fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-07 02:31:40 +09:00
Code Issues Projects Releases Packages Wiki Activity

Fix #681 #788 exposure of secret comments and files in integration search

Browse source
This commit is contained in:
Kijin Sung 2017-05-30 15:18:39 +09:00
parent 9756261a1a
commit d83ccd67aa
4 changed files with 30 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
modules/comment/comment.model.php
View file

@ -685,6 +685,10 @@ class commentModel extends comment
$args->page_count = $obj->page_count ? $obj->page_count : 10; $args->page_count = $obj->page_count ? $obj->page_count : 10;
$args->s_module_srl = $obj->module_srl; $args->s_module_srl = $obj->module_srl;
$args->exclude_module_srl = $obj->exclude_module_srl; $args->exclude_module_srl = $obj->exclude_module_srl;
if ($obj->is_secret)
{
$args->s_is_secret = $obj->is_secret;
}
// check if module is using comment validation system // check if module is using comment validation system
$oCommentController = getController("comment"); $oCommentController = getController("comment");

5
modules/file/file.admin.model.php
View file

@ -80,6 +80,11 @@ class fileAdminModel extends file
$args->page_count = $obj->page_count?$obj->page_count:10; $args->page_count = $obj->page_count?$obj->page_count:10;
$args->s_module_srl = $obj->module_srl; $args->s_module_srl = $obj->module_srl;
$args->exclude_module_srl = $obj->exclude_module_srl; $args->exclude_module_srl = $obj->exclude_module_srl;
if(toBool($obj->exclude_secret))
{
$args->document_status = 'PUBLIC';
$args->comment_is_secret = 'N';
}
// Execute the file.getFileList query // Execute the file.getFileList query
$output = executeQuery('file.getFileList', $args, $columnList); $output = executeQuery('file.getFileList', $args, $columnList);
// Return if no result or an error occurs // Return if no result or an error occurs

20
modules/file/queries/getFileList.xml
View file

@ -1,11 +1,21 @@
<query id="getFileList" action="select"> <query id="getFileList" action="select">
<tables> <tables>
<table name="files" alias="files" /> <table name="files" alias="files" />
<table name="member" alias="member" type="left join"> <table name="member" type="left join">
<conditions> <conditions>
<condition operation="equal" column="files.member_srl" default="member.member_srl" /> <condition operation="equal" column="files.member_srl" default="member.member_srl" />
</conditions> </conditions>
</table> </table>
<table name="documents" type="left join">
<conditions>
<condition operation="equal" column="files.upload_target_srl" default="documents.document_srl" />
</conditions>
</table>
<table name="comments" type="left join">
<conditions>
<condition operation="equal" column="files.upload_target_srl" default="comments.comment_srl" />
</conditions>
</table>
</tables> </tables>
<columns> <columns>
<column name="files.*" /> <column name="files.*" />
@ -16,6 +26,14 @@
<condition operation="equal" column="files.isvalid" var="isvalid" pipe="and" /> <condition operation="equal" column="files.isvalid" var="isvalid" pipe="and" />
<condition operation="equal" column="files.direct_download" var="direct_download" pipe="and" /> <condition operation="equal" column="files.direct_download" var="direct_download" pipe="and" />
<condition operation="below" column="files.regdate" var="regdate_before" pipe="and" /> <condition operation="below" column="files.regdate" var="regdate_before" pipe="and" />
<group pipe="and">
<condition operation="equal" column="documents.status" var="document_status" />
<condition operation="null" column="documents.status" pipe="or" />
</group>
<group pipe="and">
<condition operation="equal" column="comments.is_secret" var="comment_is_secret" />
<condition operation="null" column="comments.is_secret" pipe="or" />
</group>
<group pipe="and"> <group pipe="and">
<condition operation="like" column="files.source_filename" var="s_filename" pipe="or" /> <condition operation="like" column="files.source_filename" var="s_filename" pipe="or" />
<condition operation="more" column="files.file_size" var="s_filesize_more" pipe="or" /> <condition operation="more" column="files.file_size" var="s_filesize_more" pipe="or" />

2
modules/integration_search/integration_search.model.php
View file

@ -94,6 +94,7 @@ class integration_searchModel extends module
$args->page_count = 10; $args->page_count = 10;
$args->search_target = 'content'; $args->search_target = 'content';
$args->search_keyword = $search_keyword; $args->search_keyword = $search_keyword;
$args->is_secret = 'N';
$args->sort_index = 'list_order'; $args->sort_index = 'list_order';
$args->order_type = 'asc'; $args->order_type = 'asc';
// Get a list of documents // Get a list of documents
@ -167,6 +168,7 @@ class integration_searchModel extends module
$args->order_type = 'desc'; $args->order_type = 'desc';
$args->isvalid = 'Y'; $args->isvalid = 'Y';
$args->direct_download = $direct_download=='Y'?'Y':'N'; $args->direct_download = $direct_download=='Y'?'Y':'N';
$args->exclude_secret = 'Y';
// Get a list of documents // Get a list of documents
$oFileAdminModel = getAdminModel('file'); $oFileAdminModel = getAdminModel('file');
$output = $oFileAdminModel->getFileList($args); $output = $oFileAdminModel->getFileList($args);