RSS Feed/News Reaction controller plugin doesn't check canView on the ReactionContent entity

[ENXF NET]

\XF\ControllerPlugin\Reaction::actionReactions

PHP:

$reactionsFinder = $reactionRepo->findContentReactions($contentType, $contentId, $reactionId)
    ->limitByPage($page, $perPage, 1);

$reactions = $reactionsFinder->fetch();

if (!count($reactions))
{
    return $this->message(\XF::phrase('no_one_has_reacted_to_this_content_yet'));
}

$hasNext = count($reactions) > $perPage;
$reactions = $reactions->slice(0, $perPage);

$tabSummary = $reactionRepo->getContentTabSummary($contentType...

Read more

Continue reading...