[otrs-cvs] otrs/Kernel/GenericInterface/Transport/HTTP SOAP.pm, 1.53, 1.54
"CVS commits notifications of OTRS.org" <[email protected]>
| Newsgroups | gmane.comp.otrs.cvs |
|---|---|
| Message-ID | <[email protected]> |
Comments:
Update of /home/cvs/otrs/Kernel/GenericInterface/Transport/HTTP
In directory lancelot:/tmp/cvs-serv23947/Kernel/GenericInterface/Transport/HTTP
Modified Files:
SOAP.pm
Log Message:
Fixed possible security issue by quoting variables in Regular Expression.
Author: cr
Index: SOAP.pm
===================================================================
RCS file: /home/cvs/otrs/Kernel/GenericInterface/Transport/HTTP/SOAP.pm,v
retrieving revision 1.53
retrieving revision 1.54
diff -2 -u -d -r1.53 -r1.54
--- SOAP.pm 20 Nov 2012 14:30:10 -0000 1.53
+++ SOAP.pm 5 Dec 2012 15:06:21 -0000 1.54
@@ -469,5 +469,5 @@
my $Password = $Config->{Authentication}->{Password};
if ( IsStringWithData($User) && IsStringWithData($Password) ) {
- $URL =~ s{ ( http s? :// ) }{$1$User:$Password@}xmsi;
+ $URL =~ s{ ( http s? :// ) }{$1\Q$User\E:\Q$Password\E@}xmsi;
}
}
---------------------------------------------------------------------
OTRS mailing list: cvs-log - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/cvs-log
To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/cvs-log