Find Jobs
Hire Freelancers

Need PHP SQL Code Snippet / Patch for website.

$10-30 USD

Terminado
Publicado hace alrededor de 8 años

$10-30 USD

Pagado a la entrega
I have a PHP script running with mysql 4.5. I need to fix a small security hole. The PHP program handles file uploads from users. A user signs up and is assigned a primary ID number in the database. Users upload files through a CMS to the site administrator. Each time a user send a file, the file and its details are saved in a separate database table. For clarity, user details are saved to one table, and the files they upload are saved, along with notes etc, to another table. A user can log into their user control panel and view a page that lists the details about the users upload. Here's the problem. When a user is logged in and clicks the details of their own uploaded file via the user control panel provided in the PHP script, the URL in the address bar reveals the ID number of the file uploaded. That's OK. But, if the user changes the ID number in the browser (add a number to it or take away a number), they will then view files uploaded by other users. This is undesirable. Currently the CMS simply checks to be certain users are logged in with a valid account but doesn't check to see which files the user is allowed to view. The table that the file details are saved to contains the unique file ID and the user ID. I want the system to check to be sure the user viewing a file is the one that the file belongs to. If not, it should give them an error.
ID del proyecto: 10393521

Información sobre el proyecto

3 propuestas
Proyecto remoto
Activo hace 8 años

¿Buscas ganar dinero?

Beneficios de presentar ofertas en Freelancer

Fija tu plazo y presupuesto
Cobra por tu trabajo
Describe tu propuesta
Es gratis registrarse y presentar ofertas en los trabajos
Adjudicado a:
Avatar del usuario
Hello, If you provide me ftp or cpanel details, I can fix this problem immediately. Basicly, I'll modify sql query. It should read: file_id=X AND user_id=Y.. I think it's file_id=X now and causing problem. I'm online now. Thank you v much.
$25 USD en 1 día
4,9 (393 comentarios)
7,7
7,7
3 freelancers están ofertando un promedio de $36 USD por este trabajo
Avatar del usuario
Dear sir I understand your requirement please message me to discuss further
$30 USD en 0 día
4,9 (16 comentarios)
4,7
4,7

Sobre este cliente

Bandera de UNITED STATES
Mishawaka, United States
5,0
94
Forma de pago verificada
Miembro desde oct 1, 2006

Verificación del cliente

¡Gracias! Te hemos enviado un enlace para reclamar tu crédito gratuito.
Algo salió mal al enviar tu correo electrónico. Por favor, intenta de nuevo.
Usuarios registrados Total de empleos publicados
Freelancer ® is a registered Trademark of Freelancer Technology Pty Limited (ACN 142 189 759)
Copyright © 2024 Freelancer Technology Pty Limited (ACN 142 189 759)
Cargando visualización previa
Permiso concedido para Geolocalización.
Tu sesión de acceso ha expirado y has sido desconectado. Por favor, inica sesión nuevamente.