mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-08-11 03:04:09 +02:00
Code Issues Releases Wiki Activity

[ticket/15687] Force supplied filename to be correct and modify route

Browse Source 
PHPBB3-15687
This commit is contained in:
Marc Alexander
2023-06-28 10:51:22 +02:00
parent 5cb0b267d3
commit 4e9cf239ed
9 changed files with 21 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
phpBB/phpbb/storage/controller/attachment.php
View File

@@ -86,11 +86,14 @@ class attachment extends controller
}
/**
* {@inheritdoc}
* Handle attachments
*
* @param int $id File ID
* @param string $filename Filename
*/
public function handle(string $file): Response
public function handle_attachment(int $id, string $filename): Response
{
$attach_id = (int) $file;
$attach_id = $id;
$thumbnail = $this->request->variable('t', false);
$this->language->add_lang('viewtopic');
@@ -109,7 +112,8 @@ class attachment extends controller
is_orphan, physical_filename, real_filename, extension, mimetype,
filesize, filetime
FROM ' . ATTACHMENTS_TABLE . "
WHERE attach_id = $attach_id";
WHERE attach_id = $attach_id" .
(($filename) ? " AND real_filename = '" . $this->db->sql_escape($filename) . "'" : '');
$result = $this->db->sql_query($sql);
$attachment = $this->db->sql_fetchrow($result);
$this->db->sql_freeresult($result);