diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0c6f4b2a8..dc01534ad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,7 +26,7 @@
- Translations for config.php, raised scrape interval [\#1100](https://github.com/torrentpier/torrentpier/pull/1100) ([kovalensky](https://github.com/kovalensky))
- Don't re-announce for hybrids if the event is "stopped" [\#1099](https://github.com/torrentpier/torrentpier/pull/1099) ([kovalensky](https://github.com/kovalensky))
- Security measures [\#1098](https://github.com/torrentpier/torrentpier/pull/1098), [\#1113](https://github.com/torrentpier/torrentpier/pull/1113) ([kovalensky](https://github.com/kovalensky), [belomaxorka](https://github.com/belomaxorka))
-- Minor improvements [\#1121](https://github.com/torrentpier/torrentpier/pull/1121) ([belomaxorka](https://github.com/belomaxorka))
+- Minor improvements [\#1121](https://github.com/torrentpier/torrentpier/pull/1121), [\#1122](https://github.com/torrentpier/torrentpier/pull/1122) ([belomaxorka](https://github.com/belomaxorka))
- New Crowdin updates [\#1097](https://github.com/torrentpier/torrentpier/pull/1097), [\#1101](https://github.com/torrentpier/torrentpier/pull/1101) ([Exileum](https://github.com/Exileum))
## [v2.4.0-beta4](https://github.com/torrentpier/torrentpier/tree/v2.4.0-beta4) (2023-11-14)
diff --git a/dl.php b/dl.php
index 6c1efd2bd..2435abc74 100644
--- a/dl.php
+++ b/dl.php
@@ -24,14 +24,14 @@ $thumbnail = request_var('thumb', 0);
// Send file to browser
function send_file_to_browser($attachment, $upload_dir)
{
- global $bb_cfg, $lang, $userdata;
+ global $bb_cfg, $lang;
$filename = ($upload_dir == '') ? $attachment['physical_filename'] : $upload_dir . '/' . $attachment['physical_filename'];
$gotit = false;
if (@!file_exists(@amod_realpath($filename))) {
- bb_die($lang['ERROR_NO_ATTACHMENT'] . "
" . $filename . "
" . $lang['TOR_NOT_FOUND']);
+ bb_die($lang['ERROR_NO_ATTACHMENT'] . '
' . htmlCHR($filename));
} else {
$gotit = true;
}
@@ -66,7 +66,7 @@ function send_file_to_browser($attachment, $upload_dir)
}
readfile($filename);
} else {
- bb_die($lang['ERROR_NO_ATTACHMENT'] . "
" . $filename . "
" . $lang['TOR_NOT_FOUND']);
+ bb_die($lang['ERROR_NO_ATTACHMENT'] . '
' . htmlCHR($filename));
}
exit;
@@ -149,6 +149,7 @@ $datastore->rm('cat_forums');
$rows = get_extension_informations();
$num_rows = count($rows);
+$allowed_extensions = $download_mode = [];
for ($i = 0; $i < $num_rows; $i++) {
$extension = strtolower(trim($rows[$i]['extension']));
$allowed_extensions[] = $extension;
@@ -156,8 +157,8 @@ for ($i = 0; $i < $num_rows; $i++) {
}
// Disallowed
-if (!in_array($attachment['extension'], $allowed_extensions) && !IS_ADMIN) {
- bb_die(sprintf($lang['EXTENSION_DISABLED_AFTER_POSTING'], $attachment['extension']));
+if (!in_array($attachment['extension'], $allowed_extensions)) {
+ bb_die(sprintf($lang['EXTENSION_DISABLED_AFTER_POSTING'], $attachment['extension']) . '
' . $lang['ERROR_NO_ATTACHMENT'] . '
' . htmlCHR($attachment['physical_filename']));
}
$download_mode = (int)$download_mode[$attachment['extension']];
diff --git a/library/ajax/view_torrent.php b/library/ajax/view_torrent.php
index 42ed7e971..12f240a09 100644
--- a/library/ajax/view_torrent.php
+++ b/library/ajax/view_torrent.php
@@ -25,11 +25,7 @@ if (!$torrent) {
$filename = get_attachments_dir() . '/' . $torrent['physical_filename'];
if (!file_exists($filename) || !$file_contents = file_get_contents($filename)) {
- if (IS_AM) {
- $this->ajax_die($lang['ERROR_NO_ATTACHMENT'] . "\n\n" . htmlCHR($filename));
- } else {
- $this->ajax_die($lang['ERROR_NO_ATTACHMENT']);
- }
+ $this->ajax_die($lang['ERROR_NO_ATTACHMENT'] . "\n\n" . htmlCHR($filename));
}
if (!$tor = \Arokettu\Bencode\Bencode::decode($file_contents, dictType: \Arokettu\Bencode\Bencode\Collection::ARRAY)) {
diff --git a/src/Legacy/Torrent.php b/src/Legacy/Torrent.php
index 14a488724..f43bd1f7c 100644
--- a/src/Legacy/Torrent.php
+++ b/src/Legacy/Torrent.php
@@ -312,7 +312,7 @@ class Torrent
$filename = get_attachments_dir() . '/' . $torrent['physical_filename'];
if (!is_file($filename)) {
- self::torrent_error_exit($lang['ERROR_NO_ATTACHMENT']);
+ self::torrent_error_exit($lang['ERROR_NO_ATTACHMENT'] . '
' . htmlCHR($filename));
}
$file_contents = file_get_contents($filename);