Skip to content

[BF] Public access level (0) not always granted#956

Merged
barryo merged 1 commit intoinex:mainfrom
Rawk:main
Feb 16, 2026
Merged

[BF] Public access level (0) not always granted#956
barryo merged 1 commit intoinex:mainfrom
Rawk:main

Conversation

@Rawk
Copy link
Copy Markdown
Contributor

@Rawk Rawk commented Jan 27, 2026

User::AUTH_PUBLIC is an int, so the config value needs to be cast to an int before checking with ===.

This fixes a problem where having GRAPHER_ACCESS_CUSTOMER=0 in .env is not giving public access. Probably fixes other cases too.

I have not run the unit tests and psalm. If you think it is needed for this change, i have to take some time to set it up first.

In addition to the above, I have:

  • ensured unit tests all run without error
  • ran psalm and corrected any static analysis issues
  • ensured all relevant template output is escaped to avoid XSS attached with <?= $t->ee( $data ) ?> or equivalent
  • ensured appropriate checks against user privilege / resources accessed
  • API calls (particular for add/edit/delete/toggle) are not implemented with GET and use CSRF tokens to avoid CSRF attacks

`User::AUTH_PUBLIC` is an int, so the config value needs to be cast to
an int before checking with `===`-operator.

This fixes a problem where having `GRAPHER_ACCESS_CUSTOMER=0` in .env is
not giving public access. Probably fixes other cases too.
@barryo
Copy link
Copy Markdown
Member

barryo commented Feb 16, 2026

Given that these are all prechecked with is_numeric(), this looks fine. Thanks @Rawk. GitHub will run the unit tests once I move to main.

@barryo barryo merged commit 3291f7c into inex:main Feb 16, 2026
1 check passed
@Rawk Rawk deleted the main branch February 17, 2026 05:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants