Drupal
/
drupal
mirror of https://git.drupalcode.org/project/drupal.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

- Patch #881578 by Gábor Hojtsy, scor: solve SA-CORE-2010-002 issues.

merge-requests/26/head
Dries Buytaert 2010-08-20 01:21:14 +00:00
parent f8952b675c
commit 317b9b4e0c
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
modules/comment/comment.module
View File

@ -1398,7 +1398,7 @@ function comment_access($op, $comment) {
global $user; global $user;
if ($op == 'edit') { if ($op == 'edit') {
return ($user->uid && $user->uid == $comment->uid && user_access('edit own comments')) || user_access('administer comments'); return ($user->uid && $user->uid == $comment->uid && $comment->status == COMMENT_PUBLISHED && user_access('edit own comments')) || user_access('administer comments');
} }
} }

11
modules/file/file.module
View File

@ -125,9 +125,16 @@ function file_file_download($uri, $field_type = 'file') {
// Get the file record based on the URI. If not in the database just return. // Get the file record based on the URI. If not in the database just return.
$files = file_load_multiple(array(), array('uri' => $uri)); $files = file_load_multiple(array(), array('uri' => $uri));
if (count($files)) { if (count($files)) {
$file = reset($files); foreach ($files as $item) {
// Since some database servers sometimes use a case-insensitive comparison
// by default, double check that the filename is an exact match.
if ($item->uri === $uri) {
$file = $item;
break;
} }
else { }
}
if (!isset($file)) {
return; return;
} }