CVE-2022-1176: Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
value: Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96.
CWE description: The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CVSS v3 base score: 7.5
Published: 2022-03-31T10:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/modules/lhwidgetrestapi/addmsguser.php, lhc_web/modules/lhwidgetrestapi/fetchmessage.php, lhc_web/modules/lhwidgetrestapi/fetchmessages.php, lhc_web/modules/lhwidgetrestapi/getmessagesnippet.php, lhc_web/modules/lhwidgetrestapi/initchat.php, lhc_web/modules/lhwidgetrestapi/sendmailsettings.php, lhc_web/modules/lhwidgetrestapi/uisettings.php
Commit date: 2022-03-30 06:24:11 -0400
Commit message: Type check

Diff: diff --git a/lhc_web/modules/lhwidgetrestapi/addmsguser.php b/lhc_web/modules/lhwidgetrestapi/addmsguser.php
index f7e71148412..73f5bdeb376 100644
--- a/lhc_web/modules/lhwidgetrestapi/addmsguser.php
+++ b/lhc_web/modules/lhwidgetrestapi/addmsguser.php
@@ -27,11 +27,11 @@ if (isset($payload['msg']) && trim($payload['msg']) != '' && trim(str_replace('[
             erLhcoreClassModelChat::STATUS_BOT_CHAT,
         );
 
         erLhcoreClassChatEventDispatcher::getInstance()->dispatch('chat.validstatus_chat',array('chat' => & $chat, 'valid_statuses' => & $validStatuses));
 
-        if ($chat->hash == $payload['hash'] && (in_array($chat->status,$validStatuses)) && !in_array($chat->status_sub, array(erLhcoreClassModelChat::STATUS_SUB_SURVEY_COMPLETED, erLhcoreClassModelChat::STATUS_SUB_USER_CLOSED_CHAT, erLhcoreClassModelChat::STATUS_SUB_SURVEY_SHOW, erLhcoreClassModelChat::STATUS_SUB_CONTACT_FORM))) // Allow add messages only if chat is active
+        if ($chat->hash === $payload['hash'] && (in_array($chat->status,$validStatuses)) && !in_array($chat->status_sub, array(erLhcoreClassModelChat::STATUS_SUB_SURVEY_COMPLETED, erLhcoreClassModelChat::STATUS_SUB_USER_CLOSED_CHAT, erLhcoreClassModelChat::STATUS_SUB_SURVEY_SHOW, erLhcoreClassModelChat::STATUS_SUB_CONTACT_FORM))) // Allow add messages only if chat is active
         {
             $msgText = preg_replace('/\[html\](.*?)\[\/html\]/ms','',$payload['msg']);
 
             $messagesToStore = explode('[[msgitm]]', trim($msgText));
 
diff --git a/lhc_web/modules/lhwidgetrestapi/fetchmessage.php b/lhc_web/modules/lhwidgetrestapi/fetchmessage.php
index 0d32f2714e8..9d6b9b03850 100644
--- a/lhc_web/modules/lhwidgetrestapi/fetchmessage.php
+++ b/lhc_web/modules/lhwidgetrestapi/fetchmessage.php
@@ -14,11 +14,11 @@ try {
         throw new Exception('Chat ID or message ID not provided!');
     }
 
     $chat = erLhcoreClassModelChat::fetch($requestPayload['id']);
 
-    if ($chat instanceof erLhcoreClassModelChat && $chat->hash == $requestPayload['hash'])
+    if ($chat instanceof erLhcoreClassModelChat && $chat->hash === $requestPayload['hash'])
     {
         $msg = erLhcoreClassModelmsg::fetch($requestPayload['msg_id']);
 
         if ($msg instanceof erLhcoreClassModelmsg && $msg->chat_id == $chat->id) {
 
diff --git a/lhc_web/modules/lhwidgetrestapi/fetchmessages.php b/lhc_web/modules/lhwidgetrestapi/fetchmessages.php
index 2e85d55ff6f..0c1b2bb4e34 100644
--- a/lhc_web/modules/lhwidgetrestapi/fetchmessages.php
+++ b/lhc_web/modules/lhwidgetrestapi/fetchmessages.php
@@ -32,11 +32,11 @@ $operatorId = 0;
 $visitorTotalMessages = 0;
 $operatorTotalMessages = 0;
 
 $responseArray = array('status' => erLhcoreClassModelChat::STATUS_CLOSED_CHAT, 'status_sub' => erLhcoreClassModelChat::STATUS_SUB_DEFAULT);
 
-if (is_object($chat) && $chat->hash == $requestPayload['hash'])
+if (is_object($chat) && $chat->hash === $requestPayload['hash'])
 {
     erLhcoreClassChat::setTimeZoneByChat($chat);
     $chat->updateIgnoreColumns = array('last_msg_id');
 
     $responseArray['status_sub'] = $chat->status_sub;
diff --git a/lhc_web/modules/lhwidgetrestapi/getmessagesnippet.php b/lhc_web/modules/lhwidgetrestapi/getmessagesnippet.php
index 24a419ad431..6a439c71ab2 100644
--- a/lhc_web/modules/lhwidgetrestapi/getmessagesnippet.php
+++ b/lhc_web/modules/lhwidgetrestapi/getmessagesnippet.php
@@ -14,11 +14,11 @@ try {
         throw new Exception('Chat ID or message ID not provided!');
     }
 
     $chat = erLhcoreClassModelChat::fetch($requestPayload['id']);
 
-    if ($chat instanceof erLhcoreClassModelChat && $chat->hash == $requestPayload['hash'])
+    if ($chat instanceof erLhcoreClassModelChat && $chat->hash === $requestPayload['hash'])
     {
 
         $msg = erLhcoreClassModelmsg::findOne(array('limit' => 1, 'sort' => 'id DESC', 'filtergt' => array('user_id' => 0), 'filter' => array('chat_id' => $chat->id)));
 
         if ($msg instanceof erLhcoreClassModelmsg && $msg->chat_id == $chat->id) {
diff --git a/lhc_web/modules/lhwidgetrestapi/initchat.php b/lhc_web/modules/lhwidgetrestapi/initchat.php
index 8b97919a0b5..0ad557dda6f 100644
--- a/lhc_web/modules/lhwidgetrestapi/initchat.php
+++ b/lhc_web/modules/lhwidgetrestapi/initchat.php
@@ -27,11 +27,11 @@ try {
         exit;
     }
 
     erLhcoreClassChat::setTimeZoneByChat($chat);
 
-    if ($chat->hash == $requestPayload['hash'])
+    if ($chat->hash === $requestPayload['hash'])
     {
         // User online
         if ($chat->user_status != 0) {
             $chat->support_informed = 1;
             $chat->user_typing = time();// Show for shorter period these status messages
diff --git a/lhc_web/modules/lhwidgetrestapi/sendmailsettings.php b/lhc_web/modules/lhwidgetrestapi/sendmailsettings.php
index d1fc435b9c4..6b224bab61a 100644
--- a/lhc_web/modules/lhwidgetrestapi/sendmailsettings.php
+++ b/lhc_web/modules/lhwidgetrestapi/sendmailsettings.php
@@ -4,11 +4,11 @@ erLhcoreClassRestAPIHandler::setHeaders();
 
 $db = ezcDbInstance::get();
 
 $chat = erLhcoreClassModelChat::fetch($Params['user_parameters']['chat_id']);
 
-if ($chat instanceof erLhcoreClassModelChat && $chat->hash == $Params['user_parameters']['hash'])
+if ($chat instanceof erLhcoreClassModelChat && $chat->hash === $Params['user_parameters']['hash'])
 {
     if ($Params['user_parameters_unordered']['action'] == 'send') {
 
         if ((int)erLhcoreClassModelChatConfig::fetch('disable_send')->current_value == 0 && ($chat->status == erLhcoreClassModelChat::STATUS_BOT_CHAT || $chat->status == erLhcoreClassModelChat::STATUS_ACTIVE_CHAT || $chat->status == erLhcoreClassModelChat::STATUS_PENDING_CHAT || erLhcoreClassChat::canReopen($chat,true)))
         {
diff --git a/lhc_web/modules/lhwidgetrestapi/uisettings.php b/lhc_web/modules/lhwidgetrestapi/uisettings.php
index 7c2ab393a73..ecd763b95a2 100644
--- a/lhc_web/modules/lhwidgetrestapi/uisettings.php
+++ b/lhc_web/modules/lhwidgetrestapi/uisettings.php
@@ -14,11 +14,11 @@ try {
 
     $chat = erLhcoreClassModelChat::fetchAndLock($requestPayload['id']);
 
     erLhcoreClassChat::setTimeZoneByChat($chat);
 
-    if ($chat->hash == $requestPayload['hash'])
+    if ($chat->hash === $requestPayload['hash'])
     {
         $outputResponse = array(
             'operator' => 'operator',
             'chat_ui' => array(),
             'chat_ui_remove' => array(),

Vulnerable code:         if ($chat->hash == $payload['hash'] && (in_array($chat->status,$validStatuses)) && !in_array($chat->status_sub, array(erLhcoreClassModelChat::STATUS_SUB_SURVEY_COMPLETED, erLhcoreClassModelChat::STATUS_SUB_USER_CLOSED_CHAT, erLhcoreClassModelChat::STATUS_SUB_SURVEY_SHOW, erLhcoreClassModelChat::STATUS_SUB_CONTACT_FORM))) // Allow add messages only if chat is active
    if ($chat instanceof erLhcoreClassModelChat && $chat->hash == $requestPayload['hash'])
if (is_object($chat) && $chat->hash == $requestPayload['hash'])
    if ($chat instanceof erLhcoreClassModelChat && $chat->hash == $requestPayload['hash'])
    if ($chat->hash == $requestPayload['hash'])
if ($chat instanceof erLhcoreClassModelChat && $chat->hash == $Params['user_parameters']['hash'])
    if ($chat->hash == $requestPayload['hash'])
Fixed code:         if ($chat->hash === $payload['hash'] && (in_array($chat->status,$validStatuses)) && !in_array($chat->status_sub, array(erLhcoreClassModelChat::STATUS_SUB_SURVEY_COMPLETED, erLhcoreClassModelChat::STATUS_SUB_USER_CLOSED_CHAT, erLhcoreClassModelChat::STATUS_SUB_SURVEY_SHOW, erLhcoreClassModelChat::STATUS_SUB_CONTACT_FORM))) // Allow add messages only if chat is active
    if ($chat instanceof erLhcoreClassModelChat && $chat->hash === $requestPayload['hash'])
if (is_object($chat) && $chat->hash === $requestPayload['hash'])
    if ($chat instanceof erLhcoreClassModelChat && $chat->hash === $requestPayload['hash'])
    if ($chat->hash === $requestPayload['hash'])
if ($chat instanceof erLhcoreClassModelChat && $chat->hash === $Params['user_parameters']['hash'])
    if ($chat->hash === $requestPayload['hash'])