Opened 17 years ago
Last modified 17 years ago
#1259 confirmed Bug
Perl connector does not conform to our standards
Reported by: | Wiktor Walc | Owned by: | |
---|---|---|---|
Priority: | Normal | Milestone: | |
Component: | Server : Perl | Version: | |
Keywords: | Cc: |
Description
Each connector uses it's own config file, perl's not. And correct me if I'm wrong, it contains a possible security hole here:
if($FORM{'ServerPath'} ne "") { $GLOBALS{'UserFilesPath'} = $FORM{'ServerPath'}; if(!($GLOBALS{'UserFilesPath'} =~ /\/$/)) { $GLOBALS{'UserFilesPath'} .= '/' ; } } else { $GLOBALS{'UserFilesPath'} = '/userfiles/'; }
by sending malformed ServerPath we can make some bad things. I think that it would be good to adjust perl connector to our standards (so that ServerPath could be defined in cofig file, not as a part of url) and btw. it would be good to make it's own page in http://wiki.fckeditor.net/ (Integration section).
Change History (2)
comment:1 Changed 17 years ago by
Component: | File Browser → Server : Perl |
---|
comment:2 Changed 17 years ago by
Keywords: | Confirmed added |
---|