myron/parkerslingshotrentals
1
0
Fork 0
mirror of https://github.com/myronblair/parkerslingshotrentals synced 2026-07-28 00:52:54 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix security issues from code review: remove plaintext password comment, enable TLS verification, harden booking ref entropy, fix XSS/injection in signature emails, fix broken waiver link, consolidate duplicated auth/file-serving logic, add missing document view links, sync schema.sql with live DB

Browse Source
This commit is contained in:
Myron Blair
2026-07-04 14:01:33 -05:00
parent 72ba4743f9
commit d12baebcbc
8 changed files with 75 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
view-doc.php
+6 -17
View File
@@ -1,15 +1,8 @@
<?php
require_once __DIR__ . '/db.php';
function _verifyToken(string $token): bool {
if (!preg_match('/^[a-f0-9]{64}$/', $token)) return false;
$stmt = db()->prepare("SELECT token FROM admin_tokens WHERE token=? AND expires_at > NOW()");
$stmt->execute([$token]);
return (bool)$stmt->fetch();
}
$token = preg_replace('/[^a-f0-9]/', '', $_GET['_t'] ?? '');
if (!_verifyToken($token)) {
if (!verifyAdminToken($token)) {
http_response_code(403);
header('Content-Type: text/plain');
exit('Unauthorized — please log in to the admin panel first.');
@@ -34,25 +27,21 @@ if (!$row || !$row['file_path']) {
exit('Document not found.');
}
$base = realpath(__DIR__ . '/uploads');
$path = realpath(__DIR__ . '/' . $row['file_path']);
if (!$path || !$base || strpos($path, $base . DIRECTORY_SEPARATOR) !== 0) {
$path = resolveUploadPath(__DIR__, $row['file_path']);
if (!$path) {
http_response_code(404);
header('Content-Type: text/plain');
exit('File not found.');
}
$finfo = new finfo(FILEINFO_MIME_TYPE);
$mime = $finfo->file($path);
$allowed = ['image/jpeg' => 'jpg', 'image/png' => 'png', 'application/pdf' => 'pdf'];
if (!isset($allowed[$mime])) {
$mime = detectAllowedMime($path);
if (!$mime) {
http_response_code(403);
header('Content-Type: text/plain');
exit('Invalid file type.');
}
$fname = $type . '-' . $ref . '.' . $allowed[$mime];
$fname = $type . '-' . $ref . '.' . ALLOWED_DOC_MIMES[$mime];
header('Content-Type: ' . $mime);
header('Content-Disposition: inline; filename="' . $fname . '"');
header('Content-Length: ' . filesize($path));