AW: Security issue?

Hello Max,

>> When a postmaster of his-domain.com has logged in to Jamm, 
>> the browser shows the following url 
>> http://my_jamm_server/jamm/private/index.jsp
>> If he click on "Domain Admin" the url change to 
>> http://my_jamm_server/jamm/private/domain_admin.do?domain=his-
>domain.com
>If he replace his-domain.com to any domain hosted in the same 
>ldap tree he can see all accounts on that domain.
>
>And if he change the url to
http://my_jamm_server/jamm/private/site_admin.do
>He don't have to guess the domain name, all domains is listed for him.
>
>But he can't change anything.
>Is this a security issue or just a cosmetic?
>

Since he can't change anything it's not strictly a security issue, but
rather a
information leak issue.

I think this should be corrected...


André



-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE
FREE OODBMS DOWNLOAD - A multidimensional database that combines
robust object and relational technologies, making it a perfect match
for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8