Bugtraq mailing list archives
Re: Path Disclosure in Turba of Horde
From: Anil Madhavapeddy <anil () recoil org>
Date: Sat, 17 May 2003 19:47:00 +0100
On Sat, May 17, 2003 at 01:18:59PM -0000, Lorenzo Manuel Hernandez Garcia-Hierro wrote:
There is a path disclosure in status.php of Turba module at Horde 2.1, you get this: Fatal error: Call to a member function on a non-object in /opt/local/apache/htdocs/horde/turba/status.php on line 12 NOTE: i observed that this only occur in Turba....
This is a bit of a silly advisory ... the recommended production deployment for PHP is to point run-time error logging to a file, and not the script output. Have a look at the 'display_errors' and 'log_errors' entries in your php.ini. Once you set these appropriately, any PHP errors (including the above) will be safely stored in a log-file for the admin to look at. Anil
Current thread:
- Path Disclosure in Turba of Horde Lorenzo Manuel Hernandez Garcia-Hierro (May 17)
- Re: Path Disclosure in Turba of Horde Anil Madhavapeddy (May 17)