mirror of
https://github.com/phpbb/phpbb.git
synced 2025-06-06 14:35:56 +02:00
[feature/attach-dl] Putting more old code under "else if ($download_id)".
PHPBB3-11042
This commit is contained in:
Andreas Fischer
parent
60d382df4c
commit
ecab0212f8
@ -196,123 +196,142 @@ else if ($download_id)
|
|||||||
// sizeof($attachments) == 1
|
// sizeof($attachments) == 1
|
||||||
$attachment = current($attachments);
|
$attachment = current($attachments);
|
||||||
|
|
||||||
// in_message = 1 means it's in a private message
|
|
||||||
if (!$attachment['in_message'] && !$config['allow_attachments'] || $attachment['in_message'] && !$config['allow_pm_attach'])
|
if (!$attachment['in_message'] && !$config['allow_attachments'] || $attachment['in_message'] && !$config['allow_pm_attach'])
|
||||||
{
|
{
|
||||||
send_status_line(404, 'Not Found');
|
send_status_line(404, 'Not Found');
|
||||||
trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED');
|
trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED');
|
||||||
}
|
}
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
// sizeof($attachments) > 1
|
|
||||||
}
|
|
||||||
|
|
||||||
$row = array();
|
if ($attachment['is_orphan'])
|
||||||
|
|
||||||
if ($attachment && $attachment['is_orphan'])
|
|
||||||
{
|
|
||||||
// We allow admins having attachment permissions to see orphan attachments...
|
|
||||||
$own_attachment = ($auth->acl_get('a_attach') || $attachment['poster_id'] == $user->data['user_id']) ? true : false;
|
|
||||||
|
|
||||||
if (!$own_attachment || ($attachment['in_message'] && !$auth->acl_get('u_pm_download')) || (!$attachment['in_message'] && !$auth->acl_get('u_download')))
|
|
||||||
{
|
{
|
||||||
send_status_line(404, 'Not Found');
|
// We allow admins having attachment permissions to see orphan attachments...
|
||||||
trigger_error('ERROR_NO_ATTACHMENT');
|
$own_attachment = ($auth->acl_get('a_attach') || $attachment['poster_id'] == $user->data['user_id']) ? true : false;
|
||||||
|
|
||||||
|
if (!$own_attachment || ($attachment['in_message'] && !$auth->acl_get('u_pm_download')) || (!$attachment['in_message'] && !$auth->acl_get('u_download')))
|
||||||
|
{
|
||||||
|
send_status_line(404, 'Not Found');
|
||||||
|
trigger_error('ERROR_NO_ATTACHMENT');
|
||||||
|
}
|
||||||
|
|
||||||
|
// Obtain all extensions...
|
||||||
|
$extensions = $cache->obtain_attach_extensions(true);
|
||||||
}
|
}
|
||||||
|
else
|
||||||
// Obtain all extensions...
|
|
||||||
$extensions = $cache->obtain_attach_extensions(true);
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
if ($attachments || ($attachment && !$attachment['in_message']))
|
|
||||||
{
|
{
|
||||||
if ($download_id || $post_id)
|
if (!$attachment['in_message'])
|
||||||
{
|
{
|
||||||
$sql = 'SELECT p.forum_id, f.forum_password, f.parent_id
|
$sql = 'SELECT p.forum_id, f.forum_password, f.parent_id
|
||||||
FROM ' . POSTS_TABLE . ' p, ' . FORUMS_TABLE . ' f
|
FROM ' . POSTS_TABLE . ' p, ' . FORUMS_TABLE . ' f
|
||||||
WHERE p.post_id = ' . (($attachment) ? $attachment['post_msg_id'] : $post_id) . '
|
WHERE p.post_id = ' . $attachment['post_msg_id'] . '
|
||||||
AND p.forum_id = f.forum_id';
|
AND p.forum_id = f.forum_id';
|
||||||
}
|
$result = $db->sql_query_limit($sql, 1);
|
||||||
|
$row = $db->sql_fetchrow($result);
|
||||||
|
$db->sql_freeresult($result);
|
||||||
|
|
||||||
if ($topic_id)
|
$f_download = $auth->acl_get('f_download', $row['forum_id']);
|
||||||
{
|
|
||||||
$sql = 'SELECT t.forum_id, f.forum_password, f.parent_id
|
|
||||||
FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f
|
|
||||||
WHERE t.topic_id = $topic_id
|
|
||||||
AND t.forum_id = f.forum_id";
|
|
||||||
}
|
|
||||||
|
|
||||||
$result = $db->sql_query_limit($sql, 1);
|
|
||||||
$row = $db->sql_fetchrow($result);
|
|
||||||
$db->sql_freeresult($result);
|
|
||||||
|
|
||||||
$f_download = $auth->acl_get('f_download', $row['forum_id']);
|
if ($auth->acl_get('u_download') && $f_download)
|
||||||
|
|
||||||
if ($auth->acl_get('u_download') && $f_download)
|
|
||||||
{
|
|
||||||
if ($row && $row['forum_password'])
|
|
||||||
{
|
{
|
||||||
// Do something else ... ?
|
if ($row && $row['forum_password'])
|
||||||
login_forum_box($row);
|
{
|
||||||
|
// Do something else ... ?
|
||||||
|
login_forum_box($row);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
send_status_line(403, 'Forbidden');
|
||||||
|
trigger_error('SORRY_AUTH_VIEW_ATTACH');
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
send_status_line(403, 'Forbidden');
|
// Attachment is in a private message.
|
||||||
trigger_error('SORRY_AUTH_VIEW_ATTACH');
|
$row['forum_id'] = false;
|
||||||
}
|
if (!$auth->acl_get('u_pm_download'))
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
$row['forum_id'] = false;
|
|
||||||
if (!$auth->acl_get('u_pm_download'))
|
|
||||||
{
|
|
||||||
send_status_line(403, 'Forbidden');
|
|
||||||
trigger_error('SORRY_AUTH_VIEW_ATTACH');
|
|
||||||
}
|
|
||||||
|
|
||||||
// Check if the attachment is within the users scope...
|
|
||||||
$sql = 'SELECT user_id, author_id
|
|
||||||
FROM ' . PRIVMSGS_TO_TABLE . '
|
|
||||||
WHERE msg_id = ' . $attachment['post_msg_id'];
|
|
||||||
$result = $db->sql_query($sql);
|
|
||||||
|
|
||||||
$allowed = false;
|
|
||||||
while ($user_row = $db->sql_fetchrow($result))
|
|
||||||
{
|
|
||||||
if ($user->data['user_id'] == $user_row['user_id'] || $user->data['user_id'] == $user_row['author_id'])
|
|
||||||
{
|
{
|
||||||
$allowed = true;
|
send_status_line(403, 'Forbidden');
|
||||||
break;
|
trigger_error('SORRY_AUTH_VIEW_ATTACH');
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check if the attachment is within the users scope...
|
||||||
|
$sql = 'SELECT user_id, author_id
|
||||||
|
FROM ' . PRIVMSGS_TO_TABLE . '
|
||||||
|
WHERE msg_id = ' . $attachment['post_msg_id'];
|
||||||
|
$result = $db->sql_query($sql);
|
||||||
|
|
||||||
|
$allowed = false;
|
||||||
|
while ($user_row = $db->sql_fetchrow($result))
|
||||||
|
{
|
||||||
|
if ($user->data['user_id'] == $user_row['user_id'] || $user->data['user_id'] == $user_row['author_id'])
|
||||||
|
{
|
||||||
|
$allowed = true;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
$db->sql_freeresult($result);
|
||||||
|
|
||||||
|
if (!$allowed)
|
||||||
|
{
|
||||||
|
send_status_line(403, 'Forbidden');
|
||||||
|
trigger_error('ERROR_NO_ATTACHMENT');
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
$db->sql_freeresult($result);
|
|
||||||
|
|
||||||
if (!$allowed)
|
// disallowed?
|
||||||
|
$extensions = $cache->obtain_attach_extensions($row['forum_id']);
|
||||||
|
if ($attachment)
|
||||||
{
|
{
|
||||||
send_status_line(403, 'Forbidden');
|
$ary = array($attachment);
|
||||||
trigger_error('ERROR_NO_ATTACHMENT');
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
$ary = &$attachments;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!phpbb_check_attach_extensions($extensions, $ary))
|
||||||
|
{
|
||||||
|
send_status_line(404, 'Forbidden');
|
||||||
|
trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $attachment['extension']));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
}
|
||||||
// disallowed?
|
else
|
||||||
$extensions = $cache->obtain_attach_extensions($row['forum_id']);
|
{
|
||||||
if ($attachment)
|
// sizeof($attachments) > 1
|
||||||
|
if ($post_id)
|
||||||
{
|
{
|
||||||
$ary = array($attachment);
|
$sql = 'SELECT p.forum_id, f.forum_password, f.parent_id
|
||||||
|
FROM ' . POSTS_TABLE . ' p, ' . FORUMS_TABLE . ' f
|
||||||
|
WHERE p.post_id = ' . (($attachment) ? $attachment['post_msg_id'] : $post_id) . '
|
||||||
|
AND p.forum_id = f.forum_id';
|
||||||
|
}
|
||||||
|
else if ($topic_id)
|
||||||
|
{
|
||||||
|
$sql = 'SELECT t.forum_id, f.forum_password, f.parent_id
|
||||||
|
FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f
|
||||||
|
WHERE t.topic_id = $topic_id
|
||||||
|
AND t.forum_id = f.forum_id";
|
||||||
|
}
|
||||||
|
|
||||||
|
$result = $db->sql_query_limit($sql, 1);
|
||||||
|
$row = $db->sql_fetchrow($result);
|
||||||
|
$db->sql_freeresult($result);
|
||||||
|
|
||||||
|
$f_download = $auth->acl_get('f_download', $row['forum_id']);
|
||||||
|
|
||||||
|
if ($auth->acl_get('u_download') && $f_download)
|
||||||
|
{
|
||||||
|
if ($row && $row['forum_password'])
|
||||||
|
{
|
||||||
|
// Do something else ... ?
|
||||||
|
login_forum_box($row);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
$ary = &$attachments;
|
send_status_line(403, 'Forbidden');
|
||||||
}
|
trigger_error('SORRY_AUTH_VIEW_ATTACH');
|
||||||
|
|
||||||
if (!phpbb_check_attach_extensions($extensions, $ary))
|
|
||||||
{
|
|
||||||
send_status_line(404, 'Forbidden');
|
|
||||||
$ext = ($attachment) ? $attachment['extension'] : $attachments[0]['extension'];
|
|
||||||
trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $ext));
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user