[VCL-809] Information disclosure when accessing page you don't have access to

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.3.2
• Fix Version/s: 2.5
• Component/s: web gui (frontend)
• Assignee: Unassigned
• Reporter: Karl Vollmer
• Created: 21/Jan/15 19:35
• Updated: 17/Aug/15 16:32
• Resolved: 17/Aug/15 16:32

Description

visit index.php?mode=dashboard as someone who doesn't have access and you get

Notice: Undefined index: home in /var/www/html/vcl/.ht-inc/utils.php on line 10195 Notice: Undefined index: home in /var/www/html/vcl/.ht-inc/utils.php on line 10195 Notice: Undefined index: home in /var/www/html/vcl/.ht-inc/utils.php on line 10195 Notice: Undefined index: home in /var/www/html/vcl/.ht-inc/utils.php on line 10195 Notice: Undefined index: home in /var/www/html/vcl/.ht-inc/utils.php on line 10195 Notice: Undefined index: home in /var/www/html/vcl/.ht-inc/utils.php on line 10195 Notice: Undefined index: home in /var/www/html/vcl/.ht-inc/utils.php on line 10195

which discloses the location of the files on your webserver,