[kronolith] A security bug?

[Jan Schneider]

Zitat von Pasi Savilaakso <larskis@nietos.tokem.fi>:

> I tested an admin array on Horde 2 and found out the following "security
> hole". if i am logged on as one of the admins and refresh the screen
> admin "button appears at the bottom of the screen. After pressing the
> logout button in th right upper corner admin button remains at the
> program bar at the bottom. Now i can login with another user (who is not
> an admin) and still enter the admin part of the horde and change the
> values. I have not made any special changes to the  files.

The admin directory isn't secured by the admin array, but users.php can't 
be accessed if you're not logged in as an admin.

I think the css editor doesn't check for admin rights, but that's because 
it hasn't been maintained for a while. But it works only if the webserver 
has write rights on the html.php files anyway.

Atif, do you want to check for admin rights in the css editor?

Jan.

--
::::::::::::::::::::::::::::::::::::::::
AMMMa AG - discover your knowledge
:::::::::::::::::::::::::::
Detmolder Str. 25-33 :: D-33604 Bielefeld
fon +49.521.96878-0 :: fax  +49.521.96878-20
http://www.ammma.de
::::::::::::::::::::::::::::::::::::::::::::::