HTTP_OAuth icon indicating copy to clipboard operation
HTTP_OAuth copied to clipboard

security vulnerability: OAuth/Message.php::setParameters()

Open dkaye opened this issue 16 years ago • 0 comments

The method OAuth/Message.php::setParameters() will overwrite any class properties with the same name as an HTTP GET/POST parameter. Suggest (a) add a test for if (isset($this->$name)) and (b) assigning default values to all class properties that shouldn't be allowed to be replaced by HTTP parameters.

dkaye avatar Aug 23 '09 18:08 dkaye