Anonymous can read everything via search
- Status
- Closed
- Subject
- Anonymous can read everything via search
- Version
- 1.8.x
1.9.x - Category
- Error
- Usability
- Feature
- Forum
Search
User Administration (Registration, Login & Banning) - Resolution status
- Works For Me
- Submitted by
- Andriy Podanenko
- Volunteered to solve
- amette
- Lastmod by
- amette
- Rating
- Description
When enabled feature_search it is possible for
Anonymous user to read protected pages via
special search requestJust try "a" or any other word that is in hidden
or protected area in search box - tiki-
searchresults.php give U text from hidden
pagesfrom tiki-searchresults.php
http://tikiwiki.org/tiki-view_forum_thread.php?
topics_offset=0&forumId=4&comments_parentI
d=16071- Solution
if ($feature_search != 'y')
so for now it is better to disable feature_search
If U have hidden data in your tikiwiki
damian---------------
I can't reproduce it. Both search are pretty secure now and "a" is a small word. Did you try with 1.19.1?
sylvie
I'll do some short testing on that one - if not finding anything - I'll close. For now: PENDING!
- amette- Importance
- 8
- Easy to solve?
- 3
- Priority
- 24
- Demonstrate Bug (Tiki 19+)
-
This bug has been demonstrated on show2.tiki.org
Please demonstrate your bug on show2.tiki.org
Version: Create show2.tiki.org instanceAbout show2.tiki.orgTo help developers solve the bug, we kindly request that you demonstrate your bug on a show2.tiki.org instance. To start, simply select a version and click on "Create show2.tiki.org instance". Once the instance is ready (in a minute or two), as indicated in the status window below, you can then access that instance, login (the initial admin username/password is "admin") and configure the Tiki to demonstrate your bug. Priority will be given to bugs that have been demonstrated on show2.tiki.org.
- Ticket ID
- 242
- Created
- Saturday 18 June, 2005 11:43:45 GMT-0000
by Unknown - LastModif
- Saturday 02 June, 2007 04:12:23 GMT-0000
Attachments
| filename | created | hits | comment | version | filetype | ||
|---|---|---|---|---|---|---|---|
| No attachments for this item | |||||||
;){kind=link}
;){kind=link}
- htaccess.sh is gone from Tiki26 and after the installation you may need to create the symlink manually
- Create new Group function does not work Tiki V26.0 Clean install brand new database
- Manticore install and configuration
- Wiki plugin User list show all the user, the parameter Max of rows is not applied
- Automatic Indexing of Mathematical Calculation Tracker Fields
;){kind=link}
;){kind=link}