We are moving to Git Issues for bug tracking in future releases. During transition, content will be in both tools. If you'd like to file a new bug, please create an issue.

Bug 5563 - Plugin management functions not authenticated
Plugin management functions not authenticated
Status: RESOLVED FIXED
Product: OJS
Classification: Unclassified
Component: Plug-ins
2.3.2
PC Mac OS X 10.4
: P5 normal
Assigned To: Matthew Crider
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2010-07-10 11:46 PDT by Matthew Crider
Modified: 2010-08-10 13:34 PDT (History)
2 users (show)

See Also:
Version Reported In:
Also Affects: OCS 2.3.3, OHS 2.3.1, OJS 2.3.2


Attachments
Patch against Harvester 2.3.0 and above (2.35 KB, patch)
2010-07-10 12:30 PDT, Matthew Crider
Details | Diff
Patch against OCS 2.3.0 and above (2.38 KB, patch)
2010-07-10 12:31 PDT, Matthew Crider
Details | Diff
Patch against OJS 2.3.0 and above (2.38 KB, patch)
2010-07-10 12:31 PDT, Matthew Crider
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Matthew Crider 2010-07-10 11:46:49 PDT
Perform audit of validation methods in plugin management handler.
Comment 1 Matthew Crider 2010-07-10 12:30:59 PDT
Created attachment 3137 [details]
Patch against Harvester 2.3.0 and above
Comment 2 Matthew Crider 2010-07-10 12:31:27 PDT
Created attachment 3138 [details]
Patch against OCS 2.3.0 and above
Comment 3 Matthew Crider 2010-07-10 12:31:49 PDT
Created attachment 3139 [details]
Patch against OJS 2.3.0 and above
Comment 4 Matthew Crider 2010-07-10 12:32:14 PDT
All changes pushed to official.
Comment 5 Alec Smecher 2010-08-10 13:34:20 PDT
This bug should be considered a serious security risk. It affects the following releases:

OJS 2.3.0
OJS 2.3.1

OCS 2.3.0
OCS 2.3.1
OCS 2.3.2

Harvester 2.3.0

It can be corrected by upgrading to OJS 2.3.2, OCS 2.3.3, and OHS (nee Harvester) 2.3.1, or by applying the patches attached to this entry using the GNU patch tool. See http://en.wikipedia.org/wiki/Patch_%28Unix%29 for details on the patch tool.