Merge commit from fork

Handle alerts validation properly
SimpleMachines · Aug 8, 2024 · 8032867 · 8032867
2 parents 2e19fa8 + 7e29c00
commit 8032867
Showing 1 changed file with 9 additions and 3 deletions.
diff --git a/Sources/Alert.php b/Sources/Alert.php
@@ -981,8 +981,10 @@ public static function mark(int|array $members, array|int $to_mark, bool $read):
 			'',
 			'UPDATE {db_prefix}user_alerts
 			SET is_read = {int:read}
-			WHERE id_alert IN ({array_int:to_mark})',
+			WHERE id_alert IN ({array_int:to_mark})
+				AND id_member IN ({array_int:members})',
 			[
+				'members' => $members,
 				'read' => $time,
 				'to_mark' => $to_mark,
 			],
@@ -1097,8 +1099,10 @@ public static function delete(int|array $ids, int|array $members = []): void
 		Db::$db->query(
 			'',
 			'DELETE FROM {db_prefix}user_alerts
-			WHERE id_alert IN ({array_int:ids})',
+			WHERE id_alert IN ({array_int:ids})
+				AND id_member IN ({array_int:members}',
 			[
+				'members' => $members,
 				'ids' => $ids,
 			],
 		);
@@ -1544,8 +1548,10 @@ protected static function deleteInvisible(array &$alerts, int $memID): void
 			Db::$db->query(
 				'',
 				'DELETE FROM {db_prefix}user_alerts
-				WHERE id_alert IN ({array_int:alerts})',
+				WHERE id_alert IN ({array_int:alerts})
+					AND id_member = {int:member}',
 				[
+					'member' => $memID,
 					'alerts' => $deletes,
 				],
 			);