Bug #16312: (SECURITY) Non-CVS users can set statys to anything (including Critical)

From: nopman@hackermail.com Operating system: Unix PHP version: 4.1.2 PHP Bug Type: Website problem Bug description: (SECURITY) Non-CVS users can set statys to anything (including Critical) I read the sources of this error reporting page and found out that you correctly provide list of available State-options, but you do not validate the input. So one can make their own form and add there to be options for Critical,Analyzed etc. I'm pretty sure that it works, but i'll test it with this report. -- Edit bug report at http://bugs.php.net/?id=16312&edit=1 -- Fixed in CVS: http://bugs.php.net/fix.php?id=16312&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=16312&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=16312&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=16312&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=16312&r=support Expected behavior: http://bugs.php.net/fix.php?id=16312&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=16312&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=16312&r=submittedtwice