Bugzilla – Attachment 6443 Details for
Bug 6628
[security] help system use insecure REFERRER for file inclusion
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[3.2.x] Bug 6628 fixing security vulnerability
32x-Bug-6628-fixing-security-vulnerability.patch (text/plain), 656 bytes, created by
Chris Cormack
on 2011-11-28 10:15:20 UTC
(
hide
)
Description:
[3.2.x] Bug 6628 fixing security vulnerability
Filename:
MIME Type:
Creator:
Chris Cormack
Created:
2011-11-28 10:15:20 UTC
Size:
656 bytes
patch
obsolete
>From 175af6ab12a5c2c862385fa41904c5e3fee1b68b Mon Sep 17 00:00:00 2001 >From: Chris Cormack <chrisc@catalyst.net.nz> >Date: Mon, 28 Nov 2011 23:14:32 +1300 >Subject: [PATCH] [3.2.x] Bug 6628 fixing security vulnerability > >--- > help.pl | 5 ++++- > 1 files changed, 4 insertions(+), 1 deletions(-) > >diff --git a/help.pl b/help.pl >index f871e3c..2da9044 100755 >--- a/help.pl >+++ b/help.pl >@@ -37,7 +37,10 @@ if ($referurl) { > } > > $refer =~ /.*koha\/(.*)\.pl.*/; >-my $from = "modules/help/$1.tmpl"; >+my $file = $1; >+$file =~ s/[^a-zA-Z0-9_\-\/]*//g; >+my $from = "modules/help/$file.tmpl"; >+ > > my $template = gethelptemplate( $from, "intranet" ); > >-- >1.7.5.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 6628
:
6413
|
6417
|
6440
| 6443 |
6444