Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

FUD Full Path Disclosure in #222

Open
TeamAlexandriZ opened this issue Jul 23, 2015 · 1 comment
Open

FUD Full Path Disclosure in #222

TeamAlexandriZ opened this issue Jul 23, 2015 · 1 comment

Comments

@TeamAlexandriZ
Copy link

Hi,
Shaarli 0.0.41 beta is prone to FPD (Full Path Disclosure) :
Cookie input shaarli was set to nothing or long value as c0ZqcWF3VFE2NmJBdm1HMVQ0ZHJ3UmZPbTFsNGhkNHI=

error found :
Warning: session_start(): The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in /var/www/FUD
This cookie input affect the site shaarli.fr too. See screen
shaarlifud
@Knah-Tsaeb
Copy link
Contributor

This issue affect Shaarli and all fork I think.
Thanks for reporting.

Knah-Tsaeb added a commit to Knah-Tsaeb/myShaarli that referenced this issue Jul 24, 2015
@Knah-Tsaeb
[fix] sebsauvage#222 FUD Full Path Disclosure
be58e68
@Knah-Tsaeb Knah-Tsaeb mentioned this issue Jul 24, 2015
Closed
Knah-Tsaeb added a commit to Knah-Tsaeb/myShaarli that referenced this issue Jul 24, 2015
@Knah-Tsaeb
[fix] sebsauvage#222 FUD Full Path Disclosure
c6a6780
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@Knah-Tsaeb @TeamAlexandriZ