Feeling Lucky
?
[#14207] - [com_fields] [3.7b3] [SECURITY] The Gallery Fields
- Closed
- 23 Feb 2017
- Medium
- Build: staging
- # 14207
Steps to reproduce the issue
Add a Gallery field with a directory setting outside of the Joomla root
Expected result
I expect that Joomla should not be able to go outside its webspace
Actual result
Time out on my local machine as ../../../ eventually gets to the / and tries to list all folders on my mac
With different values of "directory" I can access different places on the server
System information (as much as possible)
Additional comments
joomla-cms-bot
- | Labels |
Added:
?
|
||
| Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2017-02-23 18:53:12 |
| Closed_By | ⇒ | zero-24 |
Also if I set the folder to be (outside of the joomla root) /Users/phil/Sites/remotebfb/Users/phil/Dropbox/CameraUploads
And then select "One"., the folder name that is at /Users/phil/Sites/remotebfb/Users/phil/Dropbox/CameraUploads/One
And then render on the frontend I get: