Tickets :: Comment on [#5892] Linked attachment feature vulnerability

* Your Email Address
* Spam protection	Enter the letters below: .__ .__..__.. ..__ [__)\| \|\| \|\|__\|[__) \| \\|__\|\|__\\| \|[__)
Comment	> Well... now i've realized that the solution i mentioned earlier isn't > possible too, cause: first the script retrives the file and next the > jar: protocol acts. So.. I think that a good solution is to put a > secure id in the attachment's URL, for each rcpt of the attachment. > That way, no one (except the rcpt) would know the path to the file > and the XSS attack won't be possible.
Attachment
Watch this ticket