Re: two minor security issues with admin.changePassword

[Bob Harner]

On 6/6/06, Jörn Nettingsmeier <[EMAIL PROTECTED]> wrote:

Bob Harner wrote:
> On 6/6/06, Jörn Nettingsmeier <[EMAIL PROTECTED]> wrote:
>> Bob Harner wrote:
>> > See http://issues.apache.org/bugzilla/show_bug.cgi?id=38383 which
>> > contains a fix for (I think) the same kind of problem that existed on
>> > the login page.
>>
>> ah, cool. out of curiosity: why did you do this:
>>
>> <form method="post" action="?lenya.usecase=login&amp;lenya.step=login">
>>
>> i.e. propagate some parameters via GET? i thought all of cocoon's
>> getParameter() magic was transparent wrt the method?
>
> It has to be mixed like this because the usecase matching in the
> pipeline only looks at GET parameters.
>
> Details: http://article.gmane.org/gmane.comp.cms.lenya.user/9287

YUCK! how disgusting.
are you sure this is still the case with cocoon 2.1.9-dev? in the code i
see this:

I don't know whether 2.1.9-dev still exhibits this behavior.  I know 2.1.8 does.

public class WildcardRequestParameterMatcher
             extends AbstractWildcardMatcher
{
     private String defaultParam;

<..>
     protected String getMatchString(
            Map objectModel, Parameters parameters
     ) {

<..>
         String result = ObjectModelHelper.getRequest(
                    objectModel).getParameter(paramName);
         if (result == null) {
             getLogger().debug("Parameter '" + paramName + "' not set.");
         }

         return result;
     }
}

i'm pretty sure that getParameter() works on both, but i can't test
right now. can anyone comment on this?

---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]