supplier

[ballot]

<?php

include(dirname(__FILE__).'/config/config.inc.php');
include(dirname(__FILE__).'/init.php');

//will be initialized bellow...
if(intval(Configuration::get('PS_REWRITING_SETTINGS')) === 1)
   $rewrited_url = null;

if (!isset($objectType))
   $objectType = 'supplier';

as u see $objectType is not defined if someone go to supplier.php?objectType=manufacturer or anything he can success dont know if it may cause a security bug or not taking $objectType from get/post/cookie

[rocky]

I can't see any problem. PrestaShop seems to ignore the query string. I tried to go to supplier.php?objectType=manufacturer, but it loaded suppliers as usual.

If you are still concerned, you can post this issue on the bug tracker to get an official response from the PrestaShop team.

[ballot]

it must be about register globals it works on me


http://www.my-deco-shop.com/design/supplier.php?objectType=manufacturer

http://www.my-deco-shop.com/design/supplier.php?objectType=supplier

http://www.my-deco-shop.com/design/supplier.php?objectType=blablabla