CVE-2023-4304: Insufficient Information (NVD-CWE-noinfo)
value: Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.


CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 2.7
Published: 2023-08-11T01:15Z
Repository: https://github.com/froxlor/froxlor
Language: PHP
Files changed: lib/Froxlor/Api/ApiParameter.php, lib/Froxlor/Api/Commands/Admins.php, lib/Froxlor/Validate/Validate.php
Commit date: 2023-07-16 16:44:46 +0200
Commit message: validate non-empy admin-name in Admins.update()

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

Diff: diff --git a/lib/Froxlor/Api/ApiParameter.php b/lib/Froxlor/Api/ApiParameter.php
index 6fbb1643d7..fdefb54981 100644
--- a/lib/Froxlor/Api/ApiParameter.php
+++ b/lib/Froxlor/Api/ApiParameter.php
@@ -37,16 +37,16 @@ abstract class ApiParameter
 	 */
 	private $cmd_params = null;
 
 	/**
 	 *
-	 * @param array $params
+	 * @param array|null $params
 	 *            optional, array of parameters (var=>value) for the command
 	 *
 	 * @throws Exception
 	 */
-	public function __construct($params = null)
+	public function __construct(array $params = null)
 	{
 		if (!is_null($params)) {
 			$params = $this->trimArray($params);
 		}
 		$this->cmd_params = $params;
@@ -55,11 +55,11 @@ abstract class ApiParameter
 	/**
 	 * run 'trim' function on an array recursively
 	 *
 	 * @param array $input
 	 *
-	 * @return array
+	 * @return string|array
 	 */
 	private function trimArray($input)
 	{
 		if ($input === '') {
 			return "";
@@ -77,48 +77,48 @@ abstract class ApiParameter
 	}
 
 	/**
 	 * get specific parameter which also has and unlimited-field
 	 *
-	 * @param string $param
+	 * @param string|null $param
 	 *            parameter to get out of the request-parameter list
-	 * @param string $ul_field
+	 * @param string|null $ul_field
 	 *            parameter to get out of the request-parameter list
 	 * @param bool $optional
 	 *            default: false
 	 * @param mixed $default
 	 *            value which is returned if optional=true and param is not set
 	 *
 	 * @return mixed
 	 * @throws Exception
 	 */
-	protected function getUlParam($param = null, $ul_field = null, $optional = false, $default = 0)
+	protected function getUlParam(string $param = null, string $ul_field = null, bool $optional = false, $default = 0)
 	{
 		$param_value = (int)$this->getParam($param, $optional, $default);
 		$ul_field_value = $this->getBoolParam($ul_field, true, 0);
 		if ($ul_field_value != '0') {
 			$param_value = -1;
 		}
 		return $param_value;
 	}
 
 	/**
-	 * get specific parameter from the parameterlist;
+	 * get specific parameter from the parameter list;
 	 * check for existence and != empty if needed.
 	 * Maybe more in the future
 	 *
-	 * @param string $param
+	 * @param string|null $param
 	 *            parameter to get out of the request-parameter list
 	 * @param bool $optional
 	 *            default: false
 	 * @param mixed $default
 	 *            value which is returned if optional=true and param is not set
 	 *
 	 * @return mixed
 	 * @throws Exception
 	 */
-	protected function getParam($param = null, $optional = false, $default = '')
+	protected function getParam(string $param = null, bool $optional = false, $default = '')
 	{
 		// does it exist?
 		if (!isset($this->cmd_params[$param])) {
 			if ($optional === false) {
 				// get module + function for better error-messages
@@ -126,11 +126,11 @@ abstract class ApiParameter
 				throw new Exception('Requested parameter "' . $param . '" could not be found for "' . $inmod . '"', 404);
 			}
 			return $default;
 		}
 		// is it empty? - test really on string, as value 0 is being seen as empty by php
-		if ($this->cmd_params[$param] === "") {
+		if (!is_array($this->cmd_params[$param]) && trim($this->cmd_params[$param]) === "") {
 			if ($optional === false) {
 				// get module + function for better error-messages
 				$inmod = $this->getModFunctionString();
 				throw new Exception('Requested parameter "' . $param . '" is empty where it should not be for "' . $inmod . '"', 406);
 			}
@@ -140,21 +140,21 @@ abstract class ApiParameter
 		return $this->cmd_params[$param];
 	}
 
 	/**
 	 * returns "module::function()" for better error-messages (missing parameter etc.)
-	 * makes debugging a whole lot more comfortable
+	 * makes debugging a lot more comfortable
 	 *
 	 * @param int $level
 	 *            depth of backtrace, default 2
 	 *
 	 * @param int $max_level
 	 * @param array|null $trace
 	 *
 	 * @return string
 	 */
-	private function getModFunctionString($level = 1, $max_level = 5, $trace = null)
+	private function getModFunctionString(int $level = 1, int $max_level = 5, $trace = null)
 	{
 		// which class called us
 		$_class = get_called_class();
 		if (empty($trace)) {
 			// get backtrace
@@ -172,20 +172,20 @@ abstract class ApiParameter
 	}
 
 	/**
 	 * getParam wrapper for boolean parameter
 	 *
-	 * @param string $param
+	 * @param string|null $param
 	 *            parameter to get out of the request-parameter list
 	 * @param bool $optional
 	 *            default: false
 	 * @param mixed $default
 	 *            value which is returned if optional=true and param is not set
 	 *
 	 * @return string
 	 */
-	protected function getBoolParam($param = null, $optional = false, $default = false)
+	protected function getBoolParam(string $param = null, bool $optional = false, $default = false)
 	{
 		$_default = '0';
 		if ($default) {
 			$_default = '1';
 		}
diff --git a/lib/Froxlor/Api/Commands/Admins.php b/lib/Froxlor/Api/Commands/Admins.php
index 10175ddfd8..8f919a9cf8 100644
--- a/lib/Froxlor/Api/Commands/Admins.php
+++ b/lib/Froxlor/Api/Commands/Admins.php
@@ -582,10 +582,22 @@ class Admins extends ApiCommand implements ResourceEntity
 
 				if (empty($theme)) {
 					$theme = Settings::Get('panel.default_theme');
 				}
 
+				if (empty(trim($name))) {
+					Response::standardError([
+						'stringisempty',
+						'admin.name'
+					], '', true);
+				}
+				if (empty(trim($email))) {
+					Response::standardError([
+						'stringisempty',
+						'admin.email'
+					], '', true);
+				}
 				if (!Validate::validateEmail($email)) {
 					Response::standardError('emailiswrong', $email, true);
 				} else {
 					if ($deactivated != '1') {
 						$deactivated = '0';
diff --git a/lib/Froxlor/Validate/Validate.php b/lib/Froxlor/Validate/Validate.php
index ae57e5ab6f..794d217a5c 100644
--- a/lib/Froxlor/Validate/Validate.php
+++ b/lib/Froxlor/Validate/Validate.php
@@ -258,11 +258,11 @@ class Validate
 		}
 		return false;
 	}
 
 	/**
-	 * Returns if an emailaddress is in correct format or not
+	 * Returns if an email-address is in correct format or not
 	 *
 	 * @param string $email The email address to check
 	 *
 	 * @return mixed
 	 */

Vulnerable code: 	 * @param array $params
	public function __construct($params = null)
	 * @return array
	 * @param string $param
	 * @param string $ul_field
	protected function getUlParam($param = null, $ul_field = null, $optional = false, $default = 0)
	 * get specific parameter from the parameterlist;
	 * @param string $param
	protected function getParam($param = null, $optional = false, $default = '')
		if ($this->cmd_params[$param] === "") {
	 * makes debugging a whole lot more comfortable
	private function getModFunctionString($level = 1, $max_level = 5, $trace = null)
	 * @param string $param
	protected function getBoolParam($param = null, $optional = false, $default = false)
	 * Returns if an emailaddress is in correct format or not
Fixed code: 	 * @param array|null $params
	public function __construct(array $params = null)
	 * @return string|array
	 * @param string|null $param
	 * @param string|null $ul_field
	protected function getUlParam(string $param = null, string $ul_field = null, bool $optional = false, $default = 0)
	 * get specific parameter from the parameter list;
	 * @param string|null $param
	protected function getParam(string $param = null, bool $optional = false, $default = '')
		if (!is_array($this->cmd_params[$param]) && trim($this->cmd_params[$param]) === "") {
	 * makes debugging a lot more comfortable
	private function getModFunctionString(int $level = 1, int $max_level = 5, $trace = null)
	 * @param string|null $param
	protected function getBoolParam(string $param = null, bool $optional = false, $default = false)
				if (empty(trim($name))) {
					Response::standardError([
						'stringisempty',
						'admin.name'
					], '', true);
				}
				if (empty(trim($email))) {
					Response::standardError([
						'stringisempty',
						'admin.email'
					], '', true);
				}
	 * Returns if an email-address is in correct format or not