cvs: phpweb / release_4_1_0.php
| From: | Zeev Suraski | Date: | Mon, 10 Dec 2001 23:07:35 +0000 |
| Subject: | cvs: phpweb / release_4_1_0.php | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-7753@lists.php.net to get a copy of this message | ||
zeev Mon Dec 10 18:07:35 2001 EDT
Modified files:
/phpweb release_4_1_0.php
Log:
Fix
Index: phpweb/release_4_1_0.php
diff -u phpweb/release_4_1_0.php:1.3 phpweb/release_4_1_0.php:1.4
--- phpweb/release_4_1_0.php:1.3 Mon Dec 10 17:56:46 2001
+++ phpweb/release_4_1_0.php Mon Dec 10 18:07:35 2001
@@ -127,12 +127,12 @@
a part of the global namespace, automatically) are very often
exploitable to various degrees. For example, the piece of code:
-<?php
+<?php
if (authenticate_user()) {
$authenticated = true;
}
...
-?>
+?>
May be exploitable, as remote users can simply pass on 'authenticated'
as a form variable, and then even if authenticate_user() returns false,