Modify

Opened 11 years ago

Closed 11 years ago

Last modified 10 years ago

#1212 closed enhancement (duplicate)

Security issue allowing to download files of the server running trac

Reported by: Daniel Werner Owned by: Radek Bartoň
Priority: highest Component: DoxygenPlugin
Severity: critical Keywords: security
Cc: Trac Release: 0.10

Description

By entering any path and a corresponding file after any of the html files generated by Doxygen in the following url:

http://tracServer/projects/oneProject/doxygen/html/index.html?path=%2fpath%2fto%2fa%2ffile

it allows to download this specified file which is a big security issue.

Attachments (0)

Change History (8)

comment:1 Changed 11 years ago by Christian Boos

Resolution: duplicate
Status: newclosed

Already reported in #951, yes I know, I'm really lousy with that one :(

A patch would help...

comment:2 Changed 11 years ago by Christian Boos

Please check r1983.

comment:3 in reply to:  2 Changed 11 years ago by Daniel Werner <dan@…>

Replying to cboos:

Please check r1983.

I tried this patch but it did not resolve the problem :-(

comment:4 Changed 11 years ago by Christian Boos

Are you sure you cleared the web browser cache?

Try with another file (never downloaded so far), just to be sure.

comment:5 Changed 11 years ago by Daniel Werner <dan@…>

arghl!.. can't test it right now! We will have to wait Monday ! :)

comment:6 Changed 11 years ago by Radek Bartoň

I tryied that right now and it seems to be fixed :-).

comment:7 in reply to:  4 ; Changed 11 years ago by Daniel Werner <dan@…>

Replying to cboos:

Are you sure you cleared the web browser cache?

Try with another file (never downloaded so far), just to be sure.

Actually it did not solve the problem on my installation. I tried with a never downloaded file and I still could download it.. Dunno why!?

comment:8 in reply to:  7 Changed 11 years ago by Daniel Werner <dan@…>

Replying to Daniel Werner <dwarf007 ... moesbar ... net>:

Actually it did not solve the problem on my installation. I tried with a never downloaded file and I still could download it.. Dunno why!?

sorry... I reinstalled it properly from the svn repository and it worked. Must have done something wrong the last time.

Modify Ticket

Change Properties
Set your email in Preferences
Action
as closed The owner will remain Radek Bartoň.
The resolution will be deleted.

Add Comment


E-mail address and name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.