From 971133f23d59107454bb7a09aaf2e907eaff4d77 Mon Sep 17 00:00:00 2001
From: chaideqing <chaideqing@easycorp.ltd>
Date: Fri, 13 Jan 2023 06:39:03 +0000
Subject: [PATCH] * Fix can bypass permissions.

---
 module/misc/control.php | 1 +
 module/user/model.php   | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/module/misc/control.php b/module/misc/control.php
index b7fb0fe17b..a8ceb47dd6 100644
--- a/module/misc/control.php
+++ b/module/misc/control.php
@@ -230,6 +230,7 @@ class misc extends control
      */
     public function captcha($sessionVar = 'captcha', $uuid = '')
     {
+        if($sessionVar == 'user') die('The string user is not allowed to be defined as a session field.');
         $obLevel = ob_get_level();
         for($i = 0; $i < $obLevel; $i++) ob_end_clean();
 
diff --git a/module/user/model.php b/module/user/model.php
index 375febbe1b..d1724b9605 100644
--- a/module/user/model.php
+++ b/module/user/model.php
@@ -1199,7 +1199,8 @@ class userModel extends model
      */
     public function isLogon()
     {
-        return ($this->session->user and $this->session->user->account != 'guest');
+        $user = $this->session->user;
+        return ($user and !empty($user->account) and $user->account != 'guest');
     }
 
     /**