myron/parkerslingshotrentals
1
0
Fork 0
mirror of https://github.com/myronblair/parkerslingshotrentals synced 2026-06-30 17:50:31 -05:00
Code Issues Packages Projects Releases Wiki Activity

Security: block direct upload access, fix view-doc path traversal guard

Browse Source 
- uploads/.htaccess: deny all direct web access to uploaded customer docs
- admin/view-doc.php: add realpath() path-traversal check (mirrors view-doc.php)
- admin/view-doc.php: remove dead double-query (result was always overwritten)
- .gitignore: uploads/* wildcard so .htaccess can be tracked
This commit is contained in:
Myron Blair
2026-06-13 14:20:41 +00:00
parent 5e2d0da230
commit bb21fca399
3 changed files with 25 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+2 -1
View File
@@ -2,4 +2,5 @@
.DS_Store
*.swp
uploads/
uploads/*
!uploads/.htaccess