From 8a4f021d49804391a36da4905b033deffa5acb46 Mon Sep 17 00:00:00 2001 From: Juuso Lapinlampi Date: Mon, 16 Nov 2015 06:32:29 +0000 Subject: Fix generate_name() imaginary column "pomf" to "files" (Partially reverts commit e0bb4e0.) Actually fix generate_name() COUNT query this time. It still had an imaginary table "pomf" from e0bb4e0. Change it to "files" like in the schema. For code consistency, :filename is reverted back to :name as it was before commit e0bb4e0. That commit is bogus and doesn't fix the issue due to skipping the code review process. The problem with this COUNT query in first place was that it checked imaginary columns (name) from an imaginary table (pomf) in the database. This led to the "same filename" check not working at all, and the other code only relying on checking the same hash (currently SHA-1) for returning the filename before generate_name(). By luck, generated filenames could collide and another file of the same generated filename would be returned, discarding the new upload. I discovered this bug about a month ago myself, but back then there was no reliable way to reproduce it and no good description of the bug. This bug was introduced in commit 5b77a4e. Reported-by: Vhum Vhum Suggested-by: Luminarys OK ewhal@, luminarys@ --- static/upload.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'static/upload.php') diff --git a/static/upload.php b/static/upload.php index edae4f8..a37c549 100644 --- a/static/upload.php +++ b/static/upload.php @@ -80,8 +80,8 @@ function generate_name($file) } // Check if a file with the same name does already exist in the database - $q = $db->prepare('SELECT COUNT(filename) FROM pomf WHERE filename = (:filename)'); - $q->bindValue(':filename', $name, PDO::PARAM_STR); + $q = $db->prepare('SELECT COUNT(filename) FROM files WHERE filename = (:name)'); + $q->bindValue(':name', $name, PDO::PARAM_STR); $q->execute(); $result = $q->fetchColumn(); // If it does, generate a new name -- cgit v1.2.3