[Patch] Minor path travelsal vulnerability
|Reported by:||tinus||Owned by:||rjollos|
If the 'file' field in the 'download' table can be manipulated, the DownloadsPlugin allows a user to download any file that can be accessed by the Trac user.
Attached is a patch that uses the basename function prior to concatenating the path to foil this attack.
Change History (4)
Changed 4 years ago by tinus
comment:1 Changed 4 years ago by rjollos
- Summary changed from minor path travelsal vulnerability to [Patch] Minor path travelsal vulnerability