FreeLists / dokuwiki / [dokuwiki] Re: SECURITY WARNING

[Chris Smith <chris@xxxxxxxxxxxxx>]

Andreas Gohr wrote:
> Shit.
>
> Okay we have a serious problem here. I just issued a warning on the 
> freshmeat announcement list. Everybody secure the bin directory as 
> fast as possible! Or just delete it if not needed.
>
> Protecting the bin directory is a solution for the two existing 
> exploits. But I need help to evaluate some possible other risks 
> mentioned in the text below.
Can we add a simple check at the start of these three files to see if 
they are being run remotely?

Something like

if (!empty($_SERVER['SERVER_PROTOCOL'])) die();

there are other possibilities, refer 
http://hoohoo.ncsa/uluc.edu/cgi/env.html.

If something like this works (my quick test suggests it might) then this 
solution would work for those servers which don't support .htaccess files.

Also for dwpage, it may be more secure to make it use pipes for the 
non-wiki file.

Cheers,

Chris

--
DokuWiki mailing list - more info at
http://wiki.splitbrain.org/wiki:mailinglist