defaultContentMail' => ($user->getUserId() > 0) ? $user->getUserData('email') : '',
         'defaultContentName' =>
             ($user->getUserId() > 0) ? Strings::htmlentities($user->getUserData('display_name')) : '',