(04-02-2009 06:29 PM)okitai Wrote:  It's to fast... I, really, didn't have time to, even, load Refresh 2.

Alex moves fast dont he lol. I only had 1 chance to test it.
You know what im going to say next alex.
Great work mate. Testing now.

Alex you can use unlink to delete a file. So try typing in your delete code something like

@Alexandru21,
1. I've asked this before and didn't get an answer: Is it your intention not using the standard navigation. If you can, at least add the chosen name of download section to the nav.
2. I just got a report on my forum of the ability to do an SQL injection (the test was done when the Refresh 2 was used). The report is a free one and thus doesn't show where exactly the SQL injection is possible, only a manager summarize. The thing is that this report was run before (about, two weeks ago), when I didn't have this plugin installed and it showed that there are two(2) places that can be SQL injected, and now it says four(4). Please try to find whre it can do that. (The full report costs $250 - not something I have).

I think u must add files from remote server too. what i mean that one can include in downloads section thru URL also. Not always to have file upload to own sever!

(04-03-2009 11:07 AM)okitai Wrote:  @Alexandru21,
1. I've asked this before and didn't get an answer: Is it your intention not using the standard navigation. If you can, at least add the chosen name of download section to the nav.
2. I just got a report on my forum of the ability to do an SQL injection (the test was done when the Refresh 2 was used). The report is a free one and thus doesn't show where exactly the SQL injection is possible, only a manager summarize. The thing is that this report was run before (about, two weeks ago), when I didn't have this plugin installed and it showed that there are two(2) places that can be SQL injected, and now it says four(4). Please try to find whre it can do that. (The full report costs $250 - not something I have).

What SQL Injection scanner did you use?

My ISP did the request to run. It was done by: GamaSec.
I attached a picture grab from one page of the report.

MyDownload Section Beta 1 Refresh 4 is released. Now, when a user delete an item, the file of the item is deleted from the server (and 1 more changelog). Read the first post.

---

@okitai: Check the new version...

@Alexandru21, I uploaded the newer version.
1. Finally, the file does get deleted - I do, still, think that either a PM or a mail should be send to an admin about a change, like deleting a file.
2. Something that you didn't answer (about the navigation you use) - is your intention not using MyBB's build-in navigation or is it "by mistake". At least put, in the regular navigation, the name of the download section (the one we can change in the settings).
3. Sadly, I can't ask to run the test again, as it will cost me money (that I don't have), about $250.

i am getting this error when i try to download uploaded file
Fatal error: Cannot use object of type mysqli_result as array in \localhost\www\localbb\down.php on line 1477