Opened 11 years ago

Closed 11 years ago

# Security issue allowing to download files of the server running trac

Reported by: Owned by: Daniel Werner Radek Bartoň highest DoxygenPlugin critical security 0.10

### Description

By entering any path and a corresponding file after any of the html files generated by Doxygen in the following url:

 http://tracServer/projects/oneProject/doxygen/html/index.html?path=%2fpath%2fto%2fa%2ffile

it allows to download this specified file which is a big security issue.

### comment:1 Changed 11 years ago by Christian Boos

Resolution: → duplicate new → closed

Already reported in #951, yes I know, I'm really lousy with that one :(

A patch would help...

### comment:3 in reply to:  2 Changed 11 years ago by Daniel Werner <dan@…>

I tried this patch but it did not resolve the problem :-(

### comment:4 follow-up:  7 Changed 11 years ago by Christian Boos

Are you sure you cleared the web browser cache?

Try with another file (never downloaded so far), just to be sure.

### comment:5 Changed 11 years ago by Daniel Werner <dan@…>

arghl!.. can't test it right now! We will have to wait Monday ! :)

### comment:6 Changed 11 years ago by Radek Bartoň

I tryied that right now and it seems to be fixed :-).

### comment:7 in reply to:  4 ; follow-up:  8 Changed 11 years ago by Daniel Werner <dan@…>

Are you sure you cleared the web browser cache?

Try with another file (never downloaded so far), just to be sure.

Actually it did not solve the problem on my installation. I tried with a never downloaded file and I still could download it.. Dunno why!?

### comment:8 in reply to:  7 Changed 11 years ago by Daniel Werner <dan@…>

Replying to Daniel Werner <dwarf007 ... moesbar ... net>:

Actually it did not solve the problem on my installation. I tried with a never downloaded file and I still could download it.. Dunno why!?

sorry... I reinstalled it properly from the svn repository and it worked. Must have done something wrong the last time.

### Modify Ticket

Change Properties