ここの情報は古いです。ご理解頂いた上でお取り扱いください。

Changeset 6762


Ignore:
Timestamp:
Apr 26, 2008, 11:51:12 PM (14 years ago)
Author:
ebihara
Message:

#2279:一部のアルバム関連アクションで、公開範囲設定・権限チェックを無視することができたのを修正

Location:
OpenPNE/trunk/webapp/modules/pc
Files:
11 edited

Legend:

Unmodified
Added
Removed

  • OpenPNE/trunk/webapp/modules/pc/do/h_album_edit_delete_image.php

    r6677 r6762  
    1616
    1717        // --- リクエスト変数
    18         $c_album_id = $requests['target_c_album_id'];
    1918        $c_album_image_id = $requests['target_c_album_image_id'];
    2019        // ----------
    2120
    2221        //--- 権限チェック
    23         $c_album = db_album_get_c_album4c_album_id($c_album_id);
     22        $c_album_image = db_album_image_get_c_album_image4id($c_album_image_id);
     23        $c_album = db_album_get_c_album4c_album_id($c_album_image['c_album_id']);
    2424        if ($c_album['c_member_id'] != $u) {
    2525            handle_kengen_error();
    2626        }
    2727
    28         $c_album_image = db_album_image_get_c_album_image4id($c_album_image_id);
    2928        db_album_image_data_delete($c_album_image['image_filename']);
    3029        db_album_delete_c_album_image($c_album_image_id);
    3130
    32         $p = array('target_c_album_id' => $c_album_id);
     31        $p = array('target_c_album_id' => $c_album_image['c_album_id']);
    3332        openpne_redirect('pc', 'page_fh_album', $p);
    3433    }

  • OpenPNE/trunk/webapp/modules/pc/do/h_album_image_edit_insert_c_album_image.php

    r6677 r6762  
    2626
    2727        // --- リクエスト変数
    28         $target_c_album_id = $requests['target_c_album_id'];
    2928        $target_c_album_image_id = $requests['target_c_album_image_id'];
    3029        $image_description = $requests['image_description'];
    … …  
    3433        $filename = '';
    3534        $c_album_image = db_album_image_get_c_album_image4id($target_c_album_image_id);
     35        $target_c_album_id = $c_album_image['c_album_id'];
    3636        $img_tmp_dir_path = OPENPNE_VAR_DIR . '/tmp/';
     37
     38        $c_album = db_album_get_c_album4c_album_id($target_c_album_id);
     39        if ($c_album['c_member_id'] != $u) {
     40            handle_kengen_error();
     41        }
    3742
    3843        // アルバム写真登録処理
    … …  
    4752        t_image_clear_tmp($sessid);
    4853
    49         db_album_update_c_album_image($target_c_album_image_id,  $filename, $image_description,$filesize_1);
     54        db_album_update_c_album_image($target_c_album_image_id,  $filename, $image_description, $filesize_1);
    5055
    5156        // c_albumの更新時間UPDATE

  • OpenPNE/trunk/webapp/modules/pc/page/h_album_image_delete_confirm.php

    r6677 r6762  
    1616
    1717        // --- リクエスト変数
    18         $target_c_album_id = $requests['target_c_album_id'];
    1918        $target_c_album_image_id = $requests['target_c_album_image_id'];
    2019        // ----------
     20
     21        $target_c_album_image = db_album_image_get_c_album_image4id($target_c_album_image_id);
     22        $target_c_album_id = $target_c_album_image['c_album_id'];
     23
     24        $album = db_album_get_c_album4c_album_id($target_c_album_id);
     25        if($album['c_member_id'] != $u){
     26            handle_kengen_error();
     27        }
    2128
    2229        // target が指定されていない
    … …  
    3239        $this->set('inc_navi', fetch_inc_navi("h"));
    3340
    34         $target_c_album_image = db_album_image_get_c_album_image4id($target_c_album_image_id);
    3541        $this->set('target_c_album_image',$target_c_album_image);
    3642       

  • OpenPNE/trunk/webapp/modules/pc/page/h_album_image_edit.php

    r6677 r6762  
    1616
    1717        // --- リクエスト変数
    18         $target_c_album_id = $requests['target_c_album_id'];
    1918        $target_c_album_image_id = $requests['target_c_album_image_id'];
    2019        $image_description = $requests['image_description'];
    … …  
    2625        }
    2726
     27        // アルバムの写真データ取得
     28        $c_album_image = db_album_image_get_c_album_image4id($target_c_album_image_id);
     29        $target_c_album_id = $c_album_image['c_album_id'];
     30
    2831        //アルバムデータ取得
    2932        $c_album = db_album_get_c_album4c_album_id($target_c_album_id);
    … …  
    3336        }
    3437       
    35         // アルバムの写真データ取得
    36         $c_album_iamge = db_album_image_get_c_album_image4id($target_c_album_image_id);
    37        
    3838        // target の写真が存在しない
    39         if(!$c_album_iamge){
     39        if(!$c_album_image){
    4040            openpne_redirect('pc', 'page_h_err_fh_album');
    4141        }
    4242       
    4343        if (!(is_null($image_description))) {
    44             $c_album_iamge['image_description'] = $image_description;
     44            $c_album_image['image_description'] = $image_description;
    4545        }
    4646       
    4747        $this->set('inc_navi', fetch_inc_navi('h'));
    48         $this->set('c_album_image', $c_album_iamge);
     48        $this->set('c_album_image', $c_album_image);
    4949        $this->set('target_c_album_id', $target_c_album_id);
    5050        $this->set('target_c_album_image_id', $target_c_album_image_id);

  • OpenPNE/trunk/webapp/modules/pc/page/h_album_image_edit_confirm.php

    r6677 r6762  
    2323
    2424        // --- リクエスト変数
    25         $target_c_album_id = $requests['target_c_album_id'];
    2625        $target_c_album_image_id = $requests['target_c_album_image_id'];
    2726        $image_description = $requests['image_description'];
    … …  
    3029        $sessid = session_id();
    3130        t_image_clear_tmp($sessid);
     31
     32        // アルバムの写真データ取得
     33        $c_album_image = db_album_image_get_c_album_image4id($target_c_album_image_id);
     34        $target_c_album_id = $c_album_image['c_album_id'];
     35
     36        //アルバムデータ取得
     37        $c_album = db_album_get_c_album4c_album_id($target_c_album_id);
     38        //--- 権限チェック
     39        if ($u != $c_album['c_member_id']) {
     40            handle_kengen_error();
     41        }
    3242
    3343        $upfiles = array(

  • OpenPNE/trunk/webapp/modules/pc/page/h_delete_album.php

    r6677 r6762  
    1717        // --- リクエスト変数
    1818        $target_c_album_id = $requests['target_c_album_id'];
     19
     20        $c_album = db_album_get_c_album4c_album_id($target_c_album_id);
     21        //--- 権限チェック
     22        if ($u != $c_album['c_member_id']) {
     23            handle_kengen_error();
     24        }
    1925       
    2026        $this->set('inc_navi', fetch_inc_navi('h'));

  • OpenPNE/trunk/webapp/modules/pc/validate/do/h_album_edit_delete_image.ini

    r6546 r6762  
    1 [target_c_album_id]
    2 type = "int"
    3 required = 1
    4 
    51[target_c_album_image_id]
    62type = "int"

  • OpenPNE/trunk/webapp/modules/pc/validate/do/h_album_image_edit_insert_c_album_image.ini

    r6546 r6762  
    11[target_c_album_image_id]
    2 type = "int"
    3 
    4 [target_c_album_id]
    52type = "int"
    63

  • OpenPNE/trunk/webapp/modules/pc/validate/page/h_album_image_delete_confirm.ini

    r6546 r6762  
    1 [target_c_album_id]
    2 type = "int"
    3 
    41[target_c_album_image_id]
    52type = "int"

  • OpenPNE/trunk/webapp/modules/pc/validate/page/h_album_image_edit.ini

    r6546 r6762  
    1 [target_c_album_id]
    2 type = "int"
    3 required = 0
    4 min = 1
    5 
    61[target_c_album_image_id]
    72type = "int"

  • OpenPNE/trunk/webapp/modules/pc/validate/page/h_album_image_edit_confirm.ini

    r6546 r6762  
    1 [target_c_album_id]
    2 type = "int"
    3 required = 0
    4 min = 1
    5 
    61[target_c_album_image_id]
    72type = "int"
Note: See TracChangeset for help on using the changeset viewer.