Validate the object type definition in CommentAction::validateObjectType()
authorTim Düsterhus <duesterhus@woltlab.com>
Mon, 28 Feb 2022 12:02:17 +0000 (13:02 +0100)
committerTim Düsterhus <duesterhus@woltlab.com>
Mon, 28 Feb 2022 12:02:17 +0000 (13:02 +0100)
wcfsetup/install/files/lib/data/comment/CommentAction.class.php

index e53f4fee11244868a8a85c8ed8e4873361bd209c..e59cb2e314ad48d7b0ca900af3d22686a630a6f3 100644 (file)
@@ -1179,6 +1179,9 @@ class CommentAction extends AbstractDatabaseObjectAction implements IMessageInli
                if ($objectType === null) {
                        throw new UserInputException('objectTypeID');
                }
+               if ($objectType->getDefinition()->definitionName !== 'com.woltlab.wcf.comment.commentableContent') {
+                       throw new UserInputException('objectTypeID');
+               }
                
                return $objectType;
        }