XerXes
05-13-2005, 02:49 PM
I tend to upload a bunch of images to my photoblog at a time and then set the appropriate posting times in the admin interface. This should make sure, that the images would only be seen, when I set the to. However, one of my friends discovered this bug:
If you click on any of the old images, the url will change to something like http://fotoblog.xerxes.dk/index.php?showimage=xx, where xx is the id of the image. He found out that you can easily alter the id into a bigger number and see the newer images.
I solved the bug by replacing line 135 with this:
$row = sql_array("select * from ".$pixelpost_db_prefix."pixelpost where (id='".$_GET['showimage']."') AND datetime<='$cdate'");
If you click on any of the old images, the url will change to something like http://fotoblog.xerxes.dk/index.php?showimage=xx, where xx is the id of the image. He found out that you can easily alter the id into a bigger number and see the newer images.
I solved the bug by replacing line 135 with this:
$row = sql_array("select * from ".$pixelpost_db_prefix."pixelpost where (id='".$_GET['showimage']."') AND datetime<='$cdate'");