SiT! Bugs - Project plugin
View Issue Details
0000508Project pluginChartpublic2009-02-19 23:242010-03-04 18:09
ivan 
paulh 
highblockhave not tried
closedfixed 
 
2.1 
0000508: Chart eval()'s unchecked input
While updating paths I noticed that chart.php contains the line

eval("\$$var=cleanvar(\$_REQUEST['$var']);");

oops! This is going to need rewriting as it allows arbitrary php code to be executed.

Although this is slightly mitigated by the fact that a user must be authenticated to reach this line.
security
Issue History
2009-02-19 23:24ivanNew Issue
2009-02-19 23:58ivanTag Attached: security
2009-02-22 15:41paulhNote Added: 0000652
2009-02-22 15:41paulhAssigned To => paulh
2009-02-22 15:41paulhStatusnew => resolved
2009-02-22 15:41paulhResolutionopen => fixed
2009-02-22 15:41paulhFixed in Version => 2.1
2010-03-04 18:09ivanStatusresolved => closed

Notes
(0000652)
paulh   
2009-02-22 15:41   
r5183 resolves this