{"action":"created","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/8957","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/8957/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/8957/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/8957/events","html_url":"https://github.com/joomla/joomla-cms/issues/8957","id":127982859,"number":8957,"title":"Information disclosure","user":{"login":"demis-palma","id":1609992,"avatar_url":"https://avatars.githubusercontent.com/u/1609992?v=3","gravatar_id":"","url":"https://api.github.com/users/demis-palma","html_url":"https://github.com/demis-palma","followers_url":"https://api.github.com/users/demis-palma/followers","following_url":"https://api.github.com/users/demis-palma/following{/other_user}","gists_url":"https://api.github.com/users/demis-palma/gists{/gist_id}","starred_url":"https://api.github.com/users/demis-palma/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/demis-palma/subscriptions","organizations_url":"https://api.github.com/users/demis-palma/orgs","repos_url":"https://api.github.com/users/demis-palma/repos","events_url":"https://api.github.com/users/demis-palma/events{/privacy}","received_events_url":"https://api.github.com/users/demis-palma/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/joomla/joomla-cms/labels/No%20Code%20Attached%20Yet","name":"No Code Attached Yet","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":17,"created_at":"2016-01-21T17:57:21Z","updated_at":"2016-01-22T15:04:28Z","closed_at":null,"body":"A lot of Joomla libraries, lack the _JEXEC or die() check.\r\n\r\nAccording to the official [documentation](https://docs.joomla.org/JEXEC), those file should be protected:\r\n\r\n> if you access a file directly [...] and a PHP error is raised (presuming your PHP error reporting is set to show errors by default) [...] then the file needs to be protected.\r\n\r\nThe most of the unprotected libraries, actually generate PHP errors, causing the path exposure described in the documentation cited.\r\n\r\nFor example the URL: http://YOURSITE/libraries/vendor/joomla/application/src/Cli/Output/Stdout.php causes:\r\n\r\n> Fatal error: Class 'Joomla\\Application\\Cli\\CliOutput' not found in **/home/user1250/www**/libraries/vendor/joomla/application/src/Cli/Output/Stdout.php on line 19\r\n\r\nI've found 59 unprotected files, but they might be more.\r\n\r\n    libraries/vendor/joomla/application/src  (4 usages found)\r\n        AbstractApplication.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Application;\r\n        AbstractCliApplication.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Application;\r\n        AbstractDaemonApplication.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Application;\r\n        AbstractWebApplication.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Application;\r\n    libraries/vendor/joomla/application/src/Cli  (3 usages found)\r\n        CliOutput.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Application\\Cli;\r\n        ColorProcessor.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Application\\Cli;\r\n        ColorStyle.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Application\\Cli;\r\n    libraries/vendor/joomla/application/src/Cli/Output  (2 usages found)\r\n        Stdout.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Application\\Cli\\Output;\r\n        Xml.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Application\\Cli\\Output;\r\n    libraries/vendor/joomla/application/src/Cli/Output/Processor  (2 usages found)\r\n        ColorProcessor.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Application\\Cli\\Output\\Processor;\r\n        ProcessorInterface.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Application\\Cli\\Output\\Processor;\r\n    libraries/vendor/joomla/application/src/Web  (1 usage found)\r\n        WebClient.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Application\\Web;\r\n    libraries/vendor/joomla/di/src  (4 usages found)\r\n        Container.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\DI;\r\n        ContainerAwareInterface.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\DI;\r\n        ContainerAwareTrait.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\DI;\r\n        ServiceProviderInterface.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\DI;\r\n    libraries/vendor/joomla/di/src/Exception  (1 usage found)\r\n        DependencyResolutionException.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\DI\\Exception;\r\n    libraries/vendor/joomla/event/src  (10 usages found)\r\n        AbstractEvent.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Event;\r\n        DelegatingDispatcher.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Event;\r\n        Dispatcher.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Event;\r\n        DispatcherAwareInterface.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Event;\r\n        DispatcherInterface.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Event;\r\n        Event.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Event;\r\n        EventImmutable.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Event;\r\n        EventInterface.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Event;\r\n        ListenersPriorityQueue.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Event;\r\n        Priority.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Event;\r\n    libraries/vendor/joomla/filter/src  (2 usages found)\r\n        InputFilter.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Filter;\r\n        OutputFilter.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Filter;\r\n    libraries/vendor/joomla/input/src  (5 usages found)\r\n        Cli.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Input;\r\n        Cookie.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Input;\r\n        Files.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Input;\r\n        Input.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Input;\r\n        Json.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Input;\r\n    libraries/vendor/joomla/registry/src  (2 usages found)\r\n        AbstractRegistryFormat.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Registry;\r\n        Registry.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Registry;\r\n    libraries/vendor/joomla/registry/src/Format  (5 usages found)\r\n        Ini.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Registry\\Format;\r\n        Json.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Registry\\Format;\r\n        Php.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Registry\\Format;\r\n        Xml.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Registry\\Format;\r\n        Yaml.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Registry\\Format;\r\n    libraries/vendor/joomla/session/Joomla/Session  (2 usages found)\r\n        Session.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Session;\r\n        Storage.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Session;\r\n    libraries/vendor/joomla/session/Joomla/Session/Storage  (7 usages found)\r\n        Apc.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Session\\Storage;\r\n        Database.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Session\\Storage;\r\n        Memcache.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Session\\Storage;\r\n        Memcached.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Session\\Storage;\r\n        None.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Session\\Storage;\r\n        Wincache.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Session\\Storage;\r\n        Xcache.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Session\\Storage;\r\n    libraries/vendor/joomla/string/src  (3 usages found)\r\n        Inflector.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\String;\r\n        Normalise.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\String;\r\n        String.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\String;\r\n    libraries/vendor/joomla/uri/src  (5 usages found)\r\n        AbstractUri.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Uri;\r\n        Uri.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Uri;\r\n        UriHelper.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Uri;\r\n        UriImmutable.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Uri;\r\n        UriInterface.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Uri;\r\n    libraries/vendor/joomla/utilities/src  (1 usage found)\r\n        ArrayHelper.php  (1 usage found)\r\n            (9: 1) namespace Joomla\\Utilities;\r\n"},"comment":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/comments/173943962","html_url":"https://github.com/joomla/joomla-cms/issues/8957#issuecomment-173943962","issue_url":"https://api.github.com/repos/joomla/joomla-cms/issues/8957","id":173943962,"user":{"login":"Bakual","id":1018684,"avatar_url":"https://avatars.githubusercontent.com/u/1018684?v=3","gravatar_id":"","url":"https://api.github.com/users/Bakual","html_url":"https://github.com/Bakual","followers_url":"https://api.github.com/users/Bakual/followers","following_url":"https://api.github.com/users/Bakual/following{/other_user}","gists_url":"https://api.github.com/users/Bakual/gists{/gist_id}","starred_url":"https://api.github.com/users/Bakual/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Bakual/subscriptions","organizations_url":"https://api.github.com/users/Bakual/orgs","repos_url":"https://api.github.com/users/Bakual/repos","events_url":"https://api.github.com/users/Bakual/events{/privacy}","received_events_url":"https://api.github.com/users/Bakual/received_events","type":"User","site_admin":false},"created_at":"2016-01-22T15:04:28Z","updated_at":"2016-01-22T15:04:28Z","body":"> I thought we used the code in /vendor not /vendor/src - mea culpa\r\n\r\nThere is no /vendor/src. There is /vendor/.../.../src (eg libraries/vendor/joomla/application/src). I thought you referred to those folders :smile: "}}