[41083] in bugtraq
Re: Re: Mambo Open Source, Path disclosure
daemon@ATHENA.MIT.EDU (trueend5@yahoo.com)
Mon Nov 7 19:36:23 2005
Date: 6 Nov 2005 14:32:05 -0000
Message-ID: <20051106143205.23481.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: trueend5@yahoo.com
To: bugtraq@securityfocus.com
You are right
mamboserver soloution is available now:
The fix is easy,
in /component/com_content/content.php
Approx Line 190 Change the block FROM:
Code:
// Paramters
$params = new stdClass();
if ( $Itemid ) {
$menu = new mosMenu( $database );
$menu->load( $Itemid );
$params =& new mosParameters( $menu->params );
} else {
$menu = "";
$params =& new mosEmpty();
}
CHANGE TO READ:
Code:
// Paramters
$params = new stdClass();
if ( $Itemid ) {
$menu = new mosMenu( $database );
$menu->load( $Itemid );
$params =& new mosParameters( $menu->params );
} else {
$menu = "";
$params =& new mosParameters(''); //mosEmpty();
}
best regards
Alireza Hassani
Security Science Researchers Institute Of Iran
[http://www.KAPDA.ir]
