Details
-
Type:
Bug
-
Status: Done/Fixed
-
Priority:
Critical
-
Resolution: Fixed/Completed
-
Affects Version/s: 4.2.16, 4.4.5
-
Component/s: CiviCRM Profile
-
Security Level: Security - Published
-
Labels:None
Description
Some advanced settings for CiviCRM profiles – such as post_URL and cancel_URL – are exported at runtime to an HTML FORM, returned in a POST-back, and then evaluated. This allows untrusted parties to manipulate their content.
To resolve this issue, we should update the profile-handling code to always load settings from the database.