diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php index cbce502231..6e1843315b 100644 --- a/phpBB/includes/functions.php +++ b/phpBB/includes/functions.php @@ -785,7 +785,7 @@ function obtain_attach_extensions(&$extensions) else { // Don't count on forbidden extensions table, because it is not allowed to allow forbidden extensions at all - $sql = "SELECT e.extension, g.cat_id, g.download_mode, g.upload_icon + $sql = "SELECT e.extension, g.* FROM " . EXTENSIONS_TABLE . " e, " . EXTENSION_GROUPS_TABLE . " g WHERE e.group_id = g.group_id AND g.allow_group = 1"; @@ -800,6 +800,7 @@ function obtain_attach_extensions(&$extensions) $extensions[$extension]['display_cat'] = intval($row['cat_id']); $extensions[$extension]['download_mode'] = intval($row['download_mode']); $extensions[$extension]['upload_icon'] = trim($row['upload_icon']); + $extensions[$extension]['max_filesize'] = intval($row['max_filesize']); } $db->sql_freeresult($result); diff --git a/phpBB/includes/functions_posting.php b/phpBB/includes/functions_posting.php index 0dd91d4f78..5b0ae41cf9 100644 --- a/phpBB/includes/functions_posting.php +++ b/phpBB/includes/functions_posting.php @@ -956,7 +956,7 @@ function delete_post($mode, $post_id, $topic_id, $forum_id, $post_data) $forum_update_sql = ''; $user_update_sql = ''; - $topic_update_sql = 'topic_replies = topic_replies - 1, topic_replies_real = topic_replies_real - 1, '; + $topic_update_sql = 'topic_replies = topic_replies - 1, topic_replies_real = topic_replies_real - 1'; // Only one post... delete topic if ($post_data['topic_first_post_id'] == $post_data['topic_last_post_id']) @@ -1401,16 +1401,20 @@ function upload_attachment($filename) $filedata['filesize'] = (!@filesize($file)) ? intval($_FILES['size']) : @filesize($file); - $sql = "SELECT g.allow_group, g.max_filesize, g.cat_id - FROM " . EXTENSION_GROUPS_TABLE . " g, " . EXTENSIONS_TABLE . " e - WHERE (g.group_id = e.group_id) AND (e.extension = '" . $filedata['extension'] . "')"; - $result = $db->sql_query_limit($sql, 1); + $extensions = array(); + obtain_attach_extensions($extensions); - $row = $db->sql_fetchrow($result); - $db->sql_freeresult($result); + // Check Extension + if (!in_array($filedata['extension'], $extensions['_allowed_'])) + { + $filedata['error'] = true; + $filedata['err_msg'] = sprintf($user->lang['DISALLOWED_EXTENSION'], $filedata['extension']); + $filedata['post_attach'] = false; + return ($filedata); + } - $allowed_filesize = ( intval($row['max_filesize']) != 0 ) ? intval($row['max_filesize']) : intval($config['max_filesize']); - $cat_id = intval($row['cat_id']); + $allowed_filesize = ($extensions[$filedata['extension']]['max_filesize'] != 0) ? $extensions[$filedata['extension']]['max_filesize'] : $config['max_filesize']; + $cat_id = $extensions[$filedata['extension']]['display_cat']; // check Filename if ( preg_match("/[\\/:*?\"<>|]/i", $filename) ) @@ -1430,14 +1434,6 @@ function upload_attachment($filename) return ($filedata); } - // Check Extension - if (intval($row['allow_group']) == 0) - { - $filedata['error'] = true; - $filedata['err_msg'] = sprintf($user->lang['DISALLOWED_EXTENSION'], $filedata['extension']); - $filedata['post_attach'] = false; - return ($filedata); - } /* // Check Image Size, if it is an image if ( (!$acl->gets('m_', 'a_')) && ($cat_id == IMAGE_CAT) ) diff --git a/phpBB/viewtopic.php b/phpBB/viewtopic.php index 30325e5bd6..e31b3c9b08 100644 --- a/phpBB/viewtopic.php +++ b/phpBB/viewtopic.php @@ -1027,18 +1027,18 @@ if ($row = $db->sql_fetchrow($result)) // NOTE: If you want to use the download.php everytime an image is displayed inlined, replace the // Section between BEGIN and END with (Without the // of course): // $img_source = $phpbb_root_path . 'download.' . $phpEx . $SID . '&id=' . $attachment['attach_id']; - // $download_link = TRUE; + // $linked_image = TRUE; // // BEGIN if ((intval($config['ftp_upload'])) && (trim($config['upload_dir']) == '')) { $img_source = $phpbb_root_path . 'download.' . $phpEx . $SID . '&id=' . $attachment['attach_id']; - $download_link = TRUE; + $linked_image = TRUE; } else { $img_source = $filename; - $download_link = FALSE; + $linked_image = FALSE; } // END @@ -1046,9 +1046,9 @@ if ($row = $db->sql_fetchrow($result)) $download_link = $img_source; // Directly Viewed Image ... update the download count - if (!$download_link) + if (!$linked_image) { - $update_count = true; + $update_count = TRUE; } } @@ -1134,9 +1134,9 @@ if ($row = $db->sql_fetchrow($result)) if ($update_count) { - $sql = 'UPDATE ' . ATTACHMENTS_DESC_TABLE . ' + $sql = "UPDATE " . ATTACHMENTS_DESC_TABLE . " SET download_count = download_count + 1 - WHERE attach_id = ' . $attachment['attach_id']; + WHERE attach_id = " . $attachment['attach_id']; $db->sql_query($sql); } }