CVE-2023-5976: Improper Access Control (CWE-284)
value: Improper Access Control in GitHub repository microweber/microweber prior to 2.0.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 4.3
Published: 2023-11-07T04:24Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Content/Models/Content.php, userfiles/modules/comments/src/Http/Livewire/UserCommentReplyComponent.php
Commit date: 2023-06-07 16:54:32 +0300
Commit message: update

Diff: diff --git a/src/MicroweberPackages/Content/Models/Content.php b/src/MicroweberPackages/Content/Models/Content.php
index c19a33475d7..af0c054b495 100644
--- a/src/MicroweberPackages/Content/Models/Content.php
+++ b/src/MicroweberPackages/Content/Models/Content.php
@@ -111,11 +111,17 @@ class Content extends Model
         "created_at",
     ];
 
     public function scopeActive($query)
     {
-        return $query->where('is_active', 1)->where('is_deleted', 0);
+        return $query
+            ->where('is_active', 1)
+            ->where(function($subQuery) {
+                $subQuery
+                    ->whereNull('is_deleted')
+                    ->orWhere('is_deleted', 0);
+            });
     }
 
     public function related()
     {
         return $this->hasMany(ContentRelated::class,'content_id','id')->orderBy('position', 'ASC');
diff --git a/userfiles/modules/comments/src/Http/Livewire/UserCommentReplyComponent.php b/userfiles/modules/comments/src/Http/Livewire/UserCommentReplyComponent.php
index ca9f0e2c2f4..5f7b300fcee 100644
--- a/userfiles/modules/comments/src/Http/Livewire/UserCommentReplyComponent.php
+++ b/userfiles/modules/comments/src/Http/Livewire/UserCommentReplyComponent.php
@@ -1,10 +1,11 @@
 <?php
 
 namespace MicroweberPackages\Modules\Comments\Http\LiveWire;
 
 use Livewire\Component;
+use MicroweberPackages\Content\Models\Content;
 
 class UserCommentReplyComponent extends Component
 {
     public $state = [
         'comment_name' => '',
@@ -24,26 +25,30 @@ class UserCommentReplyComponent extends Component
     }
 
     public function save()
     {
         $validate = [
+            'state.rel_id' => 'required|min:1',
             'state.comment_body' => 'required|min:3',
         ];
         if (!user_id()) {
             $validate['state.comment_name'] = 'required|min:3';
             $validate['state.comment_email'] = 'required|email';
         }
 
         $this->validate($validate);
 
-        $comment = new \MicroweberPackages\Comment\Models\Comment();
-
-        if (isset($this->state['rel_id'])) {
-            $comment->rel_id = $this->state['rel_id'];
-            $comment->rel_type = 'content';
+        $countContent = Content::where('id', $this->state['rel_id'])->whereActive()->count();
+        if ($countContent == 0) {
+            $this->addError('state.rel_id', 'Content not found');
+            return;
         }
 
+        $comment = new \MicroweberPackages\Comment\Models\Comment();
+        $comment->rel_id = $this->state['rel_id'];
+        $comment->rel_type = 'content';
+
         if (isset($this->state['reply_to_comment_id'])) {
             $comment->reply_to_comment_id = $this->state['reply_to_comment_id'];
         }
 
         $comment->user_ip = user_ip();

Vulnerable code:         return $query->where('is_active', 1)->where('is_deleted', 0);
        $comment = new \MicroweberPackages\Comment\Models\Comment();

        if (isset($this->state['rel_id'])) {
            $comment->rel_id = $this->state['rel_id'];
            $comment->rel_type = 'content';
Fixed code:         return $query
            ->where('is_active', 1)
            ->where(function($subQuery) {
                $subQuery
                    ->whereNull('is_deleted')
                    ->orWhere('is_deleted', 0);
            });
use MicroweberPackages\Content\Models\Content;
            'state.rel_id' => 'required|min:1',
        $countContent = Content::where('id', $this->state['rel_id'])->whereActive()->count();
        if ($countContent == 0) {
            $this->addError('state.rel_id', 'Content not found');
            return;
        $comment = new \MicroweberPackages\Comment\Models\Comment();
        $comment->rel_id = $this->state['rel_id'];
        $comment->rel_type = 'content';