Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

Security issue in render_file

#35

render_file allows accessing any files from outside public folder using ../.
Can be solved with a quick fic by stripping those ../

I plan to add an improved security policy with a safe_dir option.

(Thx to Zncdr who reported that issue)

Reported by Fabrice Luraine · November 30th, 2009 @ 09:42 AM

State: resolved
Milestone: none
Assigned to: Fabrice Luraine Fabrice Luraine

Activity

  1. Fabrice Luraine
    Fabrice Luraine
    • State changed from new to resolved

    (from [c99be76fc22bbd5de7e167fab8100e800bf5ce55]) Fixing big security issue in render_file that allows accessing any files from outside public folder using ../ Improved security behaviour will be added later (with a safe_dir option). [#35 state:resolved]
    http://github.com/sofadesign/limonade/commit/c99be76fc22bbd5de7e167...

    November 30th, 2009 @ 09:50 AM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.