[pLog-svn] [Lifetype Vulnerability] Very Serious FileDisclosure Problem (read passwords/config whatever you want)

[Ammar Ibrahim]

Since you know all the valid profiles, why don't you use a whitelist
approach? e.g.

switch($profile){
     case 'rss20':
     case 'rss10':
           //valid
}

On 2/14/07, Oscar Renalias <oscar at renalias.net> wrote:
> I thought that was the case, but there is a way to go around that. I
> didn't know how to do it either until I saw proof...
>
> On 14 Feb 2007, at 11:34, howard chen wrote:
>
> > On 2/14/07, Mark Wu <markplace at gmail.com> wrote:
> >> Hi Howard:
> >>
> >> Take a look at revision 4731 and 4732.
> >>
> >> Mark
> >>
> >
> > i have look at the patch, but seems this is not as serious as it
> > supposed to be?
> >
> > seems profile must be ended with a .template extension, the system is
> > safe though.
> > _______________________________________________
> > pLog-svn mailing list
> > pLog-svn at devel.lifetype.net
> > http://limedaley.com/mailman/listinfo/plog-svn
> >
>
> _______________________________________________
> pLog-svn mailing list
> pLog-svn at devel.lifetype.net
> http://limedaley.com/mailman/listinfo/plog-svn
>