Changeset 1121 for trunk/smf/Sources/Display.php

Timestamp:

03/29/10 15:37:29 (2 years ago)

Author:

bogdan2412

Message:

Updated with changes from live.

• Updated SMF to 1.1.11
• Added Summify to site and forum
• Small change to job detail view

File:

• trunk/smf/Sources/Display.php (modified) (4 diffs)

trunk/smf/Sources/Display.php

@@ -6 +6 @@
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.9                                           *
+* Software Version:           SMF 1.1.11                                          *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
 * Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
@@ -929 +929 @@
 function Download()
 {
-        global $txt, $modSettings, $db_prefix, $user_info, $scripturl, $context, $sourcedir;
+        global $txt, $modSettings, $db_prefix, $user_info, $scripturl, $context, $sourcedir, $topic;
 
         $context['no_last_modified'] = true;
@@ -952 +952 @@
         else
         {
+                // This checks only the current board for $board/$topic's permissions.
                 isAllowedTo('view_attachments');
 
                 // Make sure this attachment is on this board.
+                // NOTE: We must verify that $topic is the attachment's topic, or else the permission check above is broken.
                 $request = db_query("
                         SELECT a.filename, a.ID_ATTACH, a.attachmentType, a.file_hash
@@ -961 +963 @@
                                 AND $user_info[query_see_board]
                                 AND m.ID_MSG = a.ID_MSG
+                                AND m.ID_TOPIC = $topic
                                 AND a.ID_ATTACH = $_REQUEST[attach]
                         LIMIT 1", __FILE__, __LINE__);