AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-05 07:07:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Claim shared item views atomically and log guest audit IPs

Browse Source
This commit is contained in:
johnnyq
2026-07-27 20:58:37 -04:00
parent b555a300bc
commit 70d165e8bc
6 changed files with 194 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
guest/guest_view_item.php
View File

@@ -128,6 +128,14 @@ if ($item_type == "Document") {
exit();
}
// Claim the view before any content is disclosed
if (!claimSharedItemView($item_id)) {
echo "<div class='alert alert-danger'>Item cannot be viewed at this time. Check with the person that sent you this link to ensure it is correct and has not expired.</div>";
require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/footer.php';
exit();
}
$doc_title = escapeHtml($doc_row['document_name']);
$doc_title_escaped = escapeSql($doc_row['document_name']);
$doc_content = $purifier->purify($doc_row['document_content']);
@@ -135,10 +143,6 @@ if ($item_type == "Document") {
echo "<h3>$doc_title</h3>";
echo "<div class='prettyContent'>$doc_content</div>";
// Update document view count
$new_item_views = $item_views + 1;
mysqli_query($mysqli, "UPDATE shared_items SET item_views = $new_item_views WHERE item_id = $item_id");
// Logging
$name = mysqli_real_escape_string($mysqli, $doc_title);
logAudit("Share", "View", "Viewed shared $item_type $doc_title_escaped via link", $client_id);
@@ -176,6 +180,14 @@ if ($item_type == "Document") {
exit();
}
// Claim the view before the credential is decrypted or rendered
if (!claimSharedItemView($item_id)) {
echo "<div class='alert alert-danger'>Item cannot be viewed at this time. Check with the person that sent you this link to ensure it is correct and has not expired.</div>";
require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/footer.php';
exit();
}
$credential_id = intval($credential_row['credential_id']);
$credential_name = escapeHtml($credential_row['credential_name']);
$credential_uri = escapeHtml($credential_row['credential_uri']);
@@ -254,10 +266,6 @@ if ($item_type == "Document") {
<?php
// Update credential view count
$new_item_views = $item_views + 1;
mysqli_query($mysqli, "UPDATE shared_items SET item_views = $new_item_views WHERE item_id = $item_id");
// Logging
$name = escapeSql($credential_row['credential_name']);
logAudit("Share", "View", "Viewed shared $item_type $name via link", $client_id);