@@ -21,7 +21,7 @@ if (
!isset($_GET['delete']) &&
!isset($_POST['password'])
) {
$requestedFile = rawurldecode($requestedFile);
$filename = basename($requestedFile);
$filepath = UPLOAD_DIR . $filename;
The note is not visible to the blocked user.