-
Notifications
You must be signed in to change notification settings - Fork 4.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Full path disclosure due to Undefined index #2998
Full path disclosure due to Undefined index #2998
Conversation
I don't see how this can happen, and I can't reproduce. Line 158 of admin/index.php: Which is going run the check function on line 103 of admin/controller/common/login.php. It's going to fail the check at line 124 because you are not logged-in and the route is not ignored, so now we are sent to the login page. There is no way to hit the error/not_found.php file if you are not logged in. Please advise me if I am wrong, but like I said, I cannot reproduce this issue. |
As you can see in the image above I see the warning coming from I debugged opencart and I think the problem is I'm asking for a page that does not require login ( Does it make sense? |
Good catch. Only seems to be reproducible with a route that is route=common/login/xxx or in the ignore array on line 118 of admin/controller/common/login.php A possible solution that may be better would be to change the check inside of the check() function of login.php to something like:
This allows the pages that need to be accessed in the ignore table to be accessed, while rejecting weird things such as route=common/login/somethinghere |
You're right, it is a better solution. I'll update my pull request in minutes. |
This reverts commit ab87344.
…e=common/login/xxx")
Didn't think about the simple solution - nice. |
Full path disclosure due to Undefined index
Perfect, thanks. |
In admin panel, if you are not logged in, and generate a
404 Not Found
error with something like<youdomain>/admin/index.php?route=common/login/XXX
anUndefined index
warning will appears leading toFull Path Disclosure
issue.