[#15794] - Frontend com_config issues
- Closed
- 10 Feb 2019
- Medium
- Build: master
- # 15794
Steps to reproduce the issue
login as super admin to frontend joomla 4
http://joomla4/index.php?option=com_config&view=modules = Call to a member function getLabel() on null
http://joomla4/index.php?option=com_config&view=templates = Call to a member function getFieldsets() on null
http://joomla4/index.php?option=com_config&view=config = Call to a member function getFieldset() on null
E.g.
joomla-cms-bot
- | Labels |
Added:
?
|
||
franz-wohlkoenig
- | Category | ⇒ | com_config Front End |
| Title |
|
||||||
| Title |
|
||||||
| Status | New | ⇒ | Discussion |
| Title |
|
||||||
its true that you get an error if you go to the reported urls but i dont see where you can generate those urls except by typing them directly
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/15794.
And there lies in the bug, hackers don't care if you cannot generate urls, they will find a way to generate urls manually, and test that the result in output has some juicy information - these urls luckily generate error messages, instead of disclosing information
NO url I can craft to your site should return a PHP fatal error, information disclosure or the like, this should be correctly handled.
as they correctly disclose error messages and do not disclose information what is the problem
They do not "correctly" disclose error messages - that is the whole point. They disclose PHP errors, not correctly handled errors and exceptions.
| Labels |
Added:
J4 Issue
|
||
| Title |
|
||||||
This is a v3 issue and not v4. Removed [4.0] from title.
@brianteeman Please change label to J3 Issue. Thanks.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/15794.
zero-24
- | Labels |
Added:
J3 Issue
Removed: J4 Issue |
||
| Status | Discussion | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2019-02-10 21:33:46 |
| Closed_By | ⇒ | PhilETaylor |
I don't know how com_config is used in frontend but just checked and saw that the same error happens with Joomla 3.7, so this is not really an issue with Joomla 4