From c52ef8b2f395cded35f4ec01149b4dd4196cdff1 Mon Sep 17 00:00:00 2001
From: Lufei <lufei@easycorp.ltd>
Date: Mon, 22 May 2023 14:43:24 +0800
Subject: [PATCH] * Fix wrong setting of sessionVar.

---
 module/misc/config.php  | 2 ++
 module/misc/control.php | 6 +++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/module/misc/config.php b/module/misc/config.php
index 10d1ead72a..98a44fc616 100644
--- a/module/misc/config.php
+++ b/module/misc/config.php
@@ -2,3 +2,5 @@
 $config->misc->api     = 'https://api.zentao.net';
 $config->misc->enApi   = 'https://api.zentao.pm';
 $config->misc->qucheng = 'https://www.qucheng.com';
+
+$config->misc->disabledSessionVar = array('user', 'tutorialmode');
diff --git a/module/misc/control.php b/module/misc/control.php
index 44e7de4cb9..771625b14b 100644
--- a/module/misc/control.php
+++ b/module/misc/control.php
@@ -217,13 +217,13 @@ class misc extends control
      * Show captcha and save to session.
      *
      * @param  string $sessionVar
-     * @param  string $uuid
      * @access public
      * @return void
      */
-    public function captcha($sessionVar = 'captcha', $uuid = '')
+    public function captcha($sessionVar = 'captcha')
     {
-        if($sessionVar == 'user') die('The string user is not allowed to be defined as a session field.');
+        if(in_array(strtolower($sessionVar), $this->config->misc->disabledSessionVar)) die("The string {$sessionVar} is not allowed to be defined as a session field.");
+
         $obLevel = ob_get_level();
         for($i = 0; $i < $obLevel; $i++) ob_end_clean();