-
Bug
-
Resolution: Fixed
-
Minor
-
3.0.10
-
None
F.e. includes/functions_privmsgs.php
// Additionally, do not include the sender if he is in the group he wants to send to. ;)
|
if ($row['user_id'] === $user->data['user_id'])
|
{
|
continue;
|
}
|
This code compares two strings to be exactly the same. If there is a MOD that casts the global user_id to int (which I think is a security addition), the comparison will fail.
(In this case it sends group pms also to the sender.)
The code should either check == only, or both values should be casted to int.
- is related to
-
PHPBB-10904 Misleading message when PMing an empty group
- Closed