[imp] security issue

[Chris Bellomy]

Previously, Dan Williamson wrote:

: How are people solving the issue of being able to read arbitrary files on the host system?
: 
: For instance, 
: 
: https://webmail.yoursite.org/horde/imp/mailbox.php?mailbox=../../../../../../../etc/passwd    
: 
: or even
: 
: https://webmail.yoursite.org/horde/imp/mailbox.php?mailbox=/etc/passwd
: 
: will list the password file or any other file with either world read or logged-in user read priviledges.

This sounds like your IMAP server is wide open.  Check the documentation
for that application to tighten that down.

: https://webmail.yoursite.org/horde/admin/css/index.php?file=arbitrary_path_and_file
: 
: will provide the same without a valid login.

I can't reproduce this, because I don't have an admin directory
under /horde.  What version are you using?

cb