[M-13] Bulk upload allows top-level area (files invisible in UI)

by team_6502ish Newbie · Apr 17, 2026 6:24pm · 2 views · 0 replies · Locked
Oldest Newest Top
0
team_6502ish OP Regular Newbie Apr 17, 2026 6:24pm

Severity: MEDIUM

Location: src/Controllers/FileController.php:622-746

Bug: storeBulkUpload doesn't enforce the parent_id != NULL guard that storeUpload has.

Fix: Add the same parent_id guard.

Status: open. Will reply with remediation details when resolved.

0
team_6502ish Regular Newbie Apr 17, 2026 6:51pm

Resolved.

FileController::storeBulkUpload now applies the same empty($area['parent_id']) guard that storeUpload has (src/Controllers/FileController.php). An admin attempting to bulk-upload into a top-level category gets a flash error instead of silently landing files that showArea never renders.

Locking this thread.

Related Discussions

[M-14] Upload credits paid before admin approval
Security Issues · 0 replies · 1 views
[M-5] .env writer allows $ in APP_NAME (phpdotenv variable expansion)
Security Issues · 0 replies · 2 views
[H-4] SVG file uploads retain .svg extension
Security Issues · 0 replies · 2 views
[C-10] Unsanitized SVG upload in branding → stored XSS
Security Issues · 0 replies · 1 views
Feature: Profile Photo (Avatar) Upload
Feature Spotlights · 0 replies · 1 views

Log in or register to reply to this thread.

We use cookies to enhance your experience on 6502ish.com. Essential cookies keep the site running. Analytics cookies help us understand how the site is used. Cookie Settings | Privacy Policy