Ticket #36 (closed defect: fixed)
Security issue with the Method() method
| Reported by: | PhilippAHartmann | Owned by: | PhilippAHartmann |
|---|---|---|---|
| Priority: | highest | Milestone: | 1.1.6.2 |
| Component: | core | Version: | 1.1.6.0 |
| Severity: | major | Keywords: | |
| Cc: |
Description
Bug reported on the Wikka website by PhilippAHartmann and MunehiroYamakawa.
There's a bug in the Method()-method in wikka.php. The calls to strstr() and strrpos() have a wrong order of arguments. I think, it can be a security issue, since we have access to arbitrary .php-files on the server. Even user-uploaded ones...
Patch suggested at: http://wikka.jsnx.com/WikkaBugs#hn_Problem_with_handlers
Change History
Note: See
TracTickets for help on using
tickets.
