MyBB Community Forums

Full Version: Attachment.php Permissions Error
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
Hi,

I followed this modification here:

http://community.mybb.com/thread-128763.html

and as my post mentions here:

http://community.mybb.com/thread-128763-...pid1154138

Quote:I was successfully using this modification for some time but yesterday I noticed that some zip files had been downloaded more than they should have. I created a new account and to my surprise I was able to download zip files Sad , the strange thing is trying to download old zip files brings up a no permissions page, but all new zip files start downloading. This is happening in the same section, for example: Section A> Error downloading a zip file from two months ago, Section A> Success downloading a zip file that was uploaded yesterday.

Since I made the modification I have installed two plugins: Template Conditionals and Ajax Upload Multiple Attachments Plugin (disabled when I'm not uploading). There has also been a forum update in this time.  As a test I uploaded a zip file with both plugins disabled and tested (with a new account) if I was able to download zip files, I was.

I'm not sure what else to try, any ideas please? Undecided

The modification isn't working any more. I've created a thread here hoping someone can find the cause of this problem Smile.

Since posting that message I've worked out that the last zip file to give a no permissions error was uploaded on April 9th, the next zip file was uploaded on April 19th and it's downloadable. All zip files that were uploaded after April 19th are also downloadable, even though "Can download attachments?" is unchecked in group settings.

I've removed the modification, reapplied it and the results are the same. I'm completey lost as to what could be causing this issue, how can something over ride the permissions and only on and after April 19th? Huh
A little update. Last night I created a new test forum on my server and the modification didn't work, thinking this may be a host problem I then created a free account with x10hosting.com and the modification also didn't work. After some fiddling around I discovered that the modification works with jpg, png and text files but not zip or php files (both start with the MIME type "application/").


I then changed the modification from:

&& $attachment['filetype'] == "application/zip")) 

to

&& $attachment['filetype'] == "application/x-zip-compressed")) 

which worked. Smile I tested the above on my forum and it blocks all zip files uploaded after April 9th from being downloaded, but it allows all zip files uploaded before April 9th to be downloaded (the reverse of my current problem).

I then attempted to use an array to block all zip files:

!in_array($attachment['filetype'], array('application/zip', 'application/x-zip-compressed')))) 

but instead it allows all zip files to be downloaded. Sad

I also installed an older version of mybb (1.83) and the problem is still present. I'm completely out of my depth with this and I have far too many attachments that were uploaded before April 9th to start again.