Fix guest pass href exploit

2026-08-26 13:37:58 +01:00 · 2016-05-23 16:47:33 -04:00
parent fc47488d29
commit 70af06de0c
1 changed files with 2 additions and 1 deletions
@@ -124,7 +124,8 @@
 				if (A in accesses)
 					accesses.Remove(A)
 				else
-					accesses.Add(A)
+					if(giver && giver.access && (A in giver.access))
+						accesses.Add(A)
 	if (href_list["action"])
 		switch(href_list["action"])
 			if ("id")