Language: PHP
Label: vulnerable
CWE: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Code:
    public function save()
    {
        $validate = [
            'state.comment_body' => 'required|min:3',
        ];
        if (!user_id()) {
            $validate['state.comment_name'] = 'required|min:3';
            $validate['state.comment_email'] = 'required|email';
        }

        $this->validate($validate);

        $comment = new \MicroweberPackages\Comment\Models\Comment();

        if (isset($this->state['rel_id'])) {
            $comment->rel_id = $this->state['rel_id'];
            $comment->rel_type = 'content';
        }

        if (isset($this->state['reply_to_comment_id'])) {
            $comment->reply_to_comment_id = $this->state['reply_to_comment_id'];
        }

        $comment->user_ip = user_ip();
        $comment->session_id = session_id();

        if (user_id()) {
            $comment->created_by = user_id();
        } else {
            $comment->comment_name = $this->state['comment_name'];
            $comment->comment_email = $this->state['comment_email'];
        }

        $comment->comment_body = $this->state['comment_body'];
        $comment->save();

        $this->state['comment_body'] = '';
        $this->state['comment_name'] = '';
        $this->state['comment_email'] = '';

        $this->emit('commentAdded', $comment->id);

    }