Can you make a Security group, add people to it, and only give them access to view those bugs? Don’t know if that’s possible in Flyspray.
From the little bit of research I did, I don’t think that is possible. But I could be totally wrong.
-
MODX Staff
- 12,272 Posts
Any code tested to fix these on the bugtrackers?
Ryan Thrash, MODX Co-Founder
Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
Yeap, that solve the problem Timon for the real id, when accessing the page using inde.php. But we still need to send the right error message for calling id using rewrite rule, which it will be handle by alias method, instead of id. I think openagate in the public forum mention about victor’s solution, so I believe this is suppose to be fixed already for handling uncorrect alias number/alias name/alias path.
Another thing that we can add Timon, you might want to make sure that the id is being entered in the right positive integer format, instead of converting it into an integer if possible, which gives the wrong pressumption for the user accessing the site.
That’s just some of my input. With just the above code, we avoid SQL injection through alias or id problem all at once, so the issue now is just about the way to handle the right error for the page.
Sincere
In response to the nice
fix provided by netnoise I got to wondering how the Eto folks were handling such issues (I won’t deny my roots! LOL). So I looked at the recently released 0.6.1 version and saw this (php tags added by me for highlighting):
<?php
function getDocumentIdentifier($method) {
// function to test the query and find the retrieval method
switch($method) {
case "alias" :
return strip_tags($_REQUEST['q']);
break;
case "id" :
return strip_tags($_REQUEST['id']);
break;
case "none" :
return $this->config['site_start'];
break;
default :
return $this->config['site_start'];
}
}
?>
Anyway, the noteworthy part to me is that I think it’s a good idea to provide a default case of the home page instead of blank. Just a thought.
Standard Disclaimer
I could be totally wrong.
-
MODX Staff
- 10,725 Posts
Just a sanity check. Are these security patches getting applied and checked-in to the 0.9.1 release branch in SVN? If not, this needs to be done for each one of these patches which has been applied and released back as a security patch to 0.9.1.
