diff options
| author | Claude Sonnet 5 | 2026-08-17 19:34:21 +0000 |
|---|---|---|
| committer | Frederick Muriuki Muriithi | 2026-08-17 14:53:37 -0500 |
| commit | 9f820106d932ba6952a30d6165bc1d42a1fb7ab6 (patch) | |
| tree | 0fb0b9f7597a66cb749d7d72f4baf7cd1269f896 /sourcecodes/data/example_sci/Llustructure_input_temp.txt | |
| parent | a1f64bda77d74026d663eca91b975a6ff869d9a3 (diff) | |
| download | BNW-9f820106d932ba6952a30d6165bc1d42a1fb7ab6.tar.gz | |
Fix undefined $TextinFile/$keyval in bn_after_upload_gom.php
$TextinFile was passed to move_uploaded_file() as its $to argument, but its assignment (and the $keyval/$sid/$dir it depends on) was commented out, so $TextinFile was always null/undefined here -- an upload through this page could never succeed even on PHP 7.4, and on PHP 8.1+ it also triggers "Passing null to parameter #1 ($to)... is deprecated". $keyval was similarly used (e.g. in the hidden My_key form field) before it was ever assigned, causing an "Undefined variable" warning that could leak into an unquoted HTML attribute if display_errors is on. Unlike bn_file_load_gom.php (a fresh-upload entry point that mints a new random key), this page is only reached via a redirect from modify_structure_learning.php with an existing My_key already in the query string. Restored the commented-out block, adapted to read $keyval from $_GET (matching how the rest of this file already does it further down) instead of generating a new one, so $TextinFile is a real path before the upload block runs. Verified empirically against PHP 8.3.28: simulating an upload request now correctly reaches move_uploaded_file() with a real path and falls into the file's own pre-existing "Sorry, error uploading" handling instead of silently failing on a null argument. Reviewed by: Frederick M Muriithi <fredmanglis@gmail.com>
Diffstat (limited to 'sourcecodes/data/example_sci/Llustructure_input_temp.txt')
0 files changed, 0 insertions, 0 deletions
