Skip to content
Snippets Groups Projects
Commit 2e327879 authored by Greeshma's avatar Greeshma
Browse files

reverting changes

parent 9d732795
No related branches found
No related tags found
1 merge request!413Sqlinjections
...@@ -21,40 +21,40 @@ class Emails_DownloadFile_Action extends Vtiger_Action_Controller { ...@@ -21,40 +21,40 @@ class Emails_DownloadFile_Action extends Vtiger_Action_Controller {
} }
public function process(Vtiger_Request $request) { public function process(Vtiger_Request $request) {
$db = PearDatabase::getInstance(); $db = PearDatabase::getInstance();
$attachmentId = $request->get('attachment_id'); $attachmentId = $request->get('attachment_id');
$name = $request->get('name'); $name = $request->get('name');
$query = "SELECT * FROM vtiger_attachments WHERE attachmentsid = ? AND name = ?" ; $query = "SELECT * FROM vtiger_attachments WHERE attachmentsid = ? AND name = ?" ;
$result = $db->pquery($query, array($attachmentId, $name)); $result = $db->pquery($query, array($attachmentId, $name));
if($db->num_rows($result) == 1) if($db->num_rows($result) == 1)
{ {
$row = $db->fetchByAssoc($result, 0); $row = $db->fetchByAssoc($result, 0);
$fileType = $row["type"]; $fileType = $row["type"];
$name = $row["name"]; $name = $row["name"];
$filepath = $row["path"]; $filepath = $row["path"];
$name = decode_html($name); $name = decode_html($name);
$storedFileName = $row['storedname']; $storedFileName = $row['storedname'];
if (!empty($name)) { if (!empty($name)) {
if(!empty($storedFileName)){ if(!empty($storedFileName)){
$saved_filename = $attachmentId."_". $storedFileName; $saved_filename = $attachmentId."_". $storedFileName;
}else if(is_null($storedFileName)){ }else if(is_null($storedFileName)){
$saved_filename = $attachmentId."_". $name; $saved_filename = $attachmentId."_". $name;
} }
$disk_file_size = filesize($filepath.$saved_filename); $disk_file_size = filesize($filepath.$saved_filename);
$filesize = $disk_file_size + ($disk_file_size % 1024); $filesize = $disk_file_size + ($disk_file_size % 1024);
$fileContent = fread(fopen($filepath.$saved_filename, "r"), $filesize); $fileContent = fread(fopen($filepath.$saved_filename, "r"), $filesize);
header("Content-type: $fileType"); header("Content-type: $fileType");
header("Pragma: public"); header("Pragma: public");
header("Cache-Control: private"); header("Cache-Control: private");
header("Content-Disposition: attachment; filename=$name"); header("Content-Disposition: attachment; filename=$name");
header("Content-Description: PHP Generated Data"); header("Content-Description: PHP Generated Data");
echo $fileContent; echo $fileContent;
} }
} }
} }
} }
?> ?>
\ No newline at end of file
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment