[PEAR-BUG] Bug #18351 [Opn]: Security vulnerability in editing bugs

Edit report at https://pear.php.net/bugs/bug.php?id=18351&edit=1

 ID:               18351
 Updated by:       [email protected]
 Reported By:      afshin dot meh at gmail dot com
 Summary:          Security vulnerability in editing bugs
 Status:           Open
 Type:             Bug
 Package:          pearweb
 Package Version:  1.24.2
 PHP Version:      Irrelevant
 Roadmap Versions: 
 New Comment:

Are you sure? I looked at your link and the code for that page, and I
think it's working as designed. If you'll notice, replacing "2" with "1"
in your URL yields a page that looks exactly the same. Most likely, that
bug is one where the page's code sees "edit=2" and changes it to be 1
during execution.


Previous Comments:
------------------------------------------------------------------------

[2011-03-09 20:00:27] afshin

Description:
------------
Every registered user in any level can view and use edit bugs in a
developer level just with adding "edit" parameter to URL parameters and
set this value to 2.

For example : http://pear.php.net/bugs/bug.php?id=18157&edit=2

------------------------------------------------------------------------


-- 
Edit this bug report at https://pear.php.net/bugs/bug.php?id=18351&edit=1