| Index
» Projects
» phpMyEdit
» Bug list
» Bug #641 |
 |
|
Viewing Bug Advanced Details |
[ Jump to Bugnotes ]
[ Bug History ]
[ Print ]
|
|
ID |
Category |
Severity |
Reproducibility |
Date Submitted |
Last Update |
|
0000641 |
core / general |
minor |
always |
2009-05-30 00:01 |
2009-05-30 00:01 |
|
|
|
Reporter |
jay |
View Status |
public |
|
|
Assigned To |
|
|
Priority |
normal |
Resolution |
open |
Platform |
phpMyEdit |
|
Status |
new |
Duplicate ID |
|
OS |
|
|
Projection |
none |
|
Version |
|
|
ETA |
none |
|
Product Version |
5.7.1 (stable) |
|
|
Product Build |
|
|
|
Votes |
1 |
|
|
|
Summary |
It is easy to bypass filters |
|
Description |
I'm not sure if the intended function of the filters is for security, but we use the filters to prevent unauthorized users from seeing certain database fields. However, it was found that the filters in list view could be bypassed by going directly to a "view" url such as:
http://localhost/admin.php?PME_sys_fl=0&PME_sys_fm=0&PME_sys_sfn[0]=1&PME_sys_operation=PME_op_View&PME_sys_rec=1758
|
|
Steps To Reproduce |
|
|
Additional Information / Solution |
I fixed the issue by inserting the following code at line 563:
if ($this->filters)
$ret .= ' AND '.$this->filters; |
|
Attached Files |
|
|
|
|
There are no notes attached to this bug. |
|
|
Login
Registration
Slovak
