Build shared-hosting news site with ad flow and themes#28
Build shared-hosting news site with ad flow and themes#28
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| <?php | ||
| require_once __DIR__ . '/../app/lib/auth.php'; | ||
| admin_logout(); | ||
| header('Location: ' . BASE_URL . '/admin/login.php'); |
There was a problem hiding this comment.
The logout handler calls admin_logout() without ever calling session_start(), while admin_logout() only invokes session_destroy(). PHP ignores session_destroy() when no session is active, so this endpoint redirects without clearing the session cookie or data and the admin remains logged in. Start the session before destroying it (or call session_start() inside admin_logout()) so logout actually ends the session.
Useful? React with 👍 / 👎.
| if (!empty($_FILES['logo']['name'])) { | ||
| $ext = pathinfo($_FILES['logo']['name'], PATHINFO_EXTENSION); | ||
| $name = 'assets/img/logo_'.time().'.'.$ext; | ||
| move_uploaded_file($_FILES['logo']['tmp_name'], __DIR__.'/../'.$name); | ||
| $logoPath = $name; |
There was a problem hiding this comment.
The settings form saves uploaded logo/banner files directly to public_html/assets/img using the user-supplied extension and without any MIME/type whitelist or path checks. An authenticated admin can therefore upload a PHP file (or other executable) and have it written to a web-accessible location, leading to straightforward remote code execution. Validate the file type and restrict extensions/paths before moving the upload.
Useful? React with 👍 / 👎.
1 participant
Summary
Testing
Codex Task