Thread: Read anyones mail BUG and FIX

Here is the code from my messages_0utbox.php. I downloaded Dolphin a few weeks ago. Looks like it already has a similiar fix included. Did Dolphin fix this recently?

Thanks!

Code:

	$senderID 	= $sender_arr['Recipient'];
	
	$message_sql= "SELECT m.`Text`, m.`Subject`, DATE_FORMAT( m.`Date`, '%Y-%m-%d' ) AS `Date`, p.Status FROM `Messages` AS m LEFT JOIN Profiles AS p ON m.Recipient = p.ID WHERE m.`ID` = '$messageID'";// AND`Sender` = '$senderID'";

Code:

$message_sql= "SELECT m.`Text`, m.`Subject`, DATE_FORMAT( m.`Date`, '%Y-%m-%d' ) AS `Date`, p.Status FROM `Messages` AS m LEFT JOIN Profiles AS p ON m.Recipient = p.ID WHERE m.`ID` = '$messageID'";// AND`Sender` = '$senderID'";

Perhaps - but the // before the

Code:

AND`Sender` = '$senderID'";

indicates they commented it out - or someone did - and disabled this check.

Smoge

I have not tried Lodlock's fix, which is in the first post in this thread - but I did look at it - and it appears correct.

Smoge

Yup - Im fine here too ..... No patch needed on my 4.1.0004

makenoize

Thanks for the verbal support. Just trying to help out.