Opened 17 years ago

Closed 13 years ago

#686 closed Bug (expired)

FCKeditor.Net: UserFilesPath

Reported by: anonymous Owned by:
Priority: Normal Milestone:
Component: Server : ASP.Net Version:
Keywords: SF Discussion Cc: Frederico Caldeira Knabben

Description

in "FileWorkerBase.cs" -> "UserFilesPath" property there is a mistake in order to determine which of "sUserFilesPath" variable will be set. Watch this:

[original code]

...
...
// Otherwise use the default value.
if ( sUserFilesPath == null || sUserFilesPath.Length
== 0 )
sUserFilesPath = DEFAULT_USER_FILES_PATH ;

// Try to get from the URL.
if ( sUserFilesPath == null || sUserFilesPath.Length
== 0 )
{
sUserFilesPath = Request.QueryString
["ServerPath"] ;
}
...

code

spotted? "Try to get from the URL." never works.

[new code]

...
...
// Otherwise use the default value.
// Try to get from the URL.
if ( sUserFilesPath == null || sUserFilesPath.Length
== 0 )
{
sUserFilesPath = Request.QueryString
["ServerPath"] ;
}
if ( sUserFilesPath == null || sUserFilesPath.Length
== 0 )
sUserFilesPath = DEFAULT_USER_FILES_PATH ;
...

code

Greetings, Gürhan Başbuğ.


Moved from SF:
http://sourceforge.net/tracker/index.php?func=detail&aid=1368066&group_id=75348&atid=543653

Change History (5)

comment:1 Changed 17 years ago by Martin Kou

Cc: Frederico Caldeira Knabben added

Because of security issues, the possibility of passing the UserFilesPath through the URL has been disabled. It is a quite easily hackable feature. We must still decide if it is a good thing to leave this hole opened on FCKeditor.


Moved from SF. Original poster: fredck

comment:2 Changed 17 years ago by Martin Kou

Reporter: changed from Martin Kou to anonymous

comment:3 Changed 16 years ago by Alfonso Martínez de Lizarrondo

Component: GeneralServer : ASP.Net

comment:4 Changed 16 years ago by Wojciech Olchawa

Keywords: Discussion added

comment:5 Changed 13 years ago by Wiktor Walc

Resolution: expired
Status: newclosed

There is a new ASP.NET control available: CKEditor for ASP.NET. The issue is no longer valid as the new control does not have the built-in file browser and the old one is no longer maintained.

Note: See TracTickets for help on using tickets.
© 2003 – 2022, CKSource sp. z o.o. sp.k. All rights reserved. | Terms of use | Privacy policy