cvs: docweb /www/rfc rfc-proposal-edit.php rfc-proposal-show.php

vincent Thu Aug 19 08:29:33 2004 EDT Modified files: /docweb/www/rfc rfc-proposal-edit.php rfc-proposal-show.php Log: File upload related fixes http://cvs.php.net/diff.php/docweb/www/rfc/rfc-proposal-edit.php?r1=1.2&r2=1.3&ty=u Index: docweb/www/rfc/rfc-proposal-edit.php diff -u docweb/www/rfc/rfc-proposal-edit.php:1.2 docweb/www/rfc/rfc-proposal-edit.php:1.3 --- docweb/www/rfc/rfc-proposal-edit.php:1.2 Thu Aug 19 06:30:53 2004 +++ docweb/www/rfc/rfc-proposal-edit.php Thu Aug 19 08:29:32 2004 @@ -22,7 +22,7 @@ * @author Daniel Convissor <danielc@php.net> * @copyright Copyright (c) 1997-2004 The PHP Group * @license http://www.php.net/license/3_0.txt PHP License - * @version $Id: rfc-proposal-edit.php,v 1.2 2004/08/19 10:30:53 vincent Exp $ + * @version $Id: rfc-proposal-edit.php,v 1.3 2004/08/19 12:29:32 vincent Exp $ */ /** @@ -62,8 +62,9 @@ strpos($_GET['delete'], "..") === FALSE && (($_COOKIE['PEAR_USER'] == $proposal->user_handle) || is_admin())) { $hash = substr($_GET['delete'], -32); + $file = substr($_GET['delete'], 0, -32); if (!file_exists('./../../files/' . $hash)) { - report_error('File does not exists'); + report_error('File ' . htmlspecialchars(stripslashes($file)) . ' does not exists'); } else { $proposal->pkg_filehash = str_replace('|' . $_GET['delete'], '', $proposal->pkg_filehash); @@ -75,7 +76,7 @@ // this might need some more security unlink('./../../files/' . $hash); - report_success('File deleted!'); + report_success('File ' . htmlspecialchars(stripslashes($file)) . ' deleted!'); } } @@ -176,14 +177,14 @@ $form->addElement('static', '', '', 'You have uploaded '.$filecount.' file(s). To delete, click on the file'); if (!empty($proposal->pkg_filehash)) { - $list = explode("|", htmlspecialchars($proposal->pkg_filehash)); + $list = explode("|", htmlspecialchars(stripslashes($proposal->pkg_filehash))); foreach ($list as $hash) { if ($hash == '') continue; $file = substr($hash, 0, -32); - $form->addElement('static', '', '', '<li><a href="?id='.$id.'&delete='.$hash.'">'.$file.'</a></li>'); + $form->addElement('static', '', '', '<li><a href="?id='.$id.'&delete='.urlencode($hash).'">'.$file.'</a></li>'); } } http://cvs.php.net/diff.php/docweb/www/rfc/rfc-proposal-show.php?r1=1.2&r2=1.3&ty=u Index: docweb/www/rfc/rfc-proposal-show.php diff -u docweb/www/rfc/rfc-proposal-show.php:1.2 docweb/www/rfc/rfc-proposal-show.php:1.3 --- docweb/www/rfc/rfc-proposal-show.php:1.2 Thu Aug 19 06:30:53 2004 +++ docweb/www/rfc/rfc-proposal-show.php Thu Aug 19 08:29:32 2004 @@ -19,7 +19,7 @@ * @author Daniel Convissor <danielc@php.net> * @copyright Copyright (c) 1997-2004 The PHP Group * @license http://www.php.net/license/3_0.txt PHP License - * @version $Id: rfc-proposal-show.php,v 1.2 2004/08/19 10:30:53 vincent Exp $ + * @version $Id: rfc-proposal-show.php,v 1.3 2004/08/19 12:29:32 vincent Exp $ */ /** @@ -176,7 +176,7 @@ $file = substr($hash, 0, -32); $hash = substr($hash, -32); echo ' <li>'; - print_link('?get=' . $hash, htmlspecialchars($file)); + print_link('?get=' . $hash, htmlspecialchars(stripslashes($file))); echo "</li>\n"; } }