[#32087] - Make sure the URL installer does not allow other schemas then http and https
- Fixed in Code Base
- 24 Jan 2021
- Medium
- Build: staging
- # 32087
- Diff
- zero-24:url_check
User tests: Successful: Unsuccessful:
Pull Request for an Issue raised to the JSST.
Summary of Changes
Make sure the URL installer does not allow other schemas then http and https
Testing Instructions
- Try to install an extension form this url:
ftp://joomla.zip - Joomla tires to contact an FTP server
- apply this patch
- try
ftp://joomla.zipagain. - There is now a dedicated message and we dont try to contact an FTP server
- make sure that extension installation from URL still works as before.
Actual result BEFORE applying this Pull Request
There is an message but we still try to contact the FTP server
Expected result AFTER applying this Pull Request
There is now a dedicated message and we dont try to contact an FTP server
Documentation Changes Required
none
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Administration com_installer Language & Strings Front End Plugins |
| Labels |
Added:
?
?
|
||
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/32087.
Lol when I reported this years ago I was told it was a non-problem and only idiots would try to use a non http prefix ...
Lol when I reported this years ago I was told it was a non-problem and only idiots would try to use a non http prefix ...
Well its still not handled as security issue but it was reported as one. ;) Given that we had some kind of not working JS "validation" we choose to move this forward to the public tracker and get it fixed anyway.
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/32087.
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/32087.
| Status | Pending | ⇒ | Ready to Commit |
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/32087.
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2021-01-24 15:54:08 |
| Closed_By | ⇒ | drmenzelit | |
| Labels |
Added:
?
|
||
Thanks
Thanks @drmenzelit
I have tested this item✅ successfully on eae250f
Tested successfully in 3.9.25-dev of 20 January using PHP 8.0.1.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/32087.