tim
c85f54116c
The queue image query took $id without quotes or a check, which allowed SQL injection.
69 lines
1.6 KiB
PHP
69 lines
1.6 KiB
PHP
<?php
|
|
require_once('./open_db.lib.php');
|
|
open_db('open');
|
|
require_once('./get_data.lib.php');
|
|
$queue = get_queue();
|
|
if ($queue) session_cache_limiter('nocache');
|
|
else session_cache_limiter('none');
|
|
session_set_cookie_params(strtotime('+1 year'), '/', '.xxx.org.za', TRUE, TRUE);
|
|
session_start();
|
|
if (isset($_SESSION['editor'])) {
|
|
$is_admin = TRUE;
|
|
$username = $_SESSION['editor'];
|
|
} else {
|
|
$is_admin = FALSE;
|
|
}
|
|
|
|
display_img(get_id());
|
|
|
|
function display_img($id) {
|
|
global $db, $is_admin, $queue;
|
|
$queue = get_queue();
|
|
|
|
if ((isset($_SESSION['allow_queue_image']) &&
|
|
$_SESSION['allow_queue_image'] == $id) ||
|
|
$is_admin) {
|
|
$allow_queue = TRUE;
|
|
} else {
|
|
$allow_queue = FALSE;
|
|
}
|
|
|
|
// Visitors can only see the image they submitted themselves, and no hidden stories
|
|
if ($queue) {
|
|
if (!$allow_queue) {
|
|
header("HTTP/1.1 401 Access Denied");
|
|
return;
|
|
}
|
|
$table = 'queue';
|
|
$hidden = "";
|
|
} else {
|
|
$table = 'xxx';
|
|
$hidden = $is_admin ? "" : " AND hidden IS NOT TRUE";
|
|
}
|
|
|
|
$query = "SELECT img, mime FROM $table WHERE 1 AND ID = ?".$hidden." LIMIT 0, 1";
|
|
$result = $db->execute_query($query, array((int)$id)) or die("Query failed : ".$db->error);
|
|
|
|
$row = $result->fetch_assoc();
|
|
if ($row) {
|
|
$img_data = $row['img'];
|
|
$mimetype = $row['mime'];
|
|
|
|
ob_start();
|
|
print $img_data;
|
|
$size = ob_get_length();
|
|
$img = ob_get_clean();
|
|
|
|
header("Content-type: $mimetype");
|
|
header("Content-length: $size");
|
|
print $img;
|
|
|
|
} else {
|
|
header("HTTP/1.1 404 Not Found");
|
|
return;
|
|
}
|
|
$result->close();
|
|
}
|
|
open_db('close');
|
|
?>
|