|
|
Re: CVS: squirrelmail/include init.php,1.19,1.20: msg#00042
|
Subject: |
Re: CVS: squirrelmail/include init.php,1.19,1.20 |
On 9/18/06, Tomas Kuliavas
<tokul-Rn4VEauK+AKRv+LV9MX5uipxlwaOVQ5f@xxxxxxxxxxxxxxxx> wrote:
> > Update of /cvsroot/squirrelmail/squirrelmail/include
> > In directory sc8-pr-cvs8.sourceforge.net:/tmp/cvs-serv27358/include
> >
> > Modified Files:
> > init.php
> > Log Message:
> > Stylesheets provided with templates won't load unless we load up prefs for
> > stylesheets too
>
> style.php should not use preferences. All options must be submitted in GET
> request.
What goes wrong? Is this vulnerable to attack? Problem is that the
template directory falls back to templates/default which is incorrect
unless you are in fact actually using the default template set. I
would think it's not too hard to pass the template directory value as
a GET.... ugh.
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
|
| |
