safety

2017-09-17 19:11:51 +01:00
parent 5763b77e2b
commit 186ea55348
1 changed files with 1 additions and 1 deletions
--- a/ext/user/main.php
+++ b/ext/user/main.php
@@ -126,7 +126,7 @@ class UserPage extends Extension {
 					$a["name"] = '%' . $_GET['username'] . '%';
 				}

-				if(@$_GET['email']) {
+				if($user->can('delete_user') && @$_GET['email']) {
 					$q .= " AND SCORE_STRNORM(name) LIKE SCORE_STRNORM(:email)";
 					$a["email"] = '%' . $_GET['email'] . '%';
 				}