flashii/misuzu
flashii/misuzu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bypass avatar and background 404 on profiles when admin, closes #95.

Browse source
This commit is contained in:
flash 2019-01-22 15:48:26 +01:00
parent d6eebeee75
commit f1f20eebe2
1 changed files with 20 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
public/profile.php
View file

@ -8,7 +8,16 @@ switch ($mode) {
case 'avatar':
$userId = (int)($_GET['u'] ?? 0);
if (user_warning_check_expiration($userId, MSZ_WARN_BAN) > 0) {
if (user_warning_check_expiration($userId, MSZ_WARN_BAN) > 0 && !(
parse_url($_SERVER['HTTP_REFERER'], PHP_URL_PATH) === '/profile.php'
&& perms_check(
perms_get_user(
MSZ_PERMS_USER,
user_session_current('user_id', 0)
),
MSZ_PERM_USER_MANAGE_USERS
)
)) {
$avatarFilename = build_path(
MSZ_ROOT,
config_get_default('public/images/banned-avatar.png', 'Avatar', 'banned_path')
@ -60,7 +69,16 @@ switch ($mode) {
case 'background':
$userId = (int)($_GET['u'] ?? 0);
if (user_warning_check_expiration($userId, MSZ_WARN_BAN) > 0) {
if (user_warning_check_expiration($userId, MSZ_WARN_BAN) > 0 && !(
parse_url($_SERVER['HTTP_REFERER'], PHP_URL_PATH) === '/profile.php'
&& perms_check(
perms_get_user(
MSZ_PERMS_USER,
user_session_current('user_id', 0)
),
MSZ_PERM_USER_MANAGE_USERS
)
)) {
echo render_error(404);
break;
}