Issue tracker moved to https://gitlab.archlinux.org/archlinux/aurweb/-/issues
FS#5403 - AUR allows (Un)Safe Flag for non-privileged users
Attached to Project:
AUR web interface
Opened by Thomas Bächler (brain0) - Thursday, 14 September 2006, 10:48 GMT
Opened by Thomas Bächler (brain0) - Thursday, 14 September 2006, 10:48 GMT
|
DetailsI looked over the AUR code for the first time and noticed a security vulnerability which can be witnessed here:
http://aur.archlinux.org/packages.php?do_Details=1&ID=6098 As you can see, this page says "The above files have been verified (by aursecurityvulnerability) and are safe to use.", while "aursecurityvulnerability" is an unprivileged user I created. The problem is in web/html/packages.php at the line if (!empty($ids) || $atype == "User") which should probably be one of if (!empty($ids) && $atype != "User") if (!(empty($ids) || $atype == "User")) |
This task depends upon
Closed by Simo Leone (neotuli)
Sunday, 17 September 2006, 20:37 GMT
Reason for closing: Fixed
Additional comments about closing: if (!empty($ids) && $atype == "Trusted User")
I didn't actually test the fix though... someone might wanna do that.
Sunday, 17 September 2006, 20:37 GMT
Reason for closing: Fixed
Additional comments about closing: if (!empty($ids) && $atype == "Trusted User")
I didn't actually test the fix though... someone might wanna do that.
I going to look at it.