tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Show the queue and hidden stories to editors only.

Browse Source 
With allow_queue_image in the session, queue=1 showed a visitor the whole
queue and the hidden stories. display.php now shows a visitor only the
image they submitted.
This commit is contained in:
tim
2026-09-25 21:26:32 +02:00
parent 0e5e742210
commit cda0602c95
2 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
display.php
+8 -3
View File
@@ -19,7 +19,6 @@ display_img(get_id());
function display_img($id) { function display_img($id) {
global $db, $is_admin, $queue; global $db, $is_admin, $queue;
$queue = get_queue(); $queue = get_queue();
$table = which_table();
if ((isset($_SESSION['allow_queue_image']) && if ((isset($_SESSION['allow_queue_image']) &&
$_SESSION['allow_queue_image'] == $id) || $_SESSION['allow_queue_image'] == $id) ||
@@ -29,14 +28,20 @@ function display_img($id) {
$allow_queue = FALSE; $allow_queue = FALSE;
} }
// Visitors can only see the image they submitted themselves, and no hidden stories
if ($queue) { if ($queue) {
if (!$is_admin && !$allow_queue) { if (!$allow_queue) {
header("HTTP/1.1 401 Access Denied"); header("HTTP/1.1 401 Access Denied");
return; return;
} }
$table = 'queue';
$hidden = "";
} else {
$table = 'xxx';
$hidden = $is_admin ? "" : " AND hidden IS NOT TRUE";
} }
$query = "SELECT img, mime FROM $table WHERE 1 AND ID = ".$db->real_escape_string($id)." LIMIT 0, 1"; $query = "SELECT img, mime FROM $table WHERE 1 AND ID = ".$db->real_escape_string($id).$hidden." LIMIT 0, 1";
$result = $db->query($query)or die("Query failed : ".$db->error); $result = $db->query($query)or die("Query failed : ".$db->error);
$row = $result->fetch_assoc(); $row = $result->fetch_assoc();
get_data.lib.php
+5 -5
View File
@@ -118,7 +118,7 @@ function get_count() {
} else { } else {
$count_query = "SELECT COUNT(*) FROM ".$table." WHERE 1"; $count_query = "SELECT COUNT(*) FROM ".$table." WHERE 1";
} }
if (!$is_admin && !$queue) if (!$is_admin)
$count_query .= " AND hidden IS NOT TRUE"; $count_query .= " AND hidden IS NOT TRUE";
$count_query .= " ;"; $count_query .= " ;";
@@ -152,7 +152,7 @@ function get_query($id = NULL) {
// If id= is defined, show the corresponding application only // If id= is defined, show the corresponding application only
if (is_numeric($id)) { if (is_numeric($id)) {
if (!$is_admin && !$queue) if (!$is_admin)
$query = "SELECT * FROM $table WHERE 1 AND hidden IS NOT TRUE AND id = ".$id." LIMIT 0, 1"; $query = "SELECT * FROM $table WHERE 1 AND hidden IS NOT TRUE AND id = ".$id." LIMIT 0, 1";
else else
$query = "SELECT * FROM $table WHERE 1 AND id = ".$id." LIMIT 0, 1"; $query = "SELECT * FROM $table WHERE 1 AND id = ".$id." LIMIT 0, 1";
@@ -165,13 +165,13 @@ function get_query($id = NULL) {
" OR date LIKE '%".$search."%'". " OR date LIKE '%".$search."%'".
" OR story LIKE '%".$search."%'". " OR story LIKE '%".$search."%'".
" )"; " )";
if (!$is_admin && !$queue) if (!$is_admin)
$query .= " AND hidden IS NOT TRUE"; $query .= " AND hidden IS NOT TRUE";
$query .= " ORDER BY ".$sort." " .$order." LIMIT " .$start." , ".$show." ;"; $query .= " ORDER BY ".$sort." " .$order." LIMIT " .$start." , ".$show." ;";
// Otherwise, fall back to default view // Otherwise, fall back to default view
} else { } else {
$query = "SELECT * FROM ".$table." WHERE 1"; $query = "SELECT * FROM ".$table." WHERE 1";
if (!$is_admin && !$queue) if (!$is_admin)
$query .= " AND hidden IS NOT TRUE"; $query .= " AND hidden IS NOT TRUE";
$query .= " ORDER BY ".$sort." " .$order." LIMIT " .$start." , ".$show." ;"; $query .= " ORDER BY ".$sort." " .$order." LIMIT " .$start." , ".$show." ;";
} }
@@ -349,7 +349,7 @@ function which_table($move = FALSE, $action = 'read') {
return 'queue'; return 'queue';
// Viewing // Viewing
} else if ($queue && ($is_admin || isset($_SESSION['allow_queue_image']))) { } else if ($queue && $is_admin) {
return 'queue'; return 'queue';
} else { } else {
return 'xxx'; return 'xxx';