Skip Menu |

This queue is for tickets about the CGI-Application CPAN distribution.

Report information
The Basics
Id: 84403
Status: resolved
Priority: 0/
Queue: CGI-Application
People
Owner: mcgrath.martin [...] gmail.com
Requestors: tomas.zemres [...] gmail.com
Cc:
AdminCc:
Bug Information
Severity: Normal
Broken in: 4.50
Fixed in:
  • 4.50_50
  • 4.50_51

History Show all quoted text
  Wed Apr 03 03:36:17 2013 tomas.zemres [...] gmail.com - Ticket created
Subject: Security problem: missing "start" mode dumps ENV to output page
If I forgot assign runmode "start", it internally calls "dump_html" instead. It print $ENV into HTTP response. In devel-environment it may be usefull, but in production mode it may be security-problem. Better would be display some like "HTTP 500 Internal Server Error" about missing run-mode/start-mode instead of dump server $ENV to website users on production-env.
  Wed Apr 03 03:49:04 2013 tomas.zemres [...] gmail.com - Correspondence added
From: tnt [...] netsafe.cz
Maybe better default start-mode may render: 404 Page Not Found
  Wed Apr 03 08:37:24 2013 MARKSTOS [...] cpan.org - Correspondence added
Thanks for the report.
  Wed Apr 03 08:37:25 2013 The RT System itself - Status changed from 'new' to 'open'
  Thu Jan 30 10:11:40 2014 mcgrath.martin [...] gmail.com - Correspondence added
From: mcgrath.martin [...] gmail.com
On Wed Apr 03 13:37:24 2013, MARKSTOS wrote: Show quoted text
> Thanks for the report.
Pull request to address this issue: https://github.com/markstos/CGI--Application/pull/15
  Wed Feb 28 12:09:03 2018 mcgrath.martin [...] gmail.com - Correspondence added
Fixed in dev releases, 4.50_50, 4.50_51 and the 4.60 release: https://metacpan.org/pod/CGI::Application
  Wed Feb 28 12:09:03 2018 mcgrath.martin [...] gmail.com - Status changed from 'open' to 'resolved'
  Wed Feb 28 12:09:03 2018 mcgrath.martin [...] gmail.com - Taken
  Wed Feb 28 12:09:04 2018 mcgrath.martin [...] gmail.com - Fixed in 4.50_50 added
  Wed Feb 28 12:09:04 2018 mcgrath.martin [...] gmail.com - Fixed in 4.50_51 added