Bugzilla – Attachment 40610 Details for
Bug 14408
Path traversal vulnerabilty
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 14408 & 14439 - typo fixes for regexes
Bug-14408--14439---typo-fixes-for-regexes.patch (text/plain), 860 bytes, created by
Liz Rea
on 2015-06-25 01:02:07 UTC
(
hide
)
Description:
Bug 14408 & 14439 - typo fixes for regexes
Filename:
MIME Type:
Creator:
Liz Rea
Created:
2015-06-25 01:02:07 UTC
Size:
860 bytes
patch
obsolete
>From 0580342093946f59e8f0f1320f136ad085abe305 Mon Sep 17 00:00:00 2001 >From: Liz Rea <wizzyrea@gmail.com> >Date: Wed, 24 Jun 2015 10:10:18 +1200 >Subject: [PATCH] Bug 14408 & 14439 - typo fixes for regexes > >--- > C4/Auth.pm | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 2545289..5ffab48 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -157,8 +157,8 @@ sub get_template_and_user { > > C4::Context->interface( $in->{type} ); > >- my $safe_chars = 'a-zA-Z_\-\/'; >- die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+.tt?$/ig; #sanitize input >+ my $safe_chars = 'a-zA-Z0-9_\-\/'; >+ die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+\.tt$/ig; #sanitize input > > $in->{'authnotrequired'} ||= 0; > my $template = C4::Templates::gettemplate( >-- >1.9.1
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=40610">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14408
:
40271
|
40336
|
40347
|
40348
|
40374
|
40375
|
40386
|
40387
|
40443
|
40445
|
40446
|
40447
|
40491
|
40492
|
40493
|
40564
| 40610