AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-03-11 00:04:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix potential sql injection in delete_file if param add_location was also specified - post.php

Browse Source
This commit is contained in:
Marcus Hill
2022-03-28 20:45:31 +01:00
parent d83906508d
commit 4ba313f752
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
post.php
View File

@@ -6804,6 +6804,7 @@ if(isset($_GET['delete_file'])){
$sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id AND company_id = $session_company_id"); $sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id AND company_id = $session_company_id");
$row = mysqli_fetch_array($sql_file); $row = mysqli_fetch_array($sql_file);
$client_id = $row['file_client_id']; $client_id = $row['file_client_id'];
$file_name = $row['file_name'];
$file_reference_name = $row['file_reference_name']; $file_reference_name = $row['file_reference_name'];
unlink("uploads/clients/$session_company_id/$client_id/$file_reference_name"); unlink("uploads/clients/$session_company_id/$client_id/$file_reference_name");