Security Bug

[martino87r]

Well' I'm back finally! After few months focused on my exams i have now time to work on OpenGoo.

I've discovered a little security bug that allow others to access the Upload folder.
The Upload folder (opengoo/upload) can be viewed in web browser because apache allow the listing by default. Even if the content is encrypted it will be better to don't allow listing of that directory (like any other).

I've also fixed this adding a new .htaccess file forbidding listing of that directory.

[ignacio]

You're right, we should disallow access to that folder by default.

Thanks.

[r2gnl]

well, I just downloaded and installed opengoo version 1.3.1, yet with a browser I can still acces all folder and view any content. Slipped through?

Regards, Remco

[ignacio]

Are you using apache? Check if there's a .htaccess file on the upload folder. You need to have your apache configured so that you can allow overriding configuration with .htaccess files.