<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
OK, so in the linked commit, there is a new class AppRequest in
include/http/Request.php (it is in "includes" in vtiger at the
moment because yetiforce folded the /includes/ into /include/ a
while back)<br>
This class parses fields out of the $_REQUEST data in a number of
ways, and does it properly and would be a central point to add extra
checks at some point.<br>
The commit also includes rewriting pretty much everywhere that
$_REQUEST is directly used in the codebase to use this new class. It
is a good improvement preventing various potential attacks (mostly
attacks by authenticated users, but probably some unauthed stuff,
particularly around password resetting)<br>
<br>
I think it also removes the following files on the basis that they
are no longer used, I am not sure if that is true for vtiger<br>
<br>
include/utils/InventoryUtils.php<br>
include/utils/export.php<br>
modules/Calendar/iCalExport.php<br>
modules/Calendar/iCalImport.php<br>
modules/ModComments/ModCommentsWidgetHandler.php<br>
modules/OSSTimeControl/Save.php<br>
modules/Reports/AdvancedFilter.php<br>
modules/Reports/CustomReportUtils.php_deprecated<br>
modules/Reports/ReportChartRun.php_deprecated<br>
modules/Reports/ReportSharing.php<br>
modules/Reports/ReportType.php<br>
modules/Users/Authenticate.php<br>
<br>
so the commit clearly won't apply cleanly to vtiger, but it is good
stuff and we should incorporate it.<br>
<br>
I actually pulled a copy of yetiforce from github to code.vtiger.com
the other day, in the hope of being able to figure out how to
efficiently move stuff between the systems, and work out what the
differences actually were at this stage.<br>
<a class="moz-txt-link-freetext" href="http://code.vtiger.com/alanbell/yetiforce">http://code.vtiger.com/alanbell/yetiforce</a><br>
<br>
I opened an issue for this topic here<br>
<a class="moz-txt-link-freetext" href="http://code.vtiger.com/vtiger/vtigercrm/issues/203">http://code.vtiger.com/vtiger/vtigercrm/issues/203</a><br>
<br>
Alan.<br>
<br>
<div class="moz-cite-prefix">On 13/05/16 10:55, Błażej Pabiszczak
wrote:<br>
</div>
<blockquote
cite="mid:7d495295a2815aa01796585d7b59176d@yetiforce.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<p>Every now and then we send information about security errors,
not only to Vtiger, but also to creators of Vtiger modules. In
most of the cases, these changes aren't fixed. I don't
understand why security is a taboo subject, and why nobody
considers our comments [maybe we should report each of these
cases publicly? Or maybe we should record a video on how to
break into the OD version?] Any ideas?</p>
<p>The code that is currently added to Vtiger is of low quality,
and since releasing v6.0 nobody has been really dealing with the
development as far as quality and security are considered.
Unfortunately, we inherited a lot of code from Vtiger [it also
applies to other forks – CoreBOS, VTE CRM]. The majority of
errors we point out are related to not clearing the variables,
and storing useless old files full of holes. Let's see what the
reaction to this post is, if you ignore it we won't publish info
like that anymore, it's a waste of our time. <span>Take into
consideration that our system doesn't have many of the modules
that are in Vtiger because we wrote them from scratch, so the
link below is not a ready solution, it only points out part of
the found errors. Vtiger</span></p>
<p>Therefore I suggest making a contest – how long does it take
for serious security errors to be fixed, and an update package
to be released, after publishing the errors on this mailing
list.</p>
<ul>
<li><a moz-do-not-send="true"
href="https://github.com/YetiForceCompany/YetiForceCRM/commit/4746cda904c88a26cce22194fb76f64d3df9893d">https://github.com/YetiForceCompany/YetiForceCRM/commit/4746cda904c88a26cce22194fb76f64d3df9893d</a> </li>
</ul>
<div>---<br>
<div>Z poważaniem / Regards</div>
<div> </div>
<div><strong>Błażej Pabiszczak</strong></div>
<div><em>Chief Executive Officer</em></div>
<div>M: +48.884999123<br>
E: <a moz-do-not-send="true" title="Mail do Błażej Pabiszczak"
href="mailto:b.pabiszczak@yetiforce.com">b.pabiszczak@yetiforce.com</a></div>
</div>
<p> </p>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
<a class="moz-txt-link-freetext" href="http://www.vtiger.com/">http://www.vtiger.com/</a></pre>
</blockquote>
<br>
</body>
</html>