fernando/luos
1
0
Fork 0
Code Releases Activity

BUG 9525 ProcessMaker 404 not found page is vulnerable to exploits SOLVED

Browse Source 
- It is printed directly a variable GET.
- Used htmlentities().
This commit is contained in:
Marco Antonio Nina
2012-08-01 18:37:43 -04:00
parent 5bb42dfbe8
commit dc272e4432
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
gulliver/methods/errors/error404.php
View File

@@ -22,7 +22,10 @@
* Coral Gables, FL, 33134, USA, or email info@colosa.com.
*
*/
session_start();
$session = session_id();
if (empty($session)) {
session_start();
}
if ( isset ( $_SESSION['phpFileNotFound'] ) ) {
$uri = $_SESSION['phpFileNotFound'];
@@ -31,7 +34,8 @@ if ( isset ( $_SESSION['phpFileNotFound'] ) ) {
} else {
$uri = 'undefined';
}
$referer = isset ( $_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : $_SESSION['phpLastFileFound'];
$referer = isset ( $_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] :
(isset($_SESSION['phpLastFileFound']) ? $_SESSION['phpLastFileFound'] : '');
$ERROR_TEXT = "404 Not Found ";
$ERROR_DESCRIPTION = "