makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-28 06:08:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

[feature/attach-dl] Send 404 if we get empty row from privmsg|posts|topic table

Browse source 
PHPBB3-11042
This commit is contained in:
Andreas Fischer 2012-08-10 03:26:30 +02:00
parent ccb0baa20a
commit 62305bec6d
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
phpBB/download/file.php
View file

@ -366,6 +366,12 @@ else
$row = $db->sql_fetchrow($result);
$db->sql_freeresult($result);
if (empty($row))
{
send_status_line(404, 'Not Found');
trigger_error('ERROR_NO_ATTACHMENT');
}
$bad_chars = array("'", "\\", ' ', '/', ':', '*', '?', '"', '<', '>', '|');
$clean_name = current($row);
$clean_name = rawurlencode(str_replace($bad_chars, '_', strtolower($clean_name)));