phpGroupWare - Patches: patch #3923, [Fix] Compatibility with...
You are not allowed to post comments on this tracker with your current authentication level.
patch #3923: [Fix] Compatibility with register_globals off
Submitter: | Doug Kelly <dougk_ff7> | ||
Submitted: | Wed 20 Apr 2005 06:51:13 AM UTC | ||
Category: | registration | Priority: | 6 |
Item Group: | None | Status: | None |
Privacy: | Public | Assigned to: | None |
Open/Closed: | Open |
Attached Files
file #8696: patch-fix-register_globals-dougk_ff7.diff added by dougk_ff7 (2KiB - application/octet-stream - [Fix] register_globals off compatibility)
Depends on the following items: None found
Items that depend on this one: None found
CC list is empty
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follows 1 latest change.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2005-04-20 | dougk_ff7 | Attached File | - | ![]() |
Added patch-fix-register_globals-dougk_ff7.diff, #4477 |
Here's a patch to allow registration to work without register_globals on. It's pretty hackish, but I did design it to try to prevent SQL injection. Perhaps someone will have a better idea and some cleanup for this, though--I'm not terribly familiar with the phpGW source. Most likely, the little function I use to do the replacement on the variables is either somewhere else already, or there's a better way to do it. Either way, it will NOT break when fed a single-quote (so no SQL injection), however it will die when fed a backslash (though not allow exploitation, to the best of my knowledge).