New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

security question, fix arbitrary file read #3383

Merged

astaxie merged 1 commit into beego:develop from LockGit:develop

Nov 8, 2018

Contributor

LockGit commented Nov 7, 2018 •

edited

When use file type session in the beego framework，Hacker can use "../" modify the sessionID value，

Then directory crossing read any file , So I think beego should check the sessionID before read it.

Some example:

1，https://www.anquanke.com/post/id/163575

2，gogs/gogs#5469


          security question, fix arbitrary file read

impakho mentioned this pull request

allow attacker unauthorized access to user account mindoc-org/mindoc#384

Closed

astaxie merged commit 8391d26 into beego:develop

DennisMao mentioned this pull request

Merged

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment