Tickets :: Comment on [#5892] Linked attachment feature vulnerability

* Your Email Address
* Spam protection	Enter the letters below: . . ..___ .._. \| \| \|[__ \| \| \|___\|/\\|[___\__\|_\|_
Comment	>> I guess that won't do the job either... cause it doesn't matter the > >> extension you use, the jar: protocol will interpret it as if it was a > >> jar file... i think that the solution begins with "hiding" the > >> original attachment. Another google example (this time a good one :P): > >> > >> http://mail.google.com/mail/?attid=0.1&disp=attd&view=att&th=1166689ac6fe384d > >> > >> I'm not sure, but i think that what happens in this situation, is > >> that an internal script is run and then you have access to the > >> desired attachment. But not directly. > > > > How does that help? By preventing the jar: prefix being on the URL, > because you've done a redirect? I guess that might make sense, and if > that's it that's a relatively simple change... > >
Attachment
Watch this ticket