Protect other users' user options

Question

I’m developing a system where every user has options to delete, add, or update, whatever. Let’s imagine that I, as a logged-in user with ID=6 have the options to delete one of my photos.

When I click on one of my photos it is through a link like this

photo_op.php?id=42&p=images/user/QzEckSX.png&o=6

where the ?id= the image id, the &p= the path of the image and the &o= to whom the image belongs, in this case o=6.

I am checking if the photo is from the logged-in user, if so then I display the options, if not then just display the image. This way:

$id_user=$_SESSION['id'];
$owner=$_REQUEST['o'];


if ($owner != $id_user){
    echo "";

}else{
echo "<div id='photo_op'><a href='eliminar_photo_p.php?id=$id_photo'></a> ";
echo "<a href='add_photo_p.php?id=$id_photo'></a></div>";
}

The problem is that the user with id=11 if he "injects" the ID=6 into the link that belongs to the ID=6, the user of ID=11 has access to the user options ID=6.

What is the best way to display the options to the user without it being injected into the url?

For example, being the owner of the image I have this link:

photo_op.php?id=42&p=images/user/QzEckSX.png&o=6

But if the other id=11 user does this:

photo_op.php?id=42&p=images/user/QzEckSX.png&o=11

he will have access to the options to delete this photo to which he does not belong.

My login.php file is as follows:

<?php 
include('init.php');


//echo $_POST['txtemail'];
//echo $_POST['txtpassword'];


//CONSULTA DO UTILIZADOR
$consulta="Select * from user where email='" . $_POST['txtemail'] . "' and     senha='" . $_POST['txtpassword'] . "'";
$resultado=mysql_query($consulta);
if (mysql_num_rows($resultado)>0) //SE O EMAIL E A PASSWORD COINCIDIREM
{
//COLOCA NA VARIAVEL LINHA OS DADOS DA CONSULTA
$linha=mysql_fetch_array($resultado);
//COLOCA O EMAIL EM SESSAO
$_SESSION['email']=$linha['email'];
$_SESSION['username']=$linha['username'];
$_SESSION['id']=$linha['id'];
$_SESSION['status']=$linha['status'];
$_SESSION['genero']=$linha['genero'];



$_SESSION['last_login']=$linha['last_login'];
$_SESSION['nlog']=$linha['nlog'];
//REDIRECCIONA A PAGINA PARA A PAGINA SECRETA
include('q/status_update.php');
include('q/nlog_update.php');
header("location: home.php");
}
else //CASO NÃO COINCIDAM
{
//REDIRECCIONA PARA A PAGINA INICIAL REPORTANDO O ERRO
header("location: index.php?erro=1");
}



?>

My get_photos.php is as follows:

<?php 
$id_s=$_SESSION['id'];
$sql ="SELECT id, user_id, location FROM photos WHERE user_id=$id_s";

$result = $conn->query($sql);

if ($result->num_rows > 0) {
// output data of each row
while($row = $result->fetch_assoc()) {


echo " <a class='galeria_p' onclick='goclicky(this); return false;'   target='_blank' href='q/photo_op.php?  id=".$row['id']."&p=".$row['location']."&o=".$id_s." ' ><img class='img1'   width='118px' height='118px' src=".$row['location']."></a> ";      

}
} else {
echo "0 results";
}
?>

Answer 1

Before, you have to check if the image belongs to the logged in user:

Let’s remove the line $owner=$_REQUEST['o']; because the responsibility to inform who owns the image is not of the client but of the server. Let the customer say whether or not the owner of the image is a security flaw.

It’s the same thing as you coming into a gated community and asking to get into the apartment and the doorman letting you in just because you said you own it.

$id_user = $_SESSION['id'];

// Vamos remover um possível ataque via sql injection
// Atenção que no PHP 5.5.0 em diante o método mysql_real_escape_string 
// e a extensão mysql são deprecated, ou seja, 
// serão removidos de versões futuras (o PHP 7 já removeu penso eu).
// Passe a utilizar a extensão mysqli (com "i" no fim).
$id_photo = mysql_real_escape_string($_REQUEST['id']);

$sql ="SELECT 1 FROM photos WHERE id=$id_photo AND user_id=$id_user";
$result = $conn->query($sql);

if ($result->num_rows > 0) {
    echo "<div id='photo_op'><a href='eliminar_photo_p.php?id=$id_photo'></a> ";
    echo "<a href='add_photo_p.php?id=$id_photo'></a></div>";
} else {
    echo "Seu malandro! Você não é o dono da imagem!";
}