Changeset 213 for branches/awmn/includes/pages/mynodes/mynodes.php

Timestamp:

10/03/2009 02:40:27 PM (3 years ago)

Author:

Acinonyx

Message:

[awmn] Fix unvalidated input of photos id which allows deletion of files from unprivileged users

File:

• branches/awmn/includes/pages/mynodes/mynodes.php (modified) (1 diff)

branches/awmn/includes/pages/mynodes/mynodes.php

@@ -562 +562 @@
                         foreach( (array) $_POST['id'] as $key => $value) {
                                 $db->del("photos", '', "id = '".intval($value)."' AND node_id = ".intval(get('node')));
-                                $uploaddir = $vars['folders']['photos'];
-                                $filename = 'photo-'.$value.".*";
-                                delfile(ROOT_PATH.$uploaddir.$filename);
-                                $filename = 'photo-'.$value."-*.*";
-                                delfile(ROOT_PATH.$uploaddir.$filename);
+                                if ($db->affected_rows > 0 ) {
+                                        $uploaddir = $vars['folders']['photos'];
+                                        $filename = 'photo-'.$value.".*";
+                                        delfile(ROOT_PATH.$uploaddir.$filename);
+                                        $filename = 'photo-'.$value."-*.*";
+                                        delfile(ROOT_PATH.$uploaddir.$filename);
+                                }
                         }
                 }