Skip to content

Conversation

@Rawk
Copy link
Contributor

@Rawk Rawk commented Jan 27, 2026

User::AUTH_PUBLIC is an int, so the config value needs to be cast to an int before checking with ===.

This fixes a problem where having GRAPHER_ACCESS_CUSTOMER=0 in .env is not giving public access. Probably fixes other cases too.

I have not run the unit tests and psalm. If you think it is needed for this change, i have to take some time to set it up first.

In addition to the above, I have:

  • ensured unit tests all run without error
  • ran psalm and corrected any static analysis issues
  • ensured all relevant template output is escaped to avoid XSS attached with <?= $t->ee( $data ) ?> or equivalent
  • ensured appropriate checks against user privilege / resources accessed
  • API calls (particular for add/edit/delete/toggle) are not implemented with GET and use CSRF tokens to avoid CSRF attacks

`User::AUTH_PUBLIC` is an int, so the config value needs to be cast to
an int before checking with `===`-operator.

This fixes a problem where having `GRAPHER_ACCESS_CUSTOMER=0` in .env is
not giving public access. Probably fixes other cases too.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant