about summary refs log tree commit diff
path: root/sourcecodes/data/example_sci/Llustructure_input_temp.txt
diff options
context:
space:
mode:
authorClaude Sonnet 52026-08-17 19:34:21 +0000
committerFrederick Muriuki Muriithi2026-08-17 14:53:37 -0500
commit9f820106d932ba6952a30d6165bc1d42a1fb7ab6 (patch)
tree0fb0b9f7597a66cb749d7d72f4baf7cd1269f896 /sourcecodes/data/example_sci/Llustructure_input_temp.txt
parenta1f64bda77d74026d663eca91b975a6ff869d9a3 (diff)
downloadBNW-9f820106d932ba6952a30d6165bc1d42a1fb7ab6.tar.gz
Fix undefined $TextinFile/$keyval in bn_after_upload_gom.php
$TextinFile was passed to move_uploaded_file() as its $to argument, but
its assignment (and the $keyval/$sid/$dir it depends on) was commented
out, so $TextinFile was always null/undefined here -- an upload
through this page could never succeed even on PHP 7.4, and on PHP 8.1+
it also triggers "Passing null to parameter #1 ($to)... is deprecated".
$keyval was similarly used (e.g. in the hidden My_key form field)
before it was ever assigned, causing an "Undefined variable" warning
that could leak into an unquoted HTML attribute if display_errors is on.

Unlike bn_file_load_gom.php (a fresh-upload entry point that mints a
new random key), this page is only reached via a redirect from
modify_structure_learning.php with an existing My_key already in the
query string. Restored the commented-out block, adapted to read
$keyval from $_GET (matching how the rest of this file already does it
further down) instead of generating a new one, so $TextinFile is a
real path before the upload block runs.

Verified empirically against PHP 8.3.28: simulating an upload request
now correctly reaches move_uploaded_file() with a real path and falls
into the file's own pre-existing "Sorry, error uploading" handling
instead of silently failing on a null argument.

Reviewed by: Frederick M Muriithi <fredmanglis@gmail.com>
Diffstat (limited to 'sourcecodes/data/example_sci/Llustructure_input_temp.txt')
0 files changed, 0 insertions, 0 deletions