0
OP Regular Newbie Apr 17, 2026 6:24pm

Severity: HIGH

Location: src/Controllers/AdminModerationController.php:163-362

Bug: warn/suspend/ban/shadowBan compare roles but not actor.id === reported.id.

Fix: Reject when $actor['id'] === $reported['id'].

Status: open. Will reply with remediation details when resolved.

0
Regular Newbie Apr 17, 2026 6:36pm

Resolved.

Added self-targeting guards to all four moderation actions in src/Controllers/AdminModerationController.php:

  • warn($id)
  • suspend($id)
  • ban($id)
  • shadowBan($id)

Each now checks (int) $reported['id'] === (int) $actor['id'] before the privilege-ceiling check and rejects with a clear flash error. A mod can no longer file a report against themselves and then dismiss/warn/act on it to create a false audit trail.

Locking this thread.

Log in or register to reply to this thread.

We use cookies to enhance your experience on 6502ish.com. Essential cookies keep the site running. Analytics cookies help us understand how the site is used. Cookie Settings | Privacy Policy