MantisBT: master-1.2.x f3d56d77

Author Committer Branch Timestamp Parent
dhx dhx master-1.2.x 2009-12-06 07:34 master-1.2.x 908a1fb7
Changeset

Disallow admins from changing _page and _url settings

The settings ending with _page and _url are fairly sensitive and
therefore should only be changed on a global level by someone with
access to the server (via config_inc.php). Otherwise it becomes possible
for someone with database access to change a _page setting to remotely
include/execute unwanted .php files or redirect people to other external
websites.

mod - config_defaults_inc.php Diff File