There is no control on the value entered for month at tiki-syslog.php
- Status
- Closed
- Subject
- There is no control on the value entered for month at tiki-syslog.php
- Version
- 27.x
29.x
master
30.x - Category
- Bug
- Easy for Newbie Dev
- Feature
- Logs (system & action)
- Resolution status
- Fixed or Solved
- Submitted by
- Bernard Sfez / Tiki Specialist
- Lastmod by
- Bernard Sfez / Tiki Specialist
- Rating
- Description
At tiki-syslog.php it is possible to delete older logs by using the field "Clean logs older than".
This field is expecting a numeric value (the number of month) but it is possible to type anything, even text.https://example.com/tiki-syslog.php?months=tikiwiki&clean=Clean
Then land on the "Please confirm action" dialog (without knowing what we confirm ?) and execute the action.It should not be possible to type something else than a number and the user should be warned way ahead:
"You must enter a number of month..." or something like that.- Solution
- Workaround
- Importance
- 8
- Easy to solve?
- 10 easy
- Priority
- 80
- Demonstrate Bug on Tiki 19+
-
This bug has been demonstrated on show2.tiki.org
Please demonstrate your bug on show2.tiki.org
Show.tiki.org is not configured properlyThe public/private keys configured to connect to show2.tiki.org were not accepted. Please make sure you are using RSA keys. Thanks.
- Demonstrate Bug (older Tiki versions)
-
This bug has been demonstrated on show.tikiwiki.org
Please demonstrate your bug on show.tikiwiki.org
Show.tiki.org is not configured properlyThe public/private keys configured to connect to show.tikiwiki.org were not accepted. Please make sure you are using RSA keys. Thanks.
- Ticket ID
- 8712
- Created
- Sunday 13 October, 2024 09:11:09 UTC
by Bernard Sfez / Tiki Specialist - LastModif
- Wednesday 07 May, 2025 07:39:06 UTC