Glance

  1. Series newton
  2. Bug #1546507
  3. Comment #22

Comment 22 for bug 1546507

Revision history for this message
Flavio Percoco (flaper87) wrote : Re: Regular user can delete any image file

Mike,

thanks for the new patch. We're getting closer.

Unfortunately, I don't think the check for valid external URI's is good enough. If I create an empty image and set my own location, which doesn't have the image id in it, I'll still be able to exploit this. Should we check in the DB and see if the location is being used?

Stuart, comments?