Authenticated arbitrary code execution

[jvoisin]

An authenticated administrator can execute arbitrary php code by setting the CalDAV base URI, CardDAV base URI, CalDAV/CardDAV base URI, or SQLite file path fields to something like PROJECT_BASEURI . "card.php/" . "${system('id')}" . "/");

This has a relatively small impact, because one has to be logged as admin to execute code.

[evert]

Yea this sucks. I completely rewrote the configuration system in #568 but we'll see what happens with that

[ByteHamster]

This was fixed in #899