tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity
16 Commits 2 Branches 0 Tags
e881ddb458ea610888406b35f3251e1b084c78b6
Commit Graph
5 Commits
Author SHA1 Message Date
tim e881ddb458 Keep uploads outside the web root. 
save_uploaded_file() read, and prune_images() deleted, any path in the
"uploaded" POST field. Uploads now go to UPLOAD_DIR under a random name
that only the session knows.
 2026-09-25 21:31:47 +02:00
tim c85f54116c Use bound parameters for every query that takes user data. 
The queue image query took $id without quotes or a check, which allowed
SQL injection.
 2026-09-25 21:29:09 +02:00
tim 0e5e742210 Stop visitors from writing to the live table. 
save_data() trusted the action and id in the POST data. A visitor can
now only add a new story to the queue, and cannot delete.
 2026-09-25 21:25:43 +02:00
tim 00829a0c0d Port the code to PHP 8.5. 
Replace the short open tags and the removed functions (mcrypt, mysql_error,
salt-less crypt). Decode the reCAPTCHA reply as JSON, turn off mysqli
exceptions, drop stripslashes(), and default missing input values.
Fix the misplaced continue in prune_images().
 2026-09-25 21:18:58 +02:00
tim 7fc40728f5 Initial commit. 2013-05-17 23:38:44 +02:00