Forum GLPI-Project

klaus@kbc-zagreb.hr

Member

Registered: 2008-05-05

Posts: 14

Security attack? wtf

When Im try to download some +xls files glpi send me a message "Security attack!", but I need that files, is that a bug or security issue?
Plz help.

JMD

GLPI - Lead

Registered: 2004-09-13

Posts: 9,180

Website

Re: Security attack? wtf

is- this extension authorized in your glpi configuration ?

---

JMD / Jean-Mathieu Doléans - Glpi-project.org - Association Indepnet
Apportez votre pierre au  projet GLPI   : Soutenir

bergeror

Member

From: Peabody, Massachusetts US

Registered: 2008-05-29

Posts: 30

Re: Security attack? wtf

I find that this happens with there are two consecutive periods in the file name. For example: "myfile..doc". My guess is that the PHP script thinks that someone is trying to access something in a higher directory on the web server. (such as: ../../../../../../passwd)

The simplest thing to do is delete the attachment and reupload it with no double periods.

JMD

GLPI - Lead

Registered: 2004-09-13

Posts: 9,180

Website

Re: Security attack? wtf

OK

I close

---

JMD / Jean-Mathieu Doléans - Glpi-project.org - Association Indepnet
Apportez votre pierre au  projet GLPI   : Soutenir