AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-02-28 10:54:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix: Authenticated users can craft a POST request to delete any file on the webserver. Thank you @

Browse Source 
bhopkins0
This commit is contained in:
johnnyq
2023-05-12 15:24:57 -04:00
parent 51ee479130
commit e67a75805c
7 changed files with 30 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
client_location_edit_modal.php
View File

@@ -10,7 +10,7 @@
<form action="post.php" method="post" enctype="multipart/form-data" autocomplete="off">
<input type="hidden" name="location_id" value="<?php echo $location_id; ?>">
<input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
<input type="hidden" name="existing_file_name" value="<?php echo $location_photo; ?>">
<div class="modal-body bg-white">
<ul class="nav nav-pills nav-justified mb-3">