Modify

Opened 8 years ago

Closed 8 years ago

Last modified 7 years ago

#1212 closed enhancement (duplicate)

Security issue allowing to download files of the server running trac

Reported by: Daniel Werner Owned by: Blackhex
Priority: highest Component: DoxygenPlugin
Severity: critical Keywords: security
Cc: Trac Release: 0.10

Description

By entering any path and a corresponding file after any of the html files generated by Doxygen in the following url:

http://tracServer/projects/oneProject/doxygen/html/index.html?path=%2fpath%2fto%2fa%2ffile

it allows to download this specified file which is a big security issue.

Attachments (0)

Change History (8)

comment:1 Changed 8 years ago by cboos

  • Resolution set to duplicate
  • Status changed from new to closed

Already reported in #951, yes I know, I'm really lousy with that one :(

A patch would help...

comment:2 follow-up: Changed 8 years ago by cboos

Please check r1983.

comment:3 in reply to: ↑ 2 Changed 8 years ago by Daniel Werner <dan ... moesbar ... net>

Replying to cboos:

Please check r1983.

I tried this patch but it did not resolve the problem :-(

comment:4 follow-up: Changed 8 years ago by cboos

Are you sure you cleared the web browser cache?

Try with another file (never downloaded so far), just to be sure.

comment:5 Changed 8 years ago by Daniel Werner <dan ... moesbar ... net>

arghl!.. can't test it right now!
We will have to wait Monday ! :)

comment:6 Changed 8 years ago by Blackhex

I tryied that right now and it seems to be fixed :-).

comment:7 in reply to: ↑ 4 ; follow-up: Changed 8 years ago by Daniel Werner <dwarf007 ... moesbar ... net>

Replying to cboos:

Are you sure you cleared the web browser cache?

Try with another file (never downloaded so far), just to be sure.

Actually it did not solve the problem on my installation.
I tried with a never downloaded file and I still could download it..
Dunno why!?

comment:8 in reply to: ↑ 7 Changed 8 years ago by Daniel Werner <dwarf007 ... moesbar ... net>

Replying to Daniel Werner <dwarf007 ... moesbar ... net>:

Actually it did not solve the problem on my installation.
I tried with a never downloaded file and I still could download it..
Dunno why!?

sorry... I reinstalled it properly from the svn repository and it worked.
Must have done something wrong the last time.

Add Comment

Modify Ticket

Action
as closed .
The resolution will be deleted. Next status will be 'reopened'.
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.