bugphpGroupWare - Bugs: bug #8359, minor security problem in...


You are not allowed to post comments on this tracker with your current authentication level.

bug #8359: minor security problem in class.vfs_dav.inc.php

Submitter:  Caeies <Caeies>
Submitted:  Mon 29 Mar 2004 04:16:26 PM UTC
Category:  API - phpGroupware API Item Group: release
Severity:  3 - Normal Priority:  9 - Immediate
Status:  Fixed Privacy:  Public
Assigned to:  skwashd Open/Closed:  Closed
Component Version:  SVN Operating System:  GNU/Linux - Debian
Reproducibility:  Every Time Planned Release:  None
Fixed Release: 

Tue 30 Mar 2004 04:53:07 AM UTC, comment #1: 

Ok, found it - line 2098 on the stock version of the code.

Fixed in cvs.

Please do not post security advisories as bug reports, without attempting to contact someone from the project first.


Dave Hall <skwashd>
Group administrator
Mon 29 Mar 2004 04:16:26 PM UTC, original submission:  


When creating the home user directory (from filemanager), using webdav repository, the system failed silently to create a .htaccess when required (in subfolders of the home directory, using the deny in the setup configuration).

The bug is at line 2122 change from this :
 if (!$conf->config_data['acl_default'] == 'grant')

to this :
 if ($conf->config_data['acl_default'] != 'grant')

And please ever use ( ) when using ! in front of the things.
There is a couple of this in this file and we are not sure if they are right or not. Need some deeper review.

Thanks for killing it quickly :)

Caeies, bug hunter.

Caeies <Caeies>
Group administrator


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.


Follow 3 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2004-03-30 skwashd Open/ClosedOpen Closed
2004-03-30 skwashd StatusNone Fixed
    Assigned toNone skwashd

Back to the top

Powered by Savane 3.13-4b48.
Corresponding source code