修复一处附件免积分下载的漏洞

2017-03-09 20:30:36 +08:00 · 2017-03-09 20:30:36 +08:00 · d12b00ba24
parent 2ed1b98ea1
commit d12b00ba24
1 changed files with 1 additions and 1 deletions
--- a/upload/source/module/forum/forum_misc.php
+++ b/upload/source/module/forum/forum_misc.php
@ -26,7 +26,7 @@ if($_GET['action'] == 'paysucceed') {
 	exit;

 } elseif($_GET['action'] == 'attachcredit') {
-	if($_GET['formhash'] != FORMHASH) {
+	if($_GET['formhash'] != FORMHASH || !$_G['uid']) {
 		showmessage('undefined_action', NULL);
 	}