Learn how easy it is to sync an existing GitHub or Google Code repo to a SourceForge project! See Demo

Close

#266 user\admin\menu.php with many undefined constants

2.1.8
open-accepted
minahito
user (52)
5
2014-08-19
2010-04-28
Mikhail Miguel
No

1) \html\modules\user\admin\menu.php with many many undefined constants!
2) related error message with full path disclosure vulnerability when accessing directly the file.

---

<br />
<b>Notice</b>: Use of undefined constant _MI_USER_MENU_CREATE_USER - assumed '_MI_USER_MENU_CREATE_USER' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>3</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_KEYWORD_CREATE_USER - assumed '_MI_USER_KEYWORD_CREATE_USER' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>5</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_ADMENU_LIST - assumed '_MI_USER_ADMENU_LIST' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>8</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_KEYWORD_USER_LIST - assumed '_MI_USER_KEYWORD_USER_LIST' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>9</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_ADMENU_USER_SEARCH - assumed '_MI_USER_ADMENU_USER_SEARCH' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>13</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_KEYWORD_USER_SEARCH - assumed '_MI_USER_KEYWORD_USER_SEARCH' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>14</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_MENU_CREATE_RANK - assumed '_MI_USER_MENU_CREATE_RANK' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>18</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_KEYWORD_CREATE_RANK - assumed '_MI_USER_KEYWORD_CREATE_RANK' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>20</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_ADMENU_RANK_LIST - assumed '_MI_USER_ADMENU_RANK_LIST' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>23</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_MENU_CREATE_GROUP - assumed '_MI_USER_MENU_CREATE_GROUP' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>27</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_KEYWORD_CREATE_GROUP - assumed '_MI_USER_KEYWORD_CREATE_GROUP' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>29</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_ADMENU_GROUP_LIST - assumed '_MI_USER_ADMENU_GROUP_LIST' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>32</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_KEYWORD_GROUP_LIST - assumed '_MI_USER_KEYWORD_GROUP_LIST' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>33</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_MENU_CREATE_AVATAR - assumed '_MI_USER_MENU_CREATE_AVATAR' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>37</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_KEYWORD_CREATE_AVATAR - assumed '_MI_USER_KEYWORD_CREATE_AVATAR' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>39</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_ADMENU_AVATAR_MANAGE - assumed '_MI_USER_ADMENU_AVATAR_MANAGE' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>42</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_KEYWORD_AVATAR_MANAGE - assumed '_MI_USER_KEYWORD_AVATAR_MANAGE' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>43</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_ADMENU_MAILJOB_MANAGE - assumed '_MI_USER_ADMENU_MAILJOB_MANAGE' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>47</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_KEYWORD_MAILJOB_MANAGE - assumed '_MI_USER_KEYWORD_MAILJOB_MANAGE' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>48</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_ADMENU_USER_DATA_DOWNLOAD - assumed '_MI_USER_ADMENU_USER_DATA_DOWNLOAD' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>52</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_KEYWORD_MAILJOB_MANAGE - assumed '_MI_USER_KEYWORD_MAILJOB_MANAGE' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>53</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_ADMENU_USER_DATA_CSVUPLOAD - assumed '_MI_USER_ADMENU_USER_DATA_CSVUPLOAD' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>57</b><br />
<br />
<b>Notice</b>: Use of undefined constant _MI_USER_KEYWORD_MAILJOB_MANAGE - assumed '_MI_USER_KEYWORD_MAILJOB_MANAGE' in <b>\XXX\YYY\html\modules\user\admin\menu.php</b> on line <b>58</b><br />

Discussion

  • minahito
    minahito
    2010-05-09

    We need to add guard code.

     
  • minahito
    minahito
    2010-05-09

    • milestone: 903888 --> 2.1.8
    • assigned_to: nobody --> minahito
    • status: open --> open-accepted
     
  • gigamaster
    gigamaster
    2012-07-24

    I've confirmed the fix. Closed.