summaryrefslogtreecommitdiffstats
path: root/mbbsd
diff options
context:
space:
mode:
authorin2 <in2@63ad8ddf-47c3-0310-b6dd-a9e9d9715204>2005-12-13 09:49:03 +0800
committerin2 <in2@63ad8ddf-47c3-0310-b6dd-a9e9d9715204>2005-12-13 09:49:03 +0800
commitabdd055a365bc6b5a19cdbfeec90f0f92731cb63 (patch)
tree70690c23071ca6c0ba9a82af09af911f07e497cb /mbbsd
parent13674435d74c2e66f08b06f8832ef59275f1a3ac (diff)
downloadpttbbs-abdd055a365bc6b5a19cdbfeec90f0f92731cb63.tar
pttbbs-abdd055a365bc6b5a19cdbfeec90f0f92731cb63.tar.gz
pttbbs-abdd055a365bc6b5a19cdbfeec90f0f92731cb63.tar.bz2
pttbbs-abdd055a365bc6b5a19cdbfeec90f0f92731cb63.tar.lz
pttbbs-abdd055a365bc6b5a19cdbfeec90f0f92731cb63.tar.xz
pttbbs-abdd055a365bc6b5a19cdbfeec90f0f92731cb63.tar.zst
pttbbs-abdd055a365bc6b5a19cdbfeec90f0f92731cb63.zip
security fix: users could forward hidden articles in board announce
git-svn-id: http://opensvn.csie.org/pttbbs/trunk/pttbbs@3253 63ad8ddf-47c3-0310-b6dd-a9e9d9715204
Diffstat (limited to 'mbbsd')
-rw-r--r--mbbsd/announce.c21
1 files changed, 13 insertions, 8 deletions
diff --git a/mbbsd/announce.c b/mbbsd/announce.c
index af79c1b0..f294140b 100644
--- a/mbbsd/announce.c
+++ b/mbbsd/announce.c
@@ -1163,15 +1163,20 @@ a_menu(const char *maintitle, const char *path, int lastlevel, char *trans_buffe
case 'F':
case 'U':
- snprintf(fname, sizeof(fname),
- "%s/%s", path, me.header[me.now - me.page].filename);
- if (me.now < me.num && HasUserPerm(PERM_LOGINOK) && dashf(fname)) {
- a_forward(path, &me.header[me.now - me.page], ch /* == 'U' */ );
- /* By CharlieL */
- } else
- vmsg("無法轉寄此項目");
+ if (me.now < me.num) {
+ fileheader_t *fhdr = &me.header[me.now - me.page];
+ if (!isvisible_man(&me))
+ break;
+ snprintf(fname, sizeof(fname),
+ "%s/%s", path, fhdr->filename);
+ if (HasUserPerm(PERM_LOGINOK) && dashf(fname)) {
+ a_forward(path, fhdr, ch /* == 'U' */ );
+ /* By CharlieL */
+ } else
+ vmsg("無法轉寄此項目");
+ me.page = 9999;
+ }
- me.page = 9999;
break;
#ifdef BLOG