{"action":"created","issue":{"url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/issues/12547","repository_url":"https://api.github.com/repos/phpmyadmin/phpmyadmin","labels_url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/issues/12547/labels{/name}","comments_url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/issues/12547/comments","events_url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/issues/12547/events","html_url":"https://github.com/phpmyadmin/phpmyadmin/issues/12547","id":175843033,"number":12547,"title":"prevent direct calls of include files","user":{"login":"thelounge-zz","id":625706,"avatar_url":"https://avatars.githubusercontent.com/u/625706?v=3","gravatar_id":"","url":"https://api.github.com/users/thelounge-zz","html_url":"https://github.com/thelounge-zz","followers_url":"https://api.github.com/users/thelounge-zz/followers","following_url":"https://api.github.com/users/thelounge-zz/following{/other_user}","gists_url":"https://api.github.com/users/thelounge-zz/gists{/gist_id}","starred_url":"https://api.github.com/users/thelounge-zz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thelounge-zz/subscriptions","organizations_url":"https://api.github.com/users/thelounge-zz/orgs","repos_url":"https://api.github.com/users/thelounge-zz/repos","events_url":"https://api.github.com/users/thelounge-zz/events{/privacy}","received_events_url":"https://api.github.com/users/thelounge-zz/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/labels/question","name":"question","color":"cc317c"}],"state":"closed","locked":false,"assignee":{"login":"nijel","id":212189,"avatar_url":"https://avatars.githubusercontent.com/u/212189?v=3","gravatar_id":"","url":"https://api.github.com/users/nijel","html_url":"https://github.com/nijel","followers_url":"https://api.github.com/users/nijel/followers","following_url":"https://api.github.com/users/nijel/following{/other_user}","gists_url":"https://api.github.com/users/nijel/gists{/gist_id}","starred_url":"https://api.github.com/users/nijel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nijel/subscriptions","organizations_url":"https://api.github.com/users/nijel/orgs","repos_url":"https://api.github.com/users/nijel/repos","events_url":"https://api.github.com/users/nijel/events{/privacy}","received_events_url":"https://api.github.com/users/nijel/received_events","type":"User","site_admin":false},"assignees":[{"login":"nijel","id":212189,"avatar_url":"https://avatars.githubusercontent.com/u/212189?v=3","gravatar_id":"","url":"https://api.github.com/users/nijel","html_url":"https://github.com/nijel","followers_url":"https://api.github.com/users/nijel/followers","following_url":"https://api.github.com/users/nijel/following{/other_user}","gists_url":"https://api.github.com/users/nijel/gists{/gist_id}","starred_url":"https://api.github.com/users/nijel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nijel/subscriptions","organizations_url":"https://api.github.com/users/nijel/orgs","repos_url":"https://api.github.com/users/nijel/repos","events_url":"https://api.github.com/users/nijel/events{/privacy}","received_events_url":"https://api.github.com/users/nijel/received_events","type":"User","site_admin":false}],"milestone":null,"comments":2,"created_at":"2016-09-08T19:33:18Z","updated_at":"2016-09-16T09:26:16Z","closed_at":"2016-09-16T07:19:31Z","body":"phpMyAdmin-4.4.15.8\r\n\r\n* write a simple script calling all files inside a webhost\r\n* run it against phpMyAdmin\r\n* watch your error logs\r\n\r\nhorrible - no script not intended for a empty, direct call should execute any code the send a 403 status code and tell the client \"bad request\" or something similar - it#s possiblle, proven by 600 domains without any single php warning if you call all of them directly with a blind attack\r\n\r\n[08-Sep-2016 21:25:16 Europe/Vienna] PHP Fatal error:  require_once() [<a href='http://at.php.net/manual/de/function.require.php'>function.require.php</a>]: Failed opening required 'libraries/Util.class.php' (include_path='.:/Volumes/dune/www-servers/phpincludes:/usr/share/pear:/usr/share/php') in /usr/share/phpMyAdmin/test/libraries/PMA_server_status_test.php on line 12\r\n[08-Sep-2016 21:25:16 Europe/Vienna] PHP Warning:  require_once(libraries/Util.class.php) [<a href='http://at.php.net/manual/de/function.require-once.php'>function.require-once.php</a>]: failed to open stream: No such file or directory in /usr/share/phpMyAdmin/test/libraries/PMA_server_status_variables_test.php on line 12\r\n[08-Sep-2016 21:25:16 Europe/Vienna] PHP Fatal error:  require_once() [<a href='http://at.php.net/manual/de/function.require.php'>function.require.php</a>]: Failed opening required 'libraries/Util.class.php' (include_path='.:/Volumes/dune/www-servers/phpincludes:/usr/share/pear:/usr/share/php') in /usr/share/phpMyAdmin/test/libraries/PMA_server_status_variables_test.php on line 12\r\n[08-Sep-2016 21:25:16 Europe/Vienna] PHP Warning:  require_once(libraries/php-gettext/gettext.inc) [<a href='http://at.php.net/manual/de/function.require-once.php'>function.require-once.php</a>]: failed to open stream: No such file or directory in /usr/share/phpMyAdmin/test/libraries/PMA_server_user_groups_test.php on line 9\r\n[08-Sep-2016 21:25:16 Europe/Vienna] PHP Fatal error:  require_once() [<a href='http://at.php.net/manual/de/function.require.php'>function.require.php</a>]: Failed opening required 'libraries/php-gettext/gettext.inc' (include_path='.:/Volumes/dune/www-servers/phpincludes:/usr/share/pear:/usr/share/php') in /usr/share/phpMyAdmin/test/libraries/PMA_server_user_groups_test.php on line 9\r\n[08-Sep-2016 21:25:16 Europe/Vienna] PHP Warning:  require_once(libraries/php-gettext/gettext.inc) [<a href='http://at.php.net/manual/de/function.require-once.php'>function.require-once.php</a>]: failed to open stream: No such file or directory in /usr/share/phpMyAdmin/test/libraries/PMA_server_users_test.php on line 9\r\n[08-Sep-2016 21:25:16 Europe/Vienna] PHP Fatal error:  require_once() [<a href='http://at.php.net/manual/de/function.require.php'>function.require.php</a>]: Failed opening required 'libraries/php-gettext/gettext.inc' (include_path='.:/Volumes/dune/www-servers/phpincludes:/usr/share/pear:/usr/share/php') in /usr/share/phpMyAdmin/test/libraries/PMA_server_users_test.php on line 9\r\n[08-Sep-2016 21:25:19 Europe/Vienna] PHP Warning:  require_once(libraries/Util.class.php) [<a href='http://at.php.net/manual/de/function.require-once.php'>function.require-once.php</a>]: failed to open stream: No such file or directory in /usr/share/phpMyAdmin/test/libraries/PMA_server_variables_test.php on line 12"},"comment":{"url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/issues/comments/247557085","html_url":"https://github.com/phpmyadmin/phpmyadmin/issues/12547#issuecomment-247557085","issue_url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/issues/12547","id":247557085,"user":{"login":"thelounge-zz","id":625706,"avatar_url":"https://avatars.githubusercontent.com/u/625706?v=3","gravatar_id":"","url":"https://api.github.com/users/thelounge-zz","html_url":"https://github.com/thelounge-zz","followers_url":"https://api.github.com/users/thelounge-zz/followers","following_url":"https://api.github.com/users/thelounge-zz/following{/other_user}","gists_url":"https://api.github.com/users/thelounge-zz/gists{/gist_id}","starred_url":"https://api.github.com/users/thelounge-zz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thelounge-zz/subscriptions","organizations_url":"https://api.github.com/users/thelounge-zz/orgs","repos_url":"https://api.github.com/users/thelounge-zz/repos","events_url":"https://api.github.com/users/thelounge-zz/events{/privacy}","received_events_url":"https://api.github.com/users/thelounge-zz/received_events","type":"User","site_admin":false},"created_at":"2016-09-16T09:26:16Z","updated_at":"2016-09-16T09:26:16Z","body":"/test/libraries/ is missing there and YES i know that all that stuff should not be accessable and gone searching why it was - but secure development means that all these files don't relyon recommended server configurations when you can easily check on top of every file if a specific constant is set and when not exit with a 400 status\r\n\r\nDeny access to auxiliary files in ./libraries/ or ./templates/ subfolders in your webserver configuration. Such configuration prevents from possible path exposure and cross side scripting vulnerabilities that might happen to be found in that code. For the Apache webserver, this is often accomplished with a .htaccess file in those directories."}}
{"actor":{"display_login":"thelounge-zz"}}