Skip to content
GitLab
  • Menu
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • Tryton Tryton
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 790
    • Issues 790
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 77
    • Merge requests 77
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Releases
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • External wiki
    • External wiki
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Tryton
  • TrytonTryton
  • Issues
  • #5808
Closed
Open
Created Aug 20, 2016 by Cédric Krier@cedOwner

file_open allows to open file outside trytond root

I found that file_open does not sanitize the name against up-level reference.
This allows to open any file that trytond has read access.
I see one particular case where this could be used. It is the field 'name' on Report definition which represent the relative path to the report template. As this field is writeable by the group "admin", this allow any "admin" user to forge a path to read file outside trytond directory (or egg path).
This behaviour could be an issue on shared hosting environment where trytond's administrators are not the same as the host administrators.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking