Tickets :: Comment on [#4112] Upgrade Documentation about.php

* Your Email Address
* Spam protection	Enter the letters below: .___\ / __ . .._. [__ >< / `\|\ \| \| [___/ \\__.\| \\|_\|_
Comment	>> What are you talking about? > > /horde/services/help/about.php > > This file is obsolete in horde 3.1.1 - If you do an upgrade from > former versions by just overwriting the directory the file about.php > remains and opens horde to exploits. Version 3.1.1 fixed the remote > code execution vulnerability in the help viewer but if about.php > doesn't get deleted the vulnerability still exists. Therefore I > recommend to mention this risk in docs/UPGRADING or even better: > patch about.php to make it unusable. > >
Attachment
Watch this ticket