<<< Date Index >>>     <<< Thread Index >>>

Re: DotClear Full Path Disclosure Vulnerability



I do agree with you, but I think in this case it is a DotClear issue.

The default themes provided with DotClear do not check that they have been called by a regular DotClear page, and spit out useful information for an attacker.

They should check that a certain variable is defined for example, and if not, do not display anything... even if the hosted website is configured to display errors, and you cannot change this.


Fatal error: Call to a member function fetch() on a non-object in
/home/users/xxxx/dotclear/themes/xxx/list.php on line 34

Note it's not wise to display errors on a production website. However,
when hosted, you don't necessarily have this choice...