bugphpGroupWare - Bugs: bug #8359, minor security problem in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #8359: minor security problem in class.vfs_dav.inc.php

Submitted by:  Caeies <Caeies>
Submitted on:  Mon 29 Mar 2004 04:16:26 PM UTC  
 
Category:  API - phpGroupware API Item Group:  0.9.16.000 release
Severity:  3 - Normal Priority:  9 - Immediate
Status:  Fixed Privacy:  Public
Assigned to:  Dave Hall <skwashd> Open/Closed:  Closed
Component Version:  SVN Operating System:  GNU/Linux - Debian
Reproducibility:  Every Time Planned Release:  None
Fixed Release: 

Tue 30 Mar 2004 04:53:07 AM UTC, comment #1: 

Ok, found it - line 2098 on the stock version of the code.

Fixed in cvs.

Please do not post security advisories as bug reports, without attempting to contact someone from the project first.

Cheers

Dave Hall <skwashd>
Project AdministratorIn charge of this item.
Mon 29 Mar 2004 04:16:26 PM UTC, original submission:  

Heya,

When creating the home user directory (from filemanager), using webdav repository, the system failed silently to create a .htaccess when required (in subfolders of the home directory, using the deny in the setup configuration).

The bug is at line 2122 change from this :
 if (!$conf->config_data['acl_default'] == 'grant')

to this :
 if ($conf->config_data['acl_default'] != 'grant')

And please ever use ( ) when using ! in front of the things.
There is a couple of this in this file and we are not sure if they are right or not. Need some deeper review.

Thanks for killing it quickly :)

Caeies, bug hunter.

Caeies <Caeies>
Project Administrator

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

 

 

Follow 3 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2004-03-30 skwashd Open/ClosedOpen => Closed
2004-03-30 skwashd StatusNone => Fixed
    Assigned toNone => skwashd

Back to the top


Powered by Savane 3.5