[Commotion-admin] [commotion-apps] RCE in add local applications form ‘ipaddr’ parameter (Critical) (#10)

[dismantl]

Were any examples of arbitrary command execution given? I don't see how, currently, this can be done.

The reason I didn't limit field entries to alphanumeric is that I don't know how well this would work with internationalization and translation. Obviously, we can't limit entries to A-Za-z0-9 when a user doesn't even use the same character set. Unless I can get some advice on how to do this in a context-sensitive way, I don't know how to fix this issue.

---
Reply to this email directly or view it on GitHub:
https://github.com/opentechinstitute/commotion-apps/issues/10#issuecomment-24100770
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.chambana.net/pipermail/commotion-admin/attachments/20130909/f1a2b263/attachment.html>