Bug #16312 Updated: (SECURITY) Non-CVS users can set statys to anything (including Critical)

ID: 16312 Updated by: jimw@php.net Reported By: nopman@hackermail.com -Status: Critical +Status: Closed Bug Type: Website problem Operating System: Unix PHP Version: 4.1.2 New Comment: This bug has been fixed in CVS. You can grab a snapshot of the CVS version at http://snaps.php.net/. In case this was a documentation problem, the fix will show up soon at http://www.php.net/manual/. Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2002-05-12 13:18:08] derick@php.net TOUCH ------------------------------------------------------------------------ [2002-03-27 12:39:11] sander@php.net Hm... another bug in this system... you can also fake @php.net addresses. This is critical indeed :) ------------------------------------------------------------------------ [2002-03-27 11:34:07] nopman@hackermail.com Damn!! It worked!!!! ------------------------------------------------------------------------ [2002-03-27 11:33:17] nopman@hackermail.com Trying to set this as Critical. "NopMan" ------------------------------------------------------------------------ [2002-03-27 11:30:10] nopman@hackermail.com I read the sources of this error reporting page and found out that you correctly provide list of available State-options, but you do not validate the input. So one can make their own form and add there to be options for Critical,Analyzed etc. I'm pretty sure that it works, but i'll test it with this report. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=16312&edit=1