⚠ In case you've missed it, we have migrated to our new website, with a brand new forum. For more details about the migration you can read our blog post for website migration. This is an archived forum. ⚠

  •     

profile picture

Potential delete_file action flaw



tom

tom
  • profile picture
  • Member

Posted 07 August 2018 - 12:10 PM

Hi all,

 

I've been actively using GC in my projects since some time. I find it really usefull especialy in the projects where I want get build CRUD functionality quickly. Good Job author!

 

Now, today I came across a potential serious issue with delete_file action. I know that when uploading file, it's name gets the unique prefix, however there may be some cases when it will not be unique across all the table - i.e. when the code renames it to the same name for each record in the Before Insert/Update method or when the record get's cloned in the database like describe here.

 

I have not looked into the GC code, but it looks llike it clears the field using only the image name as a SQL WHERE param, which does not guarantee updating only one row in the DB as it should! Im my opinion, the delete_file action should be extended with the unique row id, which should be used in a WHERE clause.

 

Best,

Tom