Changeset 3431

Timestamp:

Jul 18, 2007, 7:29:44 PM (14 years ago)

Author:

ogawa

Message:

#933:不正ID指定でも管理画面のアップロードファイル削除ページにアクセス可

Location:

OpenPNE/branches/stable-2.8.x/webapp

Files:

• lib/db/file.php (modified) (1 diff)
• modules/admin/do/delete_c_file4c_file_id.php (modified) (1 diff)
• modules/admin/page/delete_c_file_confirm.php (modified) (1 diff)

OpenPNE/branches/stable-2.8.x/webapp/lib/db/file.php

@@ -15 +15 @@
     $params = array(intval($c_file_id));
     $file = db_get_row($sql, $params);
-    $file['size'] = strlen($file['bin']);
+    if ($file) {
+        $file['size'] = strlen($file['bin']);
+    }
     return $file;
 }

OpenPNE/branches/stable-2.8.x/webapp/modules/admin/do/delete_c_file4c_file_id.php

@@ -15 +15 @@
 
         $c_file = db_file_c_file4c_file_id($requests['target_c_file_id']);
+        if (!$c_file) {
+            admin_client_redirect('top', '指定されたファイルは存在しません');
+        }
+
         db_file_delete_c_file($c_file['filename']);
         db_admin_delete_c_file_link4filename($c_file['filename']);

OpenPNE/branches/stable-2.8.x/webapp/modules/admin/page/delete_c_file_confirm.php

@@ -17 +17 @@
 
         $v['c_file'] = db_file_c_file4c_file_id($requests['target_c_file_id']);
+        if (!$v['c_file']) {
+            admin_client_redirect('top', '指定されたファイルは存在しません');
+        }
 
         $this->set($v);