{"action":"opened","issue":{"url":"https://api.github.com/repos/octobercms/october/issues/1756","repository_url":"https://api.github.com/repos/octobercms/october","labels_url":"https://api.github.com/repos/octobercms/october/issues/1756/labels{/name}","comments_url":"https://api.github.com/repos/octobercms/october/issues/1756/comments","events_url":"https://api.github.com/repos/octobercms/october/issues/1756/events","html_url":"https://github.com/octobercms/october/issues/1756","id":131757395,"number":1756,"title":"AJAX vulnerability","user":{"login":"Schweppesale","id":175759,"avatar_url":"https://avatars.githubusercontent.com/u/175759?v=3","gravatar_id":"","url":"https://api.github.com/users/Schweppesale","html_url":"https://github.com/Schweppesale","followers_url":"https://api.github.com/users/Schweppesale/followers","following_url":"https://api.github.com/users/Schweppesale/following{/other_user}","gists_url":"https://api.github.com/users/Schweppesale/gists{/gist_id}","starred_url":"https://api.github.com/users/Schweppesale/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Schweppesale/subscriptions","organizations_url":"https://api.github.com/users/Schweppesale/orgs","repos_url":"https://api.github.com/users/Schweppesale/repos","events_url":"https://api.github.com/users/Schweppesale/events{/privacy}","received_events_url":"https://api.github.com/users/Schweppesale/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-05T21:20:59Z","updated_at":"2016-02-05T21:20:59Z","closed_at":null,"body":"So...I've just started experimenting with the October CMS had decided to test the existing User facing interface for any possible exploits.  \r\n\r\nI decided to make the following set of changes to the \"Code\" section beneath \"Ajax Test\":\r\n\r\n```\r\nfunction onTest()\r\n{\r\n    $value1 = post('value1');\r\n    $value2 = post('value2');\r\n    $operation = post('operation');\r\n\r\n    $this['result'] = file_get_contents('/home/vagrant/Code/october/.htaccess');\r\n    return;\r\n    switch ($operation) {\r\n        case '+' :\r\n            $this['result'] = $value1 + $value2;\r\n            break;\r\n        case '-' :\r\n            $this['result'] = $value1 - $value2;\r\n            break;\r\n        case '*' :\r\n            $this['result'] = $value1 * $value2;\r\n            break;\r\n        default :\r\n            $this['result'] = $value1 / $value2;\r\n            break;\r\n    }\r\n}\r\n```\r\n\r\nbecomes:\r\n\r\n```\r\nfunction onTest()\r\n{\r\n    $this['result'] = file_get_contents('/home/vagrant/Code/october/.htaccess');\r\n    return;\r\n}\r\n```\r\n\r\nAnd here is the outcome: \r\n\r\n![screen shot 2016-02-05 at 4 10 17 pm](https://cloud.githubusercontent.com/assets/175759/12859423/13ab3fa2-cc24-11e5-9a1b-8d650d2b3905.png)\r\n\r\nThis is a pretty severe vulnerability.  "}}