tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Keep uploads outside the web root.

Browse Source 
save_uploaded_file() read, and prune_images() deleted, any path in the
"uploaded" POST field. Uploads now go to UPLOAD_DIR under a random name
that only the session knows.
This commit is contained in:
tim
2026-09-25 21:31:47 +02:00
parent c85f54116c
commit e881ddb458
7 changed files with 104 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
publish/write.inc.php
+1 -1
View File
@@ -60,7 +60,7 @@ echo (isset($story) ? $story : '')
<?php
if (isset($file_src) || isset($img)) {
if (isset($file_src)) {
echo ' <input type="hidden" id="uploaded" name="uploaded" value="'.$file_src.'" />';
echo ' <input type="hidden" id="uploaded" name="uploaded" value="pending" />';
} else {
echo ' <input type="hidden" id="uploaded" name="uploaded" value="'.$id.'" />';
}