Re: Security issue?

Keith T. Garner wrote:
> On Thu, Nov 18, 2004 at 01:44:15, Max Matslofva said:
> 
>>Hi all
>>I discovered that a postmaster of any domain can see all accounts and 
>>aliases on any domain.
>>
>>When a postmaster of his-domain.com has logged in to Jamm, the browser 
>>shows the following url
>>http://my_jamm_server/jamm/private/index.jsp
>>If he click on "Domain Admin" the url change to
>>http://my_jamm_server/jamm/private/domain_admin.do?domain=his-domain.com
>>If he replace his-domain.com to any domain hosted in the same ldap tree he 
>>can see all accounts on that domain.
>>
> 
> p> And if he change the url to
> 
>>http://my_jamm_server/jamm/private/site_admin.do
>>He don't have to guess the domain name, all domains is listed for him.
>>
>>But he can't change anything.
>>Is this a security issue or just a cosmetic?
> 
> 
> What version of Jamm is this?  I thought I had put in a block for
> this, but maybe I never completed the work or maybe it doesn't work.
> YIKES!
> 
> Keith
> 

This is 0.9.7-rc1


/ Max


-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE
FREE OODBMS DOWNLOAD - A multidimensional database that combines
robust object and relational technologies, making it a perfect match
for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8