| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sun, 11 Mar 2007 15:50:09 -0400
From: Paul Laudanski <paul@...tlecops.com>
To: programmer@...biansite.com
Cc: bugtraq@...urityfocus.com
Subject: Re: PHP-Nuke <= 8.0 Cookie Manipulation (lang)
programmer@...biansite.com wrote:
> Patch:
>
> } elseif (isset($lang)) {
> if (eregi('[A-Za-z]', $lang)) {
> if (file_exists("language/lang-".$lang.".php")) {
> include_once("language/lang-".$lang.".php");
> $currentlang = $lang;
> }else {
> include_once("language/lang-english.php");
> $currentlang = "english";
> }
> }else {
> include_once("language/lang-english.php");
> $currentlang = "english";
> }
> } else {
>
> /////////////////////////////////////////////////////////////////////////////////////////////////
> Best Regards
> Aleksandar
> Programmer and Web Developer
> ///////////////////////////////////////////////////////////////////////////////////////////////
>
>
Building on your patch you'd want to incorporate basename(). You never
want to accept directory traversal attempts into variables.
Paul Laudanski, CastleCops
http://www.linkedin.com/pub/1/49a/17b
Submit Phish: www.castlecops.com/pirt
www.castlecops.com | de.castlecops.com | wiki.castlecops.com
Powered by blists - more mailing lists