* Fix can bypass permissions.

2023-01-13 06:39:03 +00:00
parent aa2a622208
commit 971133f23d
2 changed files with 3 additions and 1 deletions
@@ -230,6 +230,7 @@ class misc extends control
     */
    public function captcha($sessionVar = 'captcha', $uuid = '')
    {
+        if($sessionVar == 'user') die('The string user is not allowed to be defined as a session field.');
        $obLevel = ob_get_level();
        for($i = 0; $i < $obLevel; $i++) ob_end_clean();