fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-04-25 13:22:16 +09:00
Code Issues Projects Releases Packages Wiki Activity

Fix #681 #788 exposure of secret comments and files in integration search

Browse source
This commit is contained in:
Kijin Sung 2017-05-30 15:18:39 +09:00
parent 9756261a1a
commit d83ccd67aa
4 changed files with 30 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
modules/file/file.admin.model.php
View file

@ -80,6 +80,11 @@ class fileAdminModel extends file
$args->page_count = $obj->page_count?$obj->page_count:10;
$args->s_module_srl = $obj->module_srl;
$args->exclude_module_srl = $obj->exclude_module_srl;
if(toBool($obj->exclude_secret))
{
$args->document_status = 'PUBLIC';
$args->comment_is_secret = 'N';
}
// Execute the file.getFileList query
$output = executeQuery('file.getFileList', $args, $columnList);
// Return if no result or an error occurs

20
modules/file/queries/getFileList.xml
View file

@ -1,11 +1,21 @@
<query id="getFileList" action="select">
<tables>
<table name="files" alias="files" />
<table name="member" alias="member" type="left join">
<table name="member" type="left join">
<conditions>
<condition operation="equal" column="files.member_srl" default="member.member_srl" />
</conditions>
</table>
<table name="documents" type="left join">
<conditions>
<condition operation="equal" column="files.upload_target_srl" default="documents.document_srl" />
</conditions>
</table>
<table name="comments" type="left join">
<conditions>
<condition operation="equal" column="files.upload_target_srl" default="comments.comment_srl" />
</conditions>
</table>
</tables>
<columns>
<column name="files.*" />
@ -16,6 +26,14 @@
<condition operation="equal" column="files.isvalid" var="isvalid" pipe="and" />
<condition operation="equal" column="files.direct_download" var="direct_download" pipe="and" />
<condition operation="below" column="files.regdate" var="regdate_before" pipe="and" />
<group pipe="and">
<condition operation="equal" column="documents.status" var="document_status" />
<condition operation="null" column="documents.status" pipe="or" />
</group>
<group pipe="and">
<condition operation="equal" column="comments.is_secret" var="comment_is_secret" />
<condition operation="null" column="comments.is_secret" pipe="or" />
</group>
<group pipe="and">
<condition operation="like" column="files.source_filename" var="s_filename" pipe="or" />
<condition operation="more" column="files.file_size" var="s_filesize_more" pipe="or" />