hitoshura25/cvefixes huggingface dataset:
CVE-2017-14619 (PHP, published 2017-09-20T21:29Z)
Description: value: Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" field in the Configuration Module.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/admin/configuration.php
phpmyfaq/inc/PMF/Faq.php
phpmyfaq/index.php
phpmyfaq/main.php
Commit message: Added some more protection against possible XSS attacks


Vulnerable code:
        $escapeValues = ['main.contactInformations', 'main.customPdfHeader', 'main.customPdfFooter'];
                $newConfigValues[$key] = PMF_String::htmlspecialchars($value, ENT_HTML5);
                $question = $row->question;
    'title' => $faqConfig->get('main.titleFAQ').$title,
    'header' => str_replace('"', '', $faqConfig->get('main.titleFAQ')),
    'metaTitle' => str_replace('"', '', $faqConfig->get('main.titleFAQ').$title),
        'breadcrumbHeadline' => $faqConfig->get('main.titleFAQ')

Fixed code:
        $escapeValues = [
            'main.contactInformations',
            'main.customPdfHeader',
            'main.customPdfFooter',
            'main.titleFAQ'
        ];
                $newConfigValues[$key] = PMF_String::htmlspecialchars($value, ENT_QUOTES);
                $question = PMF_String::htmlspecialchars($row->question);
    'title' => PMF_String::htmlspecialchars($faqConfig->get('main.titleFAQ').$title),
    'header' => PMF_String::htmlspecialchars(str_replace('"', '', $faqConfig->get('main.titleFAQ'))),
    'metaTitle' => PMF_String::htmlspecialchars(str_replace('"', '', $faqConfig->get('main.titleFAQ').$title)),
        'breadcrumbHeadline' => PMF_String::htmlspecialchars($faqConfig->get('main.titleFAQ'))
CVE-2017-15727 (PHP, published 2017-10-22T18:29Z)
Description: value: In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/admin/attachment.php
Commit message: Prevent users to upload HTML files as attachments


Vulnerable code:
    if (is_uploaded_file($_FILES['userfile']['tmp_name']) && !($_FILES['userfile']['size'] > $faqConfig->get('records.maxAttachmentSize'))) {

Fixed code:
    if (
        is_uploaded_file($_FILES['userfile']['tmp_name']) &&
        !($_FILES['userfile']['size'] > $faqConfig->get('records.maxAttachmentSize')) &&
        $_FILES['userfile']['type'] !== "text/html"
    ) {
CVE-2017-15728 (PHP, published 2017-10-22T18:29Z)
Description: value: In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via metaDescription or metaKeywords.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/admin/configuration.php
phpmyfaq/index.php
Commit message: Fixed possible admin XSS attack vector


Vulnerable code:
            'main.titleFAQ'
    'metaDescription' => $metaDescription,
    'metaKeywords' => $keywords,

Fixed code:
            'main.titleFAQ',
            'main.metaKeywords'
    'metaDescription' => PMF_String::htmlspecialchars($metaDescription),
    'metaKeywords' => PMF_String::htmlspecialchars($keywords),
CVE-2017-15729 (PHP, published 2017-10-22T18:29Z)
Description: value: In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for adding a glossary.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/admin/glossary.add.php
phpmyfaq/admin/glossary.edit.php
phpmyfaq/admin/glossary.main.php
Commit message: Added missing CSRF protection


Vulnerable code:
 *
 *
    if ('saveglossary' == $action && $user->perm->checkRight($user->getUserId(), 'addglossary')) {
    if ('updateglossary' == $action && $user->perm->checkRight($user->getUserId(), 'editglossary')) {
    if ('deleteglossary' == $action && $user->perm->checkRight($user->getUserId(), 'editglossary')) {
            '<td><a class="btn btn-danger" onclick="return confirm(\'%s\'); return false;" href="%s%d">',
            $items['id']

Fixed code:
                    <input type="hidden" name="csrf" value="<?php echo $user->getCsrfTokenFromSession() ?>">

                    <input type="hidden" name="csrf" value="<?php echo $user->getCsrfTokenFromSession() ?>">

$csrfTokenFromPost = PMF_Filter::filterInput(INPUT_POST, 'csrf', FILTER_SANITIZE_STRING);
$csrfTokenFromGet = PMF_Filter::filterInput(INPUT_GET, 'csrf', FILTER_SANITIZE_STRING);
if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfTokenFromPost) {
    $csrfCheck = false;
} else {
    $csrfCheck = true;
}
if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfTokenFromGet) {
    $csrfCheckDelete = false;
} else {
    $csrfCheckDelete = true;
}

    if ('saveglossary' == $action && $user->perm->checkRight($user->getUserId(), 'addglossary') && $csrfCheck) {
    if ('updateglossary' == $action && $user->perm->checkRight($user->getUserId(), 'editglossary') && $csrfCheck) {
    if ('deleteglossary' == $action && $user->perm->checkRight($user->getUserId(), 'editglossary') && $csrfCheckDelete) {
            '<td><a class="btn btn-danger" onclick="return confirm(\'%s\'); return false;" href="%s%d%s%s">',
            $items['id'],
            '&csrf=',
            $user->getCsrfTokenFromSession()
CVE-2017-15730 (PHP, published 2017-10-22T18:29Z)
Description: value: In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/admin/stat.ratings.php
Commit message: Fixed possible direct calls


Vulnerable code:
                        <a class="btn btn-danger" href="?action=clear-statistics">
    if ('clear-statistics' === $action) {

Fixed code:
                        <a class="btn btn-danger" 
                           href="?action=clear-statistics&csrf=<?php echo $user->getCsrfTokenFromSession() ?>">
    $csrfToken = PMF_Filter::filterInput(INPUT_GET, 'csrf', FILTER_SANITIZE_STRING);

    if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfToken) {
        $clearStatistics = false;
    } else {
        $clearStatistics = true;
    }

    if ('clear-statistics' === $action && $clearStatistics) {
CVE-2017-15731 (PHP, published 2017-10-22T18:29Z)
Description: value: In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.adminlog.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/admin/stat.adminlog.php
Commit message: Added missing CSRF protection


Vulnerable code:
                    <a class="btn btn-danger" href="?action=deleteadminlog">
        $text = str_replace('Loginerror', $PMF_LANG['ad_log_lger'], $text);
        $text = str_replace('Session expired', $PMF_LANG['ad_log_sess'], $text);
        $text = str_replace('Useredit, ', $PMF_LANG['ad_log_edit'], $text);
        $text = str_replace('Beitragcreatesave', $PMF_LANG['ad_log_crsa'], $text);
        $text = str_replace('Beitragcreate', $PMF_LANG['ad_log_crea'], $text);
        $text = str_replace('Usersave, ', $PMF_LANG['ad_log_ussa'], $text);
        $text = str_replace('Userdel, ', $PMF_LANG['ad_log_usde'], $text);
        $text = str_replace('Beitragedit, ', $PMF_LANG['ad_log_beed'], $text);
        $text = str_replace('Beitragdel, ', $PMF_LANG['ad_log_bede'], $text);
        echo $text;
        ?></small>
} elseif ($user->perm->checkRight($user->getUserId(), 'adminlog') && 'deleteadminlog' == $action) {

Fixed code:
    $csrfToken = PMF_Filter::filterInput(INPUT_GET, 'csrf', FILTER_SANITIZE_STRING);
    if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfToken) {
        $deleteLog = false;
    } else {
        $deleteLog = true;
    }

                    <a class="btn btn-danger"
                       href="?action=deleteadminlog&csrf=<?php echo $user->getCsrfTokenFromSession() ?>">
            $text = str_replace('Loginerror', $PMF_LANG['ad_log_lger'], $text);
            $text = str_replace('Session expired', $PMF_LANG['ad_log_sess'], $text);
            $text = str_replace('Useredit, ', $PMF_LANG['ad_log_edit'], $text);
            $text = str_replace('Beitragcreatesave', $PMF_LANG['ad_log_crsa'], $text);
            $text = str_replace('Beitragcreate', $PMF_LANG['ad_log_crea'], $text);
            $text = str_replace('Usersave, ', $PMF_LANG['ad_log_ussa'], $text);
            $text = str_replace('Userdel, ', $PMF_LANG['ad_log_usde'], $text);
            $text = str_replace('Beitragedit, ', $PMF_LANG['ad_log_beed'], $text);
            $text = str_replace('Beitragdel, ', $PMF_LANG['ad_log_bede'], $text);
            echo $text;
            ?></small>
} elseif ($user->perm->checkRight($user->getUserId(), 'adminlog') && 'deleteadminlog' == $action && $deleteLog) {
CVE-2017-15733 (PHP, published 2017-10-22T18:29Z)
Description: value: In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/ajax.attachment.php and admin/att.main.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/admin/ajax.attachment.php
phpmyfaq/admin/att.main.php
Commit message: Added missing CSRF protection


Vulnerable code:
 *
 *
                print $PMF_LANG['msgAttachmentsDeleted'];
                print $PMF_LANG['ad_att_delfail'];
                                <a href="javascript:deleteAttachment(<?php echo $item->id ?>); void(0);"
        function deleteAttachment(att_id)
                    data:    {attId: att_id},

Fixed code:
$csrfToken = PMF_Filter::filterInput(INPUT_GET, 'csrf', FILTER_SANITIZE_STRING);

            if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfToken) {
                echo $PMF_LANG['err_NotAuth'];
                exit(1);
            }

                echo $PMF_LANG['msgAttachmentsDeleted'];
                echo $PMF_LANG['ad_att_delfail'];
                                <a href="javascript:deleteAttachment(<?php echo $item->id ?>, '<?php echo $user->getCsrfTokenFromSession() ?>'); void(0);"
         * @apram csrf CSRF token
        function deleteAttachment(att_id, csrf)
                    data:    { attId: att_id, csrf: csrf},
CVE-2017-15734 (PHP, published 2017-10-22T18:29Z)
Description: value: In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/admin/stat.main.php
Commit message: Added missing CSRF protection


Vulnerable code:
                        <a class="btn btn-danger" href="?action=clear-visits">
    $csrfToken = PMF_Filter::filterInput(INPUT_POST, 'csrf', FILTER_SANITIZE_STRING);
    if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfToken) {
    if ('clear-visits' === $action) {

Fixed code:
                        <a class="btn btn-danger"
                           href="?action=clear-visits&csrf=<?php echo $user->getCsrfTokenFromSession() ?>">
    $csrfTokenFromPost = PMF_Filter::filterInput(INPUT_POST, 'csrf', FILTER_SANITIZE_STRING);
    $csrfTokenFromGet = PMF_Filter::filterInput(INPUT_GET, 'csrf', FILTER_SANITIZE_STRING);
    if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfTokenFromPost) {
    if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfTokenFromGet) {
        $clearVisits = false;
    } else {
        $clearVisits = true;
    }

    if ('clear-visits' === $action && $clearVisits) {
CVE-2017-15735 (PHP, published 2017-10-22T18:29Z)
Description: value: In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/admin/glossary.add.php
phpmyfaq/admin/glossary.edit.php
phpmyfaq/admin/glossary.main.php
Commit message: Added missing CSRF protection


Vulnerable code:
 *
 *
    if ('saveglossary' == $action && $user->perm->checkRight($user->getUserId(), 'addglossary')) {
    if ('updateglossary' == $action && $user->perm->checkRight($user->getUserId(), 'editglossary')) {
    if ('deleteglossary' == $action && $user->perm->checkRight($user->getUserId(), 'editglossary')) {
            '<td><a class="btn btn-danger" onclick="return confirm(\'%s\'); return false;" href="%s%d">',
            $items['id']

Fixed code:
                    <input type="hidden" name="csrf" value="<?php echo $user->getCsrfTokenFromSession() ?>">

                    <input type="hidden" name="csrf" value="<?php echo $user->getCsrfTokenFromSession() ?>">

$csrfTokenFromPost = PMF_Filter::filterInput(INPUT_POST, 'csrf', FILTER_SANITIZE_STRING);
$csrfTokenFromGet = PMF_Filter::filterInput(INPUT_GET, 'csrf', FILTER_SANITIZE_STRING);
if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfTokenFromPost) {
    $csrfCheck = false;
} else {
    $csrfCheck = true;
}
if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfTokenFromGet) {
    $csrfCheckDelete = false;
} else {
    $csrfCheckDelete = true;
}

    if ('saveglossary' == $action && $user->perm->checkRight($user->getUserId(), 'addglossary') && $csrfCheck) {
    if ('updateglossary' == $action && $user->perm->checkRight($user->getUserId(), 'editglossary') && $csrfCheck) {
    if ('deleteglossary' == $action && $user->perm->checkRight($user->getUserId(), 'editglossary') && $csrfCheckDelete) {
            '<td><a class="btn btn-danger" onclick="return confirm(\'%s\'); return false;" href="%s%d%s%s">',
            $items['id'],
            '&csrf=',
            $user->getCsrfTokenFromSession()
CVE-2017-15808 (PHP, published 2017-10-23T17:29Z)
Description: value: In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/admin/ajax.config.php
phpmyfaq/admin/instances.php
Commit message: Added missing CSRF token


Vulnerable code:
    $currentInstance->getInstanceById($site->id);
    $currentInstance->setId($site->id);
    ?>
                <?php endif;
    ?>
        <?php endforeach;
    ?>
                    { action: 'ajax', ajax: 'config', ajaxaction: 'add_instance',
                        url: url, instance: instance, comment: comment, email: email, admin: admin, password: password

Fixed code:
        if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfToken) {
            $http->sendJsonWithHeaders(array('error' => $PMF_LANG['err_NotAuth']));
            exit(1);
        }

            $currentInstance->getInstanceById($site->id);
            $currentInstance->setId($site->id);
            ?>
                <?php endif; ?>
        <?php endforeach; ?>
                        <input type="hidden" name="csrf" id="csrf" value="<?php echo $user->getCsrfTokenFromSession() ?>">
                var csrf     = $('#csrf').val();
                    {
                        action: 'ajax', ajax: 'config', ajaxaction: 'add_instance', csrf: csrf, url: url,
                        instance: instance, comment: comment, email: email, admin: admin, password: password
CVE-2017-15809 (PHP, published 2017-10-23T17:29Z)
Description: value: In phpMyFaq before 2.9.9, there is XSS in admin/tags.main.php via a crafted tag.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/admin/ajax.tags.php
phpmyfaq/admin/assets/js/tags.js
phpmyfaq/admin/tags.main.php
Commit message: Added XSS and CSRF protection


Vulnerable code:
            input.replaceWith('<span data-tag-id="' + id + '">' + input.val() + '</span>');
            data: 'id=' + id + '&tag=' + tag,
                input.replaceWith('<span data-tag-id="' + id + '">' + input.val() + '</span>');
                $('span[data-tag-id="' + id + '"]').append(' ✓');
                $('#saving_data_indicator').html('✓ ' + message);

        echo '<td><span data-tag-id="'.$key.'">'.$tag.'</span></td>';

Fixed code:
        $csrfToken = PMF_Filter::filterInput(INPUT_POST, 'csrf', FILTER_SANITIZE_STRING);

        if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfToken) {
            echo json_encode($PMF_LANG['err_NotAuth']);
            exit(1);
        }
            input.replaceWith('<span data-tag-id="' + id + '">' + input.val().replace(/\//g, '&#x2F;') + '</span>');
        var csrf = $('input[name=csrf]').val();
            data: 'id=' + id + '&tag=' + tag + '&csrf=' + csrf,
                input.replaceWith('<span data-tag-id="' + id + '">' + input.val().replace(/\//g, '&#x2F;') + '</span>');
                $('span[data-tag-id="' + id + '"]');
                $('#saving_data_indicator').html(message);
                <input type="hidden" name="csrf" value="<?php echo $user->getCsrfTokenFromSession() ?>">
        echo '<td><span data-tag-id="'.$key.'">'.PMF_String::htmlspecialchars($tag).'</span></td>';
CVE-2017-7579 (PHP, published 2017-04-07T16:59Z)
Description: value: inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/inc/PMF/Faq.php
Commit message: Added missing sanitizing


Vulnerable code:
                $data['question'] = $row->question;
                $data['question'] = $row->question;
                $oLink->itemTitle = $row->question;

Fixed code:
                $data['question'] = PMF_Filter::filterVar($row->question, FILTER_SANITIZE_STRING);
                $data['question'] = PMF_Filter::filterVar($row->question, FILTER_SANITIZE_STRING);
                $oLink->itemTitle = $title;
CVE-2024-22202 (PHP, published 2024-02-05T20:15Z)
Description: value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows an attacker to spoof another user's detail, and in turn make a compelling phishing case for removing another user's account. The front-end of this page doesn't allow changing the form details, an attacker can utilize a proxy to intercept this request and submit other data. Upon submitting this form, an email is sent to the administrator informing them that this user wants to delete their account. An administrator has no way of telling the difference between the actual user wishing to delete their account or the attacker issuing this for an account they do not control. This issue has been patched in version 3.2.5.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/api.service.php
phpmyfaq/assets/themes/default/templates/request-removal.html
phpmyfaq/request-removal.php
Commit message: fix: added missing check on user to request removal


Vulnerable code:
    <input type="hidden" name="lang" id="lang" value="{{ lang }}" />

Fixed code:
        $userId = Filter::filterVar($postData['userId'], FILTER_VALIDATE_INT);
        // Validate User ID, Username and email
        $user = new User($faqConfig);
        if (
            !$user->getUserById($userId) ||
            $userId !== $user->getUserId() ||
            $loginName !== $user->getLogin() ||
            $email !== $user->getUserData('email')
        ) {
            $response->setStatusCode(Response::HTTP_BAD_REQUEST);
            $response->setData(['error' => Translation::get('ad_user_error_loginInvalid')]);
            break;
        }

    <input type="hidden" name="lang" id="lang" value="{{ lang }}">
    <input type="hidden" name="userId" id="userId" value="{{ userId }}">
        'userId' => $user->getUserId(),