Appion

r15504 fix this

"checkExptAccessPrivilege" contains redirct either to login.php or accessdeny.php in all cases when the function is meant to return false so in effect it does not go back to the called script at all. If logged in, it goes to accessdeny.php. If not logged in, it goes to login.php It will only return to the called script if the preivilege check is passed by both criteria.

Because I don't want anyone, even those with expt access privilege (including the case when login is not enabled) to download critical files or files from other sessions, in the case of logged-in user. They are checked again after the preivilege. This is at the file level not the database level.

Hi Anchi,
Thank you for your explain.
So in download.php line 8
You can do:

if(!checkExptAccessPrivilege($sessionId,'data')) exit;

That should be take care all the problem. (Because when you redirect to other script, the original script will still keep running in the back).

Thanks.
Eric

r15507 did the exit in login.inc