makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-28 06:08:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

[ticket/12171] Check topic visibility before allowing to download attachments

Browse source 
PHPBB3-12171
This commit is contained in:
Joas Schilling 2014-02-08 13:53:23 +01:00
parent 344baf9180
commit 8744b0da6d
2 changed files with 16 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
phpBB/download/file.php
View file

@ -163,17 +163,17 @@ if (!$config['allow_attachments'] && !$config['allow_pm_attach'])
if ($download_id) if ($download_id)
{ {
// Attachment id (only 1 attachment) // Attachment id (only 1 attachment)
$sql_where = "attach_id = $download_id"; $sql_where = 'attach_id = ' . $download_id;
} }
else if ($post_msg_id) else if ($post_msg_id)
{ {
// Post id or private message id (multiple attachments) // Post id or private message id (multiple attachments)
$sql_where = "post_msg_id = $post_msg_id AND is_orphan = 0"; $sql_where = 'is_orphan = 0 AND post_msg_id = ' . $post_msg_id;
} }
else if ($topic_id) else if ($topic_id)
{ {
// Topic id (multiple attachments) // Topic id (multiple attachments)
$sql_where = "topic_id = $topic_id AND is_orphan = 0"; $sql_where = 'is_orphan = 0 AND topic_id = ' . $topic_id;
} }
else else
{ {

18
phpBB/includes/functions_download.php
View file

@ -625,15 +625,23 @@ function phpbb_increment_downloads($db, $ids)
*/ */
function phpbb_download_handle_forum_auth($db, $auth, $topic_id) function phpbb_download_handle_forum_auth($db, $auth, $topic_id)
{ {
$sql = 'SELECT t.forum_id, f.forum_name, f.forum_password, f.parent_id $sql_array = array(
FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f 'SELECT' => 't.topic_visibility, t.forum_id, f.forum_name, f.forum_password, f.parent_id',
WHERE t.topic_id = " . (int) $topic_id . " 'FROM' => array(
AND t.forum_id = f.forum_id"; TOPICS_TABLE => 't',
FORUMS_TABLE => 'f',
),
'WHERE' => 't.topic_id = ' . (int) $topic_id . '
AND t.forum_id = f.forum_id',
);
$sql = $db->sql_build_query('SELECT', $sql_array);
$result = $db->sql_query($sql); $result = $db->sql_query($sql);
$row = $db->sql_fetchrow($result); $row = $db->sql_fetchrow($result);
$db->sql_freeresult($result); $db->sql_freeresult($result);
if ($auth->acl_get('u_download') && $auth->acl_get('f_download', $row['forum_id'])) if ($row && ($row['topic_visibility'] == ITEM_APPROVED || $auth->acl_get('m_approve', $row['forum_id']))
&& $auth->acl_get('u_download') && $auth->acl_get('f_download', $row['forum_id']))
{ {
if ($row && $row['forum_password']) if ($row && $row['forum_password'])
{ {