Re: DotClear Full Path Disclosure Vulnerability

[Raphaël HUCK <raphael.huck () free fr>]

I do agree with you, but I think in this case it is a DotClear issue.

The default themes provided with DotClear do not check that they have 
been called by a regular DotClear page, and spit out useful information 
for an attacker.

They should check that a certain variable is defined for example, and if 
not, do not display anything... even if the hosted website is configured 
to display errors, and you cannot change this.


> > Fatal error: Call to a member function fetch() on a non-object in
> > /home/users/xxxx/dotclear/themes/xxx/list.php on line 34
>
> Note it's not wise to display errors on a production website. However,
> when hosted, you don't necessarily have this choice...