Bug 268283

Summary:	<dev-php5/symfony-1.2.6: Parameter injection
Product:	Gentoo Security	Reporter:	Alex Legler (RETIRED) <a3li>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	trivial	CC:	web-apps
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://www.symfony-project.org/blog/2009/04/27/symfony-1-2-6-security-fix
Whiteboard:
Package list:		Runtime testing required:	---

Description Alex Legler (RETIRED) archtester

2009-05-02 12:04:50 UTC

If a field is not unset properly, a malicious user can potentially inject values for fields for which he does not have the right for (as it won't be caught by the security measure implemented by the allow_extra_fields setting of the form).

To sum up, you are potentially affected if you use the new admin generator bundled with symfony 1.2 (Propel or Doctrine) and have removed some form fields in the display entry of the generator.yml form sections without unsetting them in the corresponding form class.

Comment 1 Alex Legler (RETIRED) archtester

2009-05-02 12:07:00 UTC

Meh fast rbu is fast today :(

*** This bug has been marked as a duplicate of bug 250961 ***