diff --git a/3.0/modules/fotomotorw/controllers/fotomotorw.php b/3.0/modules/fotomotorw/controllers/fotomotorw.php index 1be2def0..aa7de2d6 100644 --- a/3.0/modules/fotomotorw/controllers/fotomotorw.php +++ b/3.0/modules/fotomotorw/controllers/fotomotorw.php @@ -19,7 +19,7 @@ */ class FotomotorW_Controller extends Controller { - public function resize($item_id) { + public function resize($str_checksum, $item_id) { // Displayed the "resized" version of an image by it's ID number. // This both gives fotomoto access to resizes regardless of permissions // and forces fotomoto to track images by unique id instead of file name @@ -31,6 +31,11 @@ class FotomotorW_Controller extends Controller { throw new Kohana_404_Exception(); } + // Make sure checksum matches, if not, throw a 404 error. + if ($str_checksum != md5($item->created)) { + throw new Kohana_404_Exception(); + } + // If the resize file doesn't exist for some reason, display a 404 error. if (!file_exists($item->resize_path())) { throw new Kohana_404_Exception(); diff --git a/3.0/modules/fotomotorw/views/fotomotorw_block.html.php b/3.0/modules/fotomotorw/views/fotomotorw_block.html.php index f0f4b91a..a3209822 100644 --- a/3.0/modules/fotomotorw/views/fotomotorw_block.html.php +++ b/3.0/modules/fotomotorw/views/fotomotorw_block.html.php @@ -10,6 +10,6 @@