![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 4 years ago
Last modified 4 years ago
#55924 new defect (bug)
Search by category can be changed to search invalid month
| Reported by: | floridsleeves | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | Awaiting Review |
| Component: | General | Version: | 6.0 |
| Severity: | normal | Keywords: | |
| Cc: | Focuses: |
Description
In admin 'Posts' page, the search category can be selected by drop down menu:
However, client-side attackers can bypass items in drop down menu by intercepting the 'cat' field in request, which will return data from other non-existing categories.
Possible fix is to add server-side checks to this field to validate whether the category is valid.
Note:
See TracTickets
for help on using tickets.
Related to #55923