View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
20261 | Bug reports | Security | public | 2025-09-10 12:35 | 2025-10-07 16:07 |
Reporter | tibor.pacalat | Assigned To | DenisChenu | ||
Priority | none | Severity | minor | ||
Status | assigned | Resolution | open | ||
Product Version | 6.6.x | ||||
Summary | 20261: Create 400 http error code exception when invalid and potentially harmful parameter values are sent | ||||
Description | This is a follow up to the ticket https://bugs.limesurvey.org/view.php?id=2023 Create 400 http error code exception when invalid and potentially harmful parameter values are sent. | ||||
Steps To Reproduce | Steps to reproduce(Replace this text with detailed step-by-step instructions on how to reproduce the issue) Expected result(Write here what you expected to happen) Actual result(Write here what happened instead) | ||||
Tags | No tags attached. | ||||
Bug heat | 256 | ||||
Complete LimeSurvey version number (& build) | 6.15.10+250901 | ||||
I will donate to the project if issue is resolved | No | ||||
Browser | |||||
Database type & version | . | ||||
Server OS (if known) | |||||
Webserver software & version (if known) | |||||
PHP Version | . | ||||
It's not a global issue : it must be done for each parameter, and move to controller. It's a way to fix when when update. |
|
Telle me how i can create a PR for fixing such situatuation : https://github.com/LimeSurvey/LimeSurvey/blob/master/application/models/QuestionBaseDataSet.php#L41 An App::getSurveyId ? App::getId($string); where string can be survey, question, questiongroup ? My idea Use a getParam (and setParam in https://github.com/LimeSurvey/LimeSurvey/blob/master/application/core/LSYii_Application.php)
I can not start without discussion. I really dislike to work for nothing. |
|
@c_schmitz could you please provide your opinion here? |
|
Start for survey ID here https://github.com/LimeSurvey/LimeSurvey/pull/4469 |
|
Looks fine to me. |
|
I add getGid and getQid after And in my opinion : qid must use sid if exist (then we are sure it's related to the good survey), and maybe if sid is not set : set it. |
|
Date Modified | Username | Field | Change |
---|---|---|---|
2025-09-10 12:35 | tibor.pacalat | New Issue | |
2025-09-10 12:35 | tibor.pacalat | Assigned To | => DenisChenu |
2025-09-10 12:35 | tibor.pacalat | Status | new => assigned |
2025-09-10 14:48 | DenisChenu | Note Added: 83396 | |
2025-09-10 14:48 | DenisChenu | Bug heat | 250 => 252 |
2025-09-10 14:49 | DenisChenu | Note Edited: 83396 | |
2025-09-18 10:38 | DenisChenu | Assigned To | DenisChenu => tibor.pacalat |
2025-09-18 10:38 | DenisChenu | Status | assigned => acknowledged |
2025-09-18 10:38 | DenisChenu | Note Added: 83437 | |
2025-09-18 10:39 | DenisChenu | Note Edited: 83437 | |
2025-10-07 15:06 | DenisChenu | Assigned To | tibor.pacalat => DenisChenu |
2025-10-07 15:35 | tibor.pacalat | Note Added: 83561 | |
2025-10-07 15:35 | tibor.pacalat | Bug heat | 252 => 254 |
2025-10-07 15:45 | DenisChenu | Status | acknowledged => assigned |
2025-10-07 15:45 | DenisChenu | Note Added: 83563 | |
2025-10-07 15:56 | c_schmitz | Note Added: 83564 | |
2025-10-07 15:56 | c_schmitz | Bug heat | 254 => 256 |
2025-10-07 16:07 | DenisChenu | Note Added: 83565 |