| phpMyEdit - Viewing Bug Advanced Details | [ Go Back ] | ||||
|
|
|||||
| ID: | Category: | Severity: | Reproducibility: | Date Submitted: | Last Update: |
| 639 | core / general | minor | always | 2009-05-30 00:00 | 2009-05-30 00:00 |
|
|
|||||
| Reporter: | jay | Platform: | phpMyEdit | ||
| Assigned To: | OS: | ||||
| Priority: | normal | Version: | |||
| Status: | new | Product Version: | 5.7.1 (stable) | ||
| Product Build: | Resolution: | open | |||
| Projection: | none | Duplicate ID: | |||
| ETA: | none | ||||
|
|
|||||
| Summary: | It is easy to bypass filters | ||||
| Description: |
I'm not sure if the intended function of the filters is for security, but we use the filters to prevent unauthorized users from seeing certain database fields. However, it was found that the filters in list view could be bypassed by going directly to a "view" url such as: http://localhost/admin.php?PME_sys_fl=0&PME_sys_fm=0&PME_sys_sfn[0]=1&PME_sys_operation=PME_op_View&PME_sys_rec=1758 |
||||
| Steps To Reproduce: | |||||
| Additional Information / Solution: |
I fixed the issue by inserting the following code at line 563: if ($this->filters) $ret .= ' AND '.$this->filters; |
||||
| Attached Files: | |||||
| There are no notes attached to this bug. |