bugphpGroupWare - Bugs: bug #8359, minor security problem in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #8359: minor security problem in class.vfs_dav.inc.php

Submitted by:  Caeies <Caeies>
Submitted on:  Mon 29 Mar 2004 04:16:26 PM UTC  
 
Item Group: 0.9.16.000 releaseCategory: API - phpGroupware API
Severity: 3 - NormalPriority: 9 - Immediate
Status: FixedPrivacy: Public
Assigned to: Dave Hall <skwashd>Open/Closed: Closed
Component Version: SVNOperating System: GNU/Linux - Debian
Reproducibility: Every TimePlanned Release: None
Fixed Release: 

Tue 30 Mar 2004 04:53:07 AM UTC, comment #1:

Ok, found it - line 2098 on the stock version of the code.

Fixed in cvs.

Please do not post security advisories as bug reports, without attempting to contact someone from the project first.

Cheers

Dave Hall <skwashd>
Project AdministratorIn charge of this item.
Mon 29 Mar 2004 04:16:26 PM UTC, original submission:

Heya,

When creating the home user directory (from filemanager), using webdav repository, the system failed silently to create a .htaccess when required (in subfolders of the home directory, using the deny in the setup configuration).

The bug is at line 2122 change from this :
if (!$conf->config_data['acl_default'] == 'grant')

to this :
if ($conf->config_data['acl_default'] != 'grant')

And please ever use ( ) when using ! in front of the things.
There is a couple of this in this file and we are not sure if they are right or not. Need some deeper review.

Thanks for killing it quickly :)

Caeies, bug hunter.

Caeies <Caeies>
Project Administrator

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Tue 30 Mar 2004 04:54:08 AM UTCskwashdOpen/ClosedOpen=>Closed
Tue 30 Mar 2004 04:53:07 AM UTCskwashdStatusNone=>Fixed
  Assigned toNone=>skwashd

Back to the top


Powered by Savane 3.1-cleanup1