[pLog-svn] [Lifetype Vulnerability] Very Serious FileDisclosureProblem (read passwords/config whatever you want)

[Mark Wu]

Because it is eaiser for user to add their own profile without modify the
code.

Mark 

> -----Original Message-----
> From: plog-svn-bounces at devel.lifetype.net 
> [mailto:plog-svn-bounces at devel.lifetype.net] On Behalf Of 
> Ammar Ibrahim
> Sent: Wednesday, February 14, 2007 8:27 PM
> To: plog-svn at devel.lifetype.net
> Subject: Re: [pLog-svn] [Lifetype Vulnerability] Very Serious 
> FileDisclosureProblem (read passwords/config whatever you want)
> 
> Since you know all the valid profiles, why don't you use a 
> whitelist approach? e.g.
> 
> switch($profile){
>      case 'rss20':
>      case 'rss10':
>            //valid
> }
> 
> On 2/14/07, Oscar Renalias <oscar at renalias.net> wrote:
> > I thought that was the case, but there is a way to go 
> around that. I 
> > didn't know how to do it either until I saw proof...
> >
> > On 14 Feb 2007, at 11:34, howard chen wrote:
> >
> > > On 2/14/07, Mark Wu <markplace at gmail.com> wrote:
> > >> Hi Howard:
> > >>
> > >> Take a look at revision 4731 and 4732.
> > >>
> > >> Mark
> > >>
> > >
> > > i have look at the patch, but seems this is not as serious as it 
> > > supposed to be?
> > >
> > > seems profile must be ended with a .template extension, 
> the system 
> > > is safe though.
> > > _______________________________________________
> > > pLog-svn mailing list
> > > pLog-svn at devel.lifetype.net
> > > http://limedaley.com/mailman/listinfo/plog-svn
> > >
> >
> > _______________________________________________
> > pLog-svn mailing list
> > pLog-svn at devel.lifetype.net
> > http://limedaley.com/mailman/listinfo/plog-svn
> >
> _______________________________________________
> pLog-svn mailing list
> pLog-svn at devel.lifetype.net
> http://limedaley.com/mailman/listinfo/plog-svn
>