tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity
16 Commits 2 Branches 0 Tags
e881ddb458ea610888406b35f3251e1b084c78b6
Commit Graph
5 Commits
Author SHA1 Message Date
tim e881ddb458 Keep uploads outside the web root. 
save_uploaded_file() read, and prune_images() deleted, any path in the
"uploaded" POST field. Uploads now go to UPLOAD_DIR under a random name
that only the session knows.
 2026-09-25 21:31:47 +02:00
tim c85f54116c Use bound parameters for every query that takes user data. 
The queue image query took $id without quotes or a check, which allowed
SQL injection.
 2026-09-25 21:29:09 +02:00
tim cda0602c95 Show the queue and hidden stories to editors only. 
With allow_queue_image in the session, queue=1 showed a visitor the whole
queue and the hidden stories. display.php now shows a visitor only the
image they submitted.
 2026-09-25 21:26:32 +02:00
tim 00829a0c0d Port the code to PHP 8.5. 
Replace the short open tags and the removed functions (mcrypt, mysql_error,
salt-less crypt). Decode the reCAPTCHA reply as JSON, turn off mysqli
exceptions, drop stripslashes(), and default missing input values.
Fix the misplaced continue in prune_images().
 2026-09-25 21:18:58 +02:00
tim 7fc40728f5 Initial commit. 2013-05-17 23:38:44 +02:00