diff --git a/app/music_on_hold/music_on_hold.php b/app/music_on_hold/music_on_hold.php index 1254243100..9e0cd5befe 100644 --- a/app/music_on_hold/music_on_hold.php +++ b/app/music_on_hold/music_on_hold.php @@ -60,12 +60,11 @@ $streams = $database->select($sql, $parameters, 'all'); //download music on hold file - if ( - $_GET['action'] == "download" + if ($_GET['action'] == "download" && is_uuid($_GET['id']) && is_array($streams) - && @sizeof($streams) != 0 - ) { + && @sizeof($streams) != 0) { + //get the uuid $stream_uuid = $_GET['id']; @@ -78,12 +77,12 @@ break; } } - + //replace the sounds_dir variable in the path $stream_path = str_replace('$${sounds_dir}', $_SESSION['switch']['sounds']['dir'], $stream_path); //get the file - $stream_file = base64_decode($_GET['file']); + $stream_file = $_GET['file']; $stream_full_path = path_join($stream_path, $stream_file); //sanitize path @@ -117,13 +116,11 @@ } //upload music on hold file - if ( - $_POST['action'] == 'upload' + if ($_POST['action'] == 'upload' && is_array($_FILES) && is_uploaded_file($_FILES['file']['tmp_name']) && is_array($streams) - && @sizeof($streams) != 0 - ) { + && @sizeof($streams) != 0) { //determine name if ($_POST['name_new'] != '') { @@ -265,12 +262,10 @@ } //delete the music on hold file - if ( - $_GET['action'] == "delete" + if ($_GET['action'] == "delete" && is_uuid($_GET['id']) && is_array($streams) - && @sizeof($streams) != 0 - ) { + && @sizeof($streams) != 0) { //get submitted values $stream_uuid = $_GET['id']; @@ -544,7 +539,7 @@ else { $stream_details = ($music_on_hold_rate/1000).' kHz / '.$icons; } - + //show the table header echo "