From e29412c2baab988111a5714ae53557e41a37fa3a Mon Sep 17 00:00:00 2001
From: sparkyx <danydb@noalyss.eu>
Date: Sat, 14 Jan 2023 14:07:06 +0100
Subject: [PATCH] Improve security : function isAdmin recheck the password

---
 html/user_login.php                  |  4 ++--
 include/ajax/ajax_admin.php          |  2 +-
 include/class/noalyss_user.class.php | 10 +++++-----
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/html/user_login.php b/html/user_login.php
index e4477ff43..126a4ebec 100644
--- a/html/user_login.php
+++ b/html/user_login.php
@@ -98,7 +98,7 @@ if ( $version < DBVERSIONREPO )
     echo '<a hreF="'.$base.'">'.$a.'</a></h2>';
 
 }
-if ( $User->Admin()  == 1)
+if ( $User->isAdmin()  == 1)
 {
     if (SITE_UPDATE !="") {
      $update=@file_get_contents(SITE_UPDATE);
@@ -137,7 +137,7 @@ load_all_script();
 $result="";
 $result.="<table border=\"0\">";
 $result.='<TR>';
-if ( $User->Admin()  == 1 )
+if ( $User->isAdmin()  == 1 )
 {
     $result.="<TD  class=\"tool\" ><A class=\"cell\" HREF=\"admin-noalyss.php\">"._("Administration")."  </A></TD>";
 }
diff --git a/include/ajax/ajax_admin.php b/include/ajax/ajax_admin.php
index 5715b3c29..b49d96053 100644
--- a/include/ajax/ajax_admin.php
+++ b/include/ajax/ajax_admin.php
@@ -28,7 +28,7 @@ if (!defined('ALLOWED'))
  * @see admin-noalyss.php ajax_misc.php admin.js
  */
 global $g_user;
-if ($g_user->Admin()==0)
+if ($g_user->isAdmin()==0)
 {
     die();
 }
diff --git a/include/class/noalyss_user.class.php b/include/class/noalyss_user.class.php
index f7bce1716..0394287d0 100644
--- a/include/class/noalyss_user.class.php
+++ b/include/class/noalyss_user.class.php
@@ -657,25 +657,25 @@ class Noalyss_User
      * synomym for isAdmin,
      * @deprecated
      */
-    function Admin()
+    function Admin():int
     {
         return $this->isAdmin();
     }
 
     /**
-     * @brief  Check if an user is an admin
+     * @brief  Check if an user is an admin and check also his password
      *
      * @return 1 for yes 0 for no
      */
-    function isAdmin()
+    function isAdmin():int
     {
         $this->admin=0;
         $pass5=$this->password;
         $sql="select count(*) from ac_users where use_login=$1
-             and use_active=1 and use_admin=1 ";
+             and use_active=1 and use_admin=1 and use_pass=$2 ";
 
         $cn=new Database();
-        $this->admin=$cn->get_value($sql, array($this->login));
+        $this->admin=$cn->get_value($sql, array($this->login,$pass5));
         return $this->admin;
     }