Bug #16312 Updated: (SECURITY) Non-CVS users can set statys to anything (including Critical)
| From: | sander@php.net | Date: | Wed, 27 Mar 2002 17:39:11 +0000 |
| Subject: | Bug #16312 Updated: (SECURITY) Non-CVS users can set statys to anything (including Critical) | ||
| References: | 1 | Groups: | php.mirrors |
| Request: | Send a blank email to php-mirrors+get-9307@lists.php.net to get a copy of this message | ||
ID: 16312
Updated by: sander@php.net
Reported By: nopman@hackermail.com
Status: Critical
Bug Type: Website problem
Operating System: Unix
PHP Version: 4.1.2
New Comment:
Hm... another bug in this system... you can also fake @php.net
addresses.
This is critical indeed :)
Previous Comments:
------------------------------------------------------------------------
[2002-03-27 11:34:07] nopman@hackermail.com
Damn!! It worked!!!!
------------------------------------------------------------------------
[2002-03-27 11:33:17] nopman@hackermail.com
Trying to set this as Critical.
"NopMan"
------------------------------------------------------------------------
[2002-03-27 11:30:10] nopman@hackermail.com
I read the sources of this error reporting page and found
out that you correctly provide list of available
State-options, but you do not validate the input.
So one can make their own form and add there to be options
for Critical,Analyzed etc.
I'm pretty sure that it works, but i'll test it with this report.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=16312&edit=1