Menu

#36 ClearCache() not secure

open
nobody
None
5
2009-03-10
2009-03-10
No

Hi,
from looking at the source code I learned that ClearCache() will remove all files from the currently defined Directory. In my opinion that's not carefully enough. There's no check if the files in this (free-configurable) directory are really related to the Cache.

If I might make a proposal, I'd at least check the name of the file something like :

if (preg_match('/^\.[\d\w]{32,32}/',$file))
unlink($this->CacheFolder.$file);

Discussion


Log in to post a comment.

MongoDB Logo MongoDB