MantisBT: master 8f95c9e3

Author Committer Branch Timestamp Parent
dhx dhx master 2009-12-06 07:34 master 538717ff
Changeset

Disallow admins from changing _page and _url settings

The settings ending with _page and _url are fairly sensitive and
therefore should only be changed on a global level by someone with
access to the server (via config_inc.php). Otherwise it becomes possible
for someone with database access to change a _page setting to remotely
include/execute unwanted .php files or redirect people to other external
websites.

mod - config_defaults_inc.php Diff File