tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Show the queue and hidden stories to editors only.

Browse Source 
With allow_queue_image in the session, queue=1 showed a visitor the whole
queue and the hidden stories. display.php now shows a visitor only the
image they submitted.
This commit is contained in:
tim
2026-09-25 21:26:32 +02:00
parent 0e5e742210
commit cda0602c95
2 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
display.php
+8 -3
View File
@@ -19,7 +19,6 @@ display_img(get_id());
function display_img($id) {
global $db, $is_admin, $queue;
$queue = get_queue();
$table = which_table();
if ((isset($_SESSION['allow_queue_image']) &&
$_SESSION['allow_queue_image'] == $id) ||
@@ -29,14 +28,20 @@ function display_img($id) {
$allow_queue = FALSE;
}
// Visitors can only see the image they submitted themselves, and no hidden stories
if ($queue) {
if (!$is_admin && !$allow_queue) {
if (!$allow_queue) {
header("HTTP/1.1 401 Access Denied");
return;
}
$table = 'queue';
$hidden = "";
} else {
$table = 'xxx';
$hidden = $is_admin ? "" : " AND hidden IS NOT TRUE";
}
$query = "SELECT img, mime FROM $table WHERE 1 AND ID = ".$db->real_escape_string($id)." LIMIT 0, 1";
$query = "SELECT img, mime FROM $table WHERE 1 AND ID = ".$db->real_escape_string($id).$hidden." LIMIT 0, 1";
$result = $db->query($query)or die("Query failed : ".$db->error);
$row = $result->fetch_assoc();