bugphpGroupWare - Bugs: bug #7227, Webdav problem with acl_checks...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #7227: Webdav problem with acl_checks (security problem in some case ?)

Submitter:  Caeies <Caeies>
Submitted:  Tue 13 Jan 2004 02:27:58 PM UTC
   
 
Category:  API - phpGroupware API Item Group:  0.9.16RC2
Severity:  3 - Normal Priority:  7 - High
Status:  Fixed Privacy:  Public
Assigned to:  skwashd Open/Closed:  Closed
Component Version:  SVN Operating System:  GNU/Linux - Debian
Reproducibility:  Every Time Planned Release:  None
Fixed Release: 

Sun 18 Jan 2004 05:49:11 AM UTC, comment #2: 

This has been corrected in CVS.

To grab a complete update of all fixes:

1)  Check to see if you have cvs installed: 'cvs --help'.
1a) If not, install a copy of cvs-cli from your favorite
distro.

2)  Then just type:
    'cd <your phpgroupware dir>; cvs update -dP'.

You can do step 2 as many times in a day as you wish, and
will always get the most current bug fixes.

Thanks,

Dave Hall <skwashd>
Group administrator
Tue 13 Jan 2004 02:33:11 PM UTC, comment #1: 

patch #2472 solve this problem in class.vfs_dav.inc.php

regards,
Caeies.

Caeies <Caeies>
Group administrator
Tue 13 Jan 2004 02:27:58 PM UTC, original submission:  

I don't know If you remember this. So I post it on the savannah bug tracker (from forums.phpgroupware.org).

so, at line 804 in acl_check you will see a return True; (this is the beginning of the function). So acl_check always return True ... This could be ok if .htaccess are created correctly by mkdir which is not the case (see the next bug).

The workaround is the following :
1) remove the return True; at line 804
2) then before the ls at line ~880 override the acl and restore them just after.

et voila :) acl_check are working now under dav system.
Caeies.
PS: patch posted in a few minute.

Caeies <Caeies>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Follow 3 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2004-01-18 skwashd StatusNone Fixed
    Assigned toNone skwashd
    Open/ClosedOpen Closed

Back to the top

Powered by Savane 3.13-d3ae.
Corresponding source code