phpMyEdit - Viewing Bug Advanced Details			[ Go Back ]
ID:	Category:	Severity:	Reproducibility:	Date Submitted:	Last Update:
641	core / general	minor	always	2009-05-30 00:01	2009-05-30 00:01
Reporter:	jay	Platform:	phpMyEdit
Assigned To:		OS:
Priority:	normal	Version:
Status:	new	Product Version:	5.7.1 (stable)
Product Build:		Resolution:	open
Projection:	none	Duplicate ID:
ETA:	none
Summary:	It is easy to bypass filters
Description:	I'm not sure if the intended function of the filters is for security, but we use the filters to prevent unauthorized users from seeing certain database fields. However, it was found that the filters in list view could be bypassed by going directly to a "view" url such as: http://localhost/admin.php?PME_sys_fl=0&PME_sys_fm=0&PME_sys_sfn[0]=1&PME_sys_operation=PME_op_View&PME_sys_rec=1758
Steps To Reproduce:
Additional Information / Solution:	I fixed the issue by inserting the following code at line 563: if ($this->filters) $ret .= ' AND '.$this->filters;
Attached Files:

There are no notes attached to this bug.