View Issue Details

Jump to NotesJump to History
This bug affects 1 person(s).
 252
IDProjectCategoryView StatusDate SubmittedLast Update
14679Bug reportsSecuritypublic2019-03-22 15:322019-04-02 16:40
ReporterDenisChenu Assigned ToDenisChenu  
PrioritynoneSeveritypartial_block 
Status closedResolutionfixed 
Product Version3.16.x 
Fixed in Version3.17.x 
Summary14679: Theme admin can delete any directory
Description

$templatename is not filtered or tested when deleting theme …

Steps To Reproduce

Put
$("[id^='template_delete_link']").attr("data-post",'{ "templatename": "../../../tmp/assets" }'); at console,
Click on a delete button : directory assets are deleted.

You can don same with config or why not /etc/ …

Additional Information

For screenshot : i create a directory :), else : assets generation broke with php error.

TagsNo tags attached.
Attached Files
Capture d’écran du 2019-03-22 15-27-20.png (5,491 bytes)   
Capture d’écran du 2019-03-22 15-27-20.png (5,491 bytes)   
Capture d’écran du 2019-03-22 15-31-00.png (43,177 bytes)   
Capture d’écran du 2019-03-22 15-31-00.png (43,177 bytes)   
Bug heat252
Complete LimeSurvey version number (& build)3.16.1 github
I will donate to the project if issue is resolvedNo
Browsernot relevant
Database type & versionnot relevant
Server OS (if known)not relevant
Webserver software & version (if known)not relevant
PHP Versionnot relevant

Users monitoring this issue

There are no users monitoring this issue.

Activities

DenisChenu

DenisChenu

2019-03-25 08:40

developer   ~51117

https://github.com/LimeSurvey/LimeSurvey/commit/f9f561ffacaabc69d1e49b80c0970da68575d2c3

Issue History

Date Modified Username Field Change
2019-03-22 15:32 DenisChenu New Issue
2019-03-22 15:32 DenisChenu Status new => assigned
2019-03-22 15:32 DenisChenu Assigned To => DenisChenu
2019-03-22 15:32 DenisChenu File Added: Capture d’écran du 2019-03-22 15-27-20.png
2019-03-22 15:32 DenisChenu File Added: Capture d’écran du 2019-03-22 15-31-00.png
2019-03-22 15:32 DenisChenu View Status public => private
2019-03-22 15:33 DenisChenu Additional Information Updated
2019-03-25 08:40 DenisChenu Note Added: 51117
2019-03-25 08:40 DenisChenu Status assigned => resolved
2019-03-25 08:40 DenisChenu Resolution open => fixed
2019-03-25 08:40 DenisChenu Fixed in Version => 3.16.x
2019-03-25 08:40 DenisChenu Assigned To DenisChenu =>
2019-03-25 08:42 DenisChenu View Status private => public
2019-03-25 08:42 DenisChenu Assigned To => DenisChenu
2019-04-02 16:40 ollehar Status resolved => closed
2019-04-02 16:40 ollehar Fixed in Version 3.16.x => 3.17.x