| View Issue Details [ Jump to Notes ] | [ << ] [ >> ] | [ Issue History ] [ Print ] |
| ID | Project | Category | View Status | Date Submitted | Last Update |
| 0000076 | Ninan V2 | GUI | public | 2008-10-29 14:25 | 2009-01-31 19:58 |
|
| Reporter | jmi | |
| Assigned To | | |
| Priority | normal | Severity | trivial | Reproducibility | always |
| Status | new | Resolution | open | |
| Platform | | OS | | OS Version | |
| Product Version | | |
| Target Version | | Fixed in Version | | |
|
| Summary | 0000076: potencial security issue: on GUI each client (not only admin) can see physical location of nzb directory |
| Description | logged in as normal user i can see:
"Current files in /home/ninan/ninan-2.0.0/nzbfiles: "
I hate idea that users can see where are files physically on disk drive. It's potencial security issue. |
| Tags | No tags attached. |
|
| Attached Files |  ninan-76.patch [^] (974 bytes) 2009-01-31 19:58 [Show Content] [Hide Content]Index: ninan-frontend/src/main/java/dk/team/ninan/frontend/wicket/UploadPanel.java
===================================================================
--- ninan-frontend/src/main/java/dk/team/ninan/frontend/wicket/UploadPanel.java (revision 3061)
+++ ninan-frontend/src/main/java/dk/team/ninan/frontend/wicket/UploadPanel.java (working copy)
@@ -63,7 +63,13 @@
ajaxSimpleUploadForm.add(new FeedbackPanel("uploadFeedback"));
// Add folder view
- ajaxSimpleUploadForm.add(new Label("dir", uploadFolder.getAbsolutePath()));
+ String uploadFolderName;
+ if (isAdmin()) {
+ uploadFolderName = uploadFolder.getAbsolutePath();
+ } else {
+ uploadFolderName = uploadFolder.getName();
+ }
+ ajaxSimpleUploadForm.add(new Label("dir", uploadFolderName));
files.addAll(Arrays.asList(uploadFolder.listFiles()));
fileListView = new FileListView("fileList", files);
ajaxSimpleUploadForm.add(fileListView);
|
|
Relationships 
Relationships 