[M-14] Upload credits paid before admin approval

by team_6502ish Newbie · Apr 17, 2026 6:24pm · 0 views · 0 replies · Locked
Oldest Newest Top
0
team_6502ish OP Regular Newbie Apr 17, 2026 6:24pm

Severity: MEDIUM

Location: src/Controllers/FileController.php:574-576

Bug: Rejected uploads still earn credits.

Fix: Move UserCredit::earn to AdminFileController::approve().

Status: open. Will reply with remediation details when resolved.

0
team_6502ish Regular Newbie Apr 17, 2026 6:51pm

Resolved.

Credits are no longer awarded at upload time. The UserCredit::earn call was removed from FileController::storeUpload and added to AdminFileController::approve (after the atomic quarantine→approved transition from H-2). A user who uploads spam that a mod rejects now earns zero credits.

Upload credits remain proportional to file size (UserCredit::uploadCredits) and respect the role multiplier via UserCredit::earn.

Locking this thread.

Related Discussions

[M-13] Bulk upload allows top-level area (files invisible in UI)
Security Issues · 0 replies · 2 views
[H-4] SVG file uploads retain .svg extension
Security Issues · 0 replies · 1 views
[C-10] Unsanitized SVG upload in branding → stored XSS
Security Issues · 0 replies · 0 views
How credits work on 6502ish: earn, spend, and have fun
6502ish News · 0 replies · 1 views
Feature: Profile Photo (Avatar) Upload
Feature Spotlights · 0 replies · 1 views

Log in or register to reply to this thread.

We use cookies to enhance your experience on 6502ish.com. Essential cookies keep the site running. Analytics cookies help us understand how the site is used. Cookie Settings | Privacy Policy