Skip to content
Snippets Groups Projects
  • Peter Rotich's avatar
    Arbitrary Method Invocation · 4dfb77ca
    Peter Rotich authored
    This commit addresses possible Arbitrary Method Invocation via AJAX file upload.
    
    To save some memory osTicket uses callback method to fetch the content of a
    file on mail fetch. $file['data'] was overloaded as a callback by simply
    checking if the content is callable, resulting in method invocation when
    content of the uploaded file is a callable.
    
    The address the issue we're not using locally set callback parameter / method.
    4dfb77ca