FreeLists / dokuwiki / [dokuwiki] fixing clientIP() (was: SECURITY WARNING)

[Andreas Gohr <andi@xxxxxxxxxxxxxx>]

> > so to sum it up the vulnerability is in dwpage.php but cleaning the ip 
> > is a good idea anyway (it's already done in the current devel I think).
> It was Sep 3, darcs version I was using, so no its not done properly in 
> the current version.

Hmm... are we talking about the clientIP() function?

This line should remove all nasty stuff, shouldn't it?

$ip[$i] = preg_replace('/[^0-9\.]+/','',$ip[$i]);

Or did I miss something?

Andi
--
DokuWiki mailing list - more info at
http://wiki.splitbrain.org/wiki:mailinglist