[SOLVED] How Can I Stop The Information Disclosure -->

jpeadro

Joined: 2003-12-24
Posts: 198
Posted: Sat, 2005-10-15 22:50

How can I configure Gallery to stop displaying my web root whenever an error occurs?

Example:

http://www.example.com/gallery/main.php?g2_view=core.UserAdmin&g2_subView='

Notice the ' at the end of my URL, once submitted Gallery returns an error page displaying:

Error (ERROR_BAD_PARAMETER) :
in X:\Inetpub\wwwExample\Gallery\modules\core\classes\GalleryView.class at line 125 (GalleryStatus::error)
in X:\Inetpub\wwwExample\Gallery\modules\core\UserAdmin.inc at line 131 (GalleryView::loadView)
in X:\Inetpub\wwwExample\Gallery\modules\core\classes\GalleryTheme.class at line 688 (UserAdminView::loadTemplate)
in X:\Inetpub\wwwExample\Gallery\modules\core\classes\GalleryView.class at line 285 (GalleryTheme::loadTemplate)
in X:\Inetpub\wwwExample\Gallery\main.php at line 287 (GalleryView::doLoadTemplate)
in X:\Inetpub\wwwExample\Gallery\main.php at line 87
in X:\Inetpub\wwwExample\Gallery\main.php at line 80
 
mindless
mindless's picture

Joined: 2004-01-04
Posts: 8601
Posted: Sun, 2005-10-16 00:44

it should not be doing that.. each path should be relative, like:
modules\core\classes\GalleryView.class
i wonder if this code doesn't work right on windows platform.. can someone else on windows confirm?
if so, please file a bug on sourceforge.
 
valiant

Joined: 2003-01-04
Posts: 32509
Posted: Sun, 2005-10-16 15:01

yep, confirmed on windows. looking into it.
 
valiant

Joined: 2003-01-04
Posts: 32509
Posted: Sun, 2005-10-16 16:17

fixed in cvs. get tomorrows nightly snapshot or cvs update in a few hours to get the fixed modules/core/classes/GalleryStatus.class.
 
jpeadro

Joined: 2003-12-24
Posts: 198
Posted: Sun, 2005-10-16 16:22

Your response time hands down rocks.

Thanks Valiant