CVE-2023-1883: Improper Access Control (CWE-284)
value: Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 5.4
Published: 2023-04-05T17:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/ajaxservice.php, phpmyfaq/src/phpMyFAQ/Faq.php
Commit date: 2023-02-14 19:14:05 +0100
Commit message: fix: added check if news or FAQs are active

Diff: diff --git a/phpmyfaq/ajaxservice.php b/phpmyfaq/ajaxservice.php
index 74fd48d1ca..427f87a12e 100644
--- a/phpmyfaq/ajaxservice.php
+++ b/phpmyfaq/ajaxservice.php
@@ -183,17 +183,12 @@ switch ($action) {
                 break;
             }
         }
 
         if (
-            !is_null($username) && !is_null($mailer) && !is_null($comment) && $stopWords->checkBannedWord(
-                $comment
-            ) && !$faq->commentDisabled(
-                $id,
-                $languageCode,
-                $type
-            )
+            !is_null($username) && !is_null($mailer) && !is_null($comment) && $stopWords->checkBannedWord($comment) &&
+            !$faq->commentDisabled($id, $languageCode, $type) && !$faq->isActive($id, $languageCode, $type)
         ) {
             try {
                 $faqSession->userTracking('save_comment', $id);
             } catch (Exception $e) {
                 // @todo handle the exception
diff --git a/phpmyfaq/src/phpMyFAQ/Faq.php b/phpmyfaq/src/phpMyFAQ/Faq.php
index 834a6168db..b66e2507c7 100755
--- a/phpmyfaq/src/phpMyFAQ/Faq.php
+++ b/phpmyfaq/src/phpMyFAQ/Faq.php
@@ -1256,21 +1256,54 @@ class Faq
         }
 
         return false;
     }
 
+    public function isActive(int $recordId, string $recordLang, string $commentType = 'faq'): bool
+    {
+        if ('news' === $commentType) {
+            $table = 'faqnews';
+        } else {
+            $table = 'faqdata';
+        }
+
+        $query = sprintf(
+            "
+            SELECT
+                active
+            FROM
+                %s%s
+            WHERE
+                id = %d
+            AND
+                lang = '%s'",
+            Database::getTablePrefix(),
+            $table,
+            $recordId,
+            $this->config->getDb()->escape($recordLang)
+        );
+
+        $result = $this->config->getDb()->query($query);
+
+        if ($row = $this->config->getDb()->fetchObject($result)) {
+            return !(($row->active === 'y' || $row->active === 'yes'));
+        } else {
+            return true;
+        }
+    }
+
     /**
      * Checks, if comments are disabled for the FAQ record.
      *
      * @param int    $recordId    Id of FAQ or news entry
      * @param string $recordLang  Language
      * @param string $commentType Type of comment: faq or news
      * @return bool true, if comments are disabled
      */
     public function commentDisabled(int $recordId, string $recordLang, string $commentType = 'faq'): bool
     {
-        if ('news' == $commentType) {
+        if ('news' === $commentType) {
             $table = 'faqnews';
         } else {
             $table = 'faqdata';
         }
 

Vulnerable code:             !is_null($username) && !is_null($mailer) && !is_null($comment) && $stopWords->checkBannedWord(
                $comment
            ) && !$faq->commentDisabled(
                $id,
                $languageCode,
                $type
            )
        if ('news' == $commentType) {
Fixed code:             !is_null($username) && !is_null($mailer) && !is_null($comment) && $stopWords->checkBannedWord($comment) &&
            !$faq->commentDisabled($id, $languageCode, $type) && !$faq->isActive($id, $languageCode, $type)
    public function isActive(int $recordId, string $recordLang, string $commentType = 'faq'): bool
    {
        if ('news' === $commentType) {
            $table = 'faqnews';
        } else {
            $table = 'faqdata';
        }

        $query = sprintf(
            "
            SELECT
                active
            FROM
                %s%s
            WHERE
                id = %d
            AND
                lang = '%s'",
            Database::getTablePrefix(),
            $table,
            $recordId,
            $this->config->getDb()->escape($recordLang)
        );

        $result = $this->config->getDb()->query($query);

        if ($row = $this->config->getDb()->fetchObject($result)) {
            return !(($row->active === 'y' || $row->active === 'yes'));
        } else {
            return true;
        }
    }

        if ('news' === $commentType) {