Bugzilla – Attachment 6413 Details for
Bug 6628
[security] help system use insecure REFERRER for file inclusion
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 6628 : Stopping a potential vulnerability
Bug-6628--Stopping-a-potential-vulnerability.patch (text/plain), 761 bytes, created by
Chris Cormack
on 2011-11-25 18:42:16 UTC
(
hide
)
Description:
Bug 6628 : Stopping a potential vulnerability
Filename:
MIME Type:
Creator:
Chris Cormack
Created:
2011-11-25 18:42:16 UTC
Size:
761 bytes
patch
obsolete
>From 0e4116eec7d6aa1c9c1863bbe5c4033c2395bc66 Mon Sep 17 00:00:00 2001 >From: Chris Cormack <chrisc@catalyst.net.nz> >Date: Sat, 26 Nov 2011 07:39:51 +1300 >Subject: [PATCH] Bug 6628 : Stopping a potential vulnerability > >--- > help.pl | 4 +++- > 1 files changed, 3 insertions(+), 1 deletions(-) > >diff --git a/help.pl b/help.pl >index 18d27dd..74f53ef 100755 >--- a/help.pl >+++ b/help.pl >@@ -32,7 +32,9 @@ our $refer = $query->param('url'); > $refer = $query->referer() if !$refer || $refer eq 'undefined'; > > $refer =~ /koha\/(.*)\.pl/; >-my $from = "help/$1.tt"; >+my $file = $1; >+$file =~ s/[^a-zA-Z_\-\/]*//g; >+my $from = "help/$file.tt"; > > my $template = C4::Templates::gettemplate($from, 'intranet', $query); > $template->param( referer => $refer ); >-- >1.7.5.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 6628
:
6413
|
6417
|
6440
|
6443
|
6444