diff --git a/phpBB/download/file.php b/phpBB/download/file.php index 23e8327a22..7044400f90 100644 --- a/phpBB/download/file.php +++ b/phpBB/download/file.php @@ -285,16 +285,9 @@ else if ($download_id) // disallowed? $extensions = $cache->obtain_attach_extensions($row['forum_id']); - if ($attachment) - { - $ary = array($attachment); - } - else - { - $ary = &$attachments; - } - if (!phpbb_check_attach_extensions($extensions, $ary)) + $attachments_filtered = phpbb_filter_disallowed_extensions($extensions, array($attachment)); + if (empty($attachments_filtered)) { send_status_line(404, 'Forbidden'); trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $attachment['extension'])); diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php index 7d21147ab5..74c8be5f7b 100644 --- a/phpBB/includes/functions_download.php +++ b/phpBB/includes/functions_download.php @@ -618,21 +618,20 @@ function phpbb_increment_downloads($db, $ids) * Checks every attachment to see if it has an allowed extension * * @param array $extensions As generated by phpbb_cache_service::obtain_attach_extensions -* @param array &$attachments An array of attachments to check +* @param array $attachments An array of attachment row to check * -* @return bool Whether any of the attachments had allowed extensions +* @return array Array of attachment rows with allowed extension */ -function phpbb_check_attach_extensions($extensions, &$attachments) +function phpbb_filter_disallowed_extensions($extensions, $attachments) { - $new_ary = array(); - foreach ($attachments as $attach) + $result = array(); + foreach ($attachments as $row) { - if (isset($extensions['_allowed_'][$attach['extension']])) + if (isset($extensions['_allowed_'][$row['extension']])) { - $new_ary[] = $attach; + $result[] = $row; } } - $attachments = $new_ary; - return !empty($attachments); + return $result; }