Information & destructive operations exposed to unauthenticated users. #146
Comments
NathanGibbs3
added
invalid
|
Development-Latest: Being logged in using $Use_Auth_System = 1; If the logged in user credentials are deleted BASE gets an error: The specified CGI application misbehaved by not returning a complete set of HTTP headers. The headers it did return are "PHP Notice: Unauthorized user access: michael in D:\winids\inetpub\wwwroot\base\includes\base_auth.inc.php on line 563 Attempt Redirect Status: 302 Found X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Location: http://winids/base_main.php Content-type: text/html; charset=UTF-8 ". Not real sure what needs to be done maybe any logged in users should not be able to be deleted until they are logged out? |
|
Opened Issue #156 to track this. Please continue conversation on that Issue's ticket. Thank you for finding this. 😄 |
Wrok om #129 #134 #139 #146 Code Cleanup. File(s): base_common.php : base_conf.php.dist : base_maintenance.php : includes/base_capabilities.php : includes/base_output_html.inc.php : includes/base_state_citems.inc.php : includes/base_state_criteria.inc.php : setup/base_conf_contents.php Code Cleanup. File(s): includes/base_action.inc.php Issue(s): #134 #205 Code Cleanup. File(s): includes/base_auth.inc.php Code Cleanup. Function(s): ARC( $roleneeded ) AuthorizedRole Core, Returns true if the role of current user is authorized, false otherwise. File(s): includes/base_db.inc.php Function(s): filterSql( $item, $force_alert_db, $db ) Moved from includes/base_state_common.inc.php File(s): includes/base_krnl.php Code Cleanup. Bumped Kernel Version to 0.0.4 Provides additional: Base Include Path: Global: $BKI_Path Const: BASE_IPath Routines Loaded: (available at page load): BASE Constants. BASE DB system. File(s): includes/base_log_error.inc.php Issue(s): #134 #146 Code Cleanup. Function(s): ErrorMessage( $message, $color, $br ) : returnErrorMessage( $message, $color, $br ) Moved from RTL. : DDT( $Items, $Desc, $title, $tab, $wd, $vf, $XSS ) Add XSS Flag for table items. : PrintPageHeader() Issue #134 work. File(s): includes/base_log_timing.inc.php Issue(s): #146 Code Cleanup. File(s): includes/base_output_query.inc.php : styles/*.css Issue(s): #129 #139 Code Cleanup. File(s): includes/base_rtl.php Bumped RTL Version to 0.0.8 Code Cleanup. Function(s): ErrorMessage( $message, $color, $br ) : returnErrorMessage( $message, $color, $br ) Removed from RTL. File(s): includes/base_state_common.inc.php Code Cleanup. Function(s): filterSql( $item, $force_alert_db, $db ) Moved to includes/base_db.inc.php File(s): scripts/BASEcli Bumped BASEcli Version to 1.2.2 Added 'debug' and 'dbg' interactive commands to toggle connection debugging mode. Code Cleanup. Unit Test(s): Covers ARC() BaseUser::Authenticate*()
base_maintenance.php&includes/base_log_error.inc.phpincludes/base_log_error.inc.php-PrintPageHeader()Expected Behavior: Less info and NO functionality should be exposed.
Current Behavior: A lot of info and functionality is exposed.
The text was updated successfully, but these errors were encountered: