mirror of https://github.com/BOINC/boinc.git
aba8af3bc0
In the "ops" web page showing results, the credit link was wrong. The page for grepping logs allowed people to run arbitrary shell commands. Use escapeshellcmd() to prevent this. However: the Ops interface lets you type in arbitrary SQL, which lets bad guys do all sorts of things. So you need to protect access to Ops very strongly. TODO: fix all vulnerabilities in ops/. Get rid of the DB browsing features; use phpmysqladmin. |
||
|---|---|---|
| .. | ||
| inc | ||
| languages/translations | ||
| ops | ||
| project.sample | ||
| user | ||
| Makefile.am | ||