|
phpMyEdit - Viewing Bug Advanced Details |
[ Go Back ]
|
|
|
ID:
|
Category:
|
Severity:
|
Reproducibility:
|
Date Submitted:
|
Last Update:
|
|
647 |
core / general |
minor |
always |
2009-05-30 00:02 |
2009-05-30 00:02 |
|
|
Reporter:
|
jay |
Platform:
|
phpMyEdit |
|
|
Assigned To:
|
|
OS:
|
|
|
|
Priority:
|
normal |
Version:
|
|
|
|
Status:
|
new |
Product Version:
|
5.7.1 (stable) |
|
|
Product Build:
|
|
Resolution:
|
open |
|
|
Projection:
|
none |
Duplicate ID:
|
|
|
|
ETA:
|
none |
|
|
|
Summary:
|
It is easy to bypass filters |
|
Description:
|
I'm not sure if the intended function of the filters is for security, but we use the filters to prevent unauthorized users from seeing database fields. It was found that the filters in list view could be bypassed by going directly to a "view" url. |
|
Steps To Reproduce:
|
|
|
Additional Information / Solution:
|
if ($this->filters)
$ret .= ' AND '.$this->filters; |
|
Attached Files:
|
|