bugphpGroupWare - Bugs: bug #7227, Webdav problem with acl_checks...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #7227: Webdav problem with acl_checks (security problem in some case ?)

Submitted by:  Caeies <Caeies>
Submitted on:  Tue 13 Jan 2004 02:27:58 PM UTC  
 
Item Group: 0.9.16RC2Category: API - phpGroupware API
Severity: 3 - NormalPriority: 7 - High
Status: FixedPrivacy: Public
Assigned to: Dave Hall <skwashd>Open/Closed: Closed
Component Version: SVNOperating System: GNU/Linux - Debian
Reproducibility: Every TimePlanned Release: None
Fixed Release: 

Sun 18 Jan 2004 05:49:11 AM UTC, comment #2:

This has been corrected in CVS.

To grab a complete update of all fixes:

1) Check to see if you have cvs installed: 'cvs --help'.
1a) If not, install a copy of cvs-cli from your favorite
distro.

2) Then just type:
'cd <your phpgroupware dir>; cvs update -dP'.

You can do step 2 as many times in a day as you wish, and
will always get the most current bug fixes.

Thanks,

Dave Hall <skwashd>
Project AdministratorIn charge of this item.
Tue 13 Jan 2004 02:33:11 PM UTC, comment #1:

patch #2472 solve this problem in class.vfs_dav.inc.php

regards,
Caeies.

Caeies <Caeies>
Project Administrator
Tue 13 Jan 2004 02:27:58 PM UTC, original submission:

I don't know If you remember this. So I post it on the savannah bug tracker (from forums.phpgroupware.org).

so, at line 804 in acl_check you will see a return True; (this is the beginning of the function). So acl_check always return True ... This could be ok if .htaccess are created correctly by mkdir which is not the case (see the next bug).

The workaround is the following :
1) remove the return True; at line 804
2) then before the ls at line ~880 override the acl and restore them just after.

et voila :) acl_check are working now under dav system.
Caeies.
PS: patch posted in a few minute.

Caeies <Caeies>
Project Administrator

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Sun 18 Jan 2004 05:49:11 AM UTCskwashdStatusNone=>Fixed
  Assigned toNone=>skwashd
  Open/ClosedOpen=>Closed

Back to the top


Powered by Savane 3.1-cleanup1