archive/piwigo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Security improve : you can't display a picture in a category it doesn't

Browse source 
belong to


git-svn-id: http://piwigo.org/svn/trunk@84 68402e56-0260-453c-a942-63ccdbb3a9ee
This commit is contained in:
z0rglub 2003-09-09 18:36:25 +00:00
commit 122ac485f7
1 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
picture.php
View file

@ -36,7 +36,6 @@ $query.= ';';
@mysql_query( $query );
//-------------------------------------------------------------- initialization
initialize_category( 'picture' );
$cat_directory = $page['cat_dir']; // by default
//------------------------------------- main picture information initialization
$query = 'SELECT id,date_available,comment,hit,keywords';
$query.= ',author,name,file,date_creation,filesize,width,height';
@ -52,6 +51,15 @@ $query.= ' AND id = '.$_GET['image_id'];
$query.= $conf['order_by'];
$query.= ';';
$result = mysql_query( $query );
// if this image_id doesn't correspond to this category, an error message is
// displayed, and execution is stopped
if ( mysql_num_rows( $result ) == 0 )
{
echo '<div style="text-align:center;">'.$lang['access_forbiden'].'<br />';
echo '<a href="'.add_session_id( './category.php' ).'">';
echo $lang['thumbnails'].'</a></div>';
exit();
}
$row = mysql_fetch_array( $result );
$page['id'] = $row['id'];
$page['file'] = $row['file'];