mirror/php-auth
1
0
Fork 0
mirror of https://github.com/delight-im/PHP-Auth.git synced 2025-10-22 19:36:32 +02:00
Code Issues Releases Wiki Activity

Fail safely in role checks when invalid input has been supplied

Browse Source
This commit is contained in:
Marco
2018-05-25 23:19:07 +02:00
parent 7a8508d56e
commit 9d08c939a0
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/Auth.php
View File

@@ -1563,9 +1563,13 @@ final class Auth extends UserManager {
* @see Role
*/
public function hasRole($role) {
$role = (int) $role;
if (empty($role) || !\is_numeric($role)) {
return false;
}
if (isset($_SESSION) && isset($_SESSION[self::SESSION_FIELD_ROLES])) {
$role = (int) $role;
return (((int) $_SESSION[self::SESSION_FIELD_ROLES]) & $role) === $role;
}
else {