Need PHP SQL Code Snippet / Patch for website.

Completed Posted 7 years ago Paid on delivery
Completed Paid on delivery

I have a PHP script running with mysql 4.5. I need to fix a small security hole.

The PHP program handles file uploads from users. A user signs up and is assigned a primary ID number in the database. Users upload files through a CMS to the site administrator. Each time a user send a file, the file and its details are saved in a separate database table.

For clarity, user details are saved to one table, and the files they upload are saved, along with notes etc, to another table.

A user can log into their user control panel and view a page that lists the details about the users upload.

Here's the problem. When a user is logged in and clicks the details of their own uploaded file via the user control panel provided in the PHP script, the URL in the address bar reveals the ID number of the file uploaded. That's OK. But, if the user changes the ID number in the browser (add a number to it or take away a number), they will then view files uploaded by other users. This is undesirable.

Currently the CMS simply checks to be certain users are logged in with a valid account but doesn't check to see which files the user is allowed to view.

The table that the file details are saved to contains the unique file ID and the user ID. I want the system to check to be sure the user viewing a file is the one that the file belongs to. If not, it should give them an error.

PHP Software Architecture

Project ID: #10393521

About the project

3 proposals Remote project Active 7 years ago

Awarded to:

uhjk

Hello, If you provide me ftp or cpanel details, I can fix this problem immediately. Basicly, I'll modify sql query. It should read: file_id=X AND user_id=Y.. I think it's file_id=X now and causing problem. I'm online More

$25 USD in 1 day
(393 Reviews)
7.7

3 freelancers are bidding on average $36 for this job

abhi143u11

Dear sir I understand your requirement please message me to discuss further

$30 USD in 0 days
(16 Reviews)
4.7