-Known Bugs in LambdaCore 1Oct94-

$string_utils:alt_pronoun_sub -- see anyone's properties, even unreadable
 ones, since it runs with wizard permissions.


How to Exploit:

This is bad. It runs with wizperms. So if I wanted to see a property on
 yourself that was unreadable I could use that..


;;dobj=$no_one;return $string_utils:alt_pronoun_sub("%[demail_address]");
=> "$no_one"

could also use it for other properties, too.

How to Fix:

Put a set_task_perms($no_one) in the beginning of $string_utils:alt_pronou
 n_sub.


-5-
[Previous Page][Next Page][Contents]