6.0.0-beta6
▾
Tasks
New Task
Search
Photos
Wiki
▾
Tickets
New Ticket
Search
dev.horde.org
Toggle Alerts Log
Help
4/10/26
H
istory
A
ttachments
C
omment
W
atch
Download
Comment on [#5892] Linked attachment feature vulnerability
*
Your Email Address
*
Spam protection
Enter the letters below:
.__ .__..__.. ..__ [__)| || ||__|[__) | \|__||__\| |[__)
Comment
> Well... now i've realized that the solution i mentioned earlier isn't > possible too, cause: first the script retrives the file and next the > jar: protocol acts. So.. I think that a good solution is to put a > secure id in the attachment's URL, for each rcpt of the attachment. > That way, no one (except the rcpt) would know the path to the file > and the XSS attack won't be possible.
Attachment
Watch this ticket
N
ew Ticket
M
y Tickets
S
earch
Q
uery Builder
R
eports
Saved Queries
Open Bugs
Bugs waiting for Feedback
Open Bugs in Releases
Open Enhancements
Enhancements waiting for Feedback
Bugs with Patches
Enhancements with Patches
Release Showstoppers
Stalled Tickets
New Tickets
Horde 5 Showstoppers