Mark-H/SubscribeMe — Issue #27: Properly check if user is logged in or not
Author: Mark-H
Created: 2011-12-24 19:33:52+00:00
State: open
Labels: 1 - Critical

In the smCheckout.inc.php file, line 37, it has

/* We will need to be logged in */
if (!is_numeric($modx->user->id)) return $modx->sendUnauthorizedPage();

But as far as I've been able to tell, MODx will return a user->id of 0 for an anonymous user, which is a perfectly acceptable numeric value as far as is_numeric is concerned. The initial formit hook, newsubscription.inc.php uses the same line and it cheerfully passes on anonymous users, creating a new subscription with the user ID set to 0.

Thanks Susan for spotting that.