Page MenuHomePhabricator

cgi extension should be added to wgFileBlacklist
Closed, ResolvedPublic

Description

Author: rsiklos

Description:
The $wgFileBlacklist variable in DefaultSettings.php should include 'cgi', since
those kinds of files may run arbitrary code (just like php or pl)


Version: 1.3.x
Severity: normal

Details

Reference
bz874

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 7:04 PM
bzimport set Reference to bz874.
bzimport added a subscriber: Unknown Object (MLST).

jeluf wrote:

Fixed in CVS HEAD and REL1_3.