You are here: Foswiki>Tasks Web>Item8868 (12 Jul 2010, CrawfordCurrie)Edit Attach

Item8868: Security hole in %IF

Priority: Urgent
Current State: Closed
Released In: 1.1.0
Target Release: minor

Applies To: Engine
Component:
Branches:

Reported By: CrawfordCurrie
Waiting For:
Last Change By: CrawfordCurrie

I just realised that %QUERY it can be used to recover sensitive configuration items. Also %IF can be used to test any configuration item.

-- CrawfordCurrie - 09 Apr 2010

Plugged.

-- CrawfordCurrie - 09 Apr 2010

The way I plugged it is utter shite, as shown by the addition of NAMEFILTER. Let's not release with this. Revert this change, and spec a subset of configuration vars that are accessible via %QUERY

-- CrawfordCurrie - 29 Jun 2010

Done, by filtering the visible vars, and promoting the tech to the query parser proper so it's inherited by QUERY, SEARCH and IF. This has the impact that %IF tests on non-exported vars will no longer work, but it's easy to work around if so.

-- CrawfordCurrie - 29 Jun 2010

ItemTemplate edit

Summary	Security hole in %IF
ReportedBy	CrawfordCurrie
Codebase
SVN Range
AppliesTo	Engine
Component
Priority	Urgent
CurrentState	Closed
WaitingFor
Checkins	distro:59291cf3b5c9 distro:146db701235c distro:1d9345fe08ce distro:a598f509fdc3 distro:664c07ec1aca distro:93232c0daaf7 distro:33c7f8810b3f
TargetRelease	minor
ReleasedIn	1.1.0