Question Full path disclosure downloading attachments

Hi Corinne,

It seems this only happens when you edit forum entries.

This is my workaround; it's a bit technical:

1. Make a backup. We have to modify some database fields, so the entire site could break.
2. Using phpmyadmin (or similar) go to kunena_attachments table.
3. Search something relevant of your path (for example, media) in the filename_real field:



4. Results are the attachments with full path. Just edit each one deleting the full path and keeping the file name.
For example, in your case you should have an entry with media/kunena/attachments/Dienstleistungskatalog_eines_Versicherungsbrokers.pdf/Dienstleistungskatalog_eines_Versicherungsbrokers.pdf and after editing you should have only Dienstleistungskatalog_eines_Versicherungsbrokers.pdf

Obviously, you have to do this every time you edit a forum entry while a patch is provided.

If you don't know how to do it, I can give you a hand. Just use the contact form of my website and I will help you.

Regards,
Jose

Hello Jose

Thanks for your solution, but is not exactly like this.

I made to printscreens from a wrong and a correct entry.

The "folder" entry is not correct...

OLD: /media/kunena/attachments/documentname.pdf




Correct: media/kunena/attachments




Maybe i can make a database replace from all entries with ".pdf" to /media/kunena/attachments

i will try this :silly:

Thank you for your help
Corinne

You're welcome Corinne!

In my case, the full path disclosure is located only in the filename_real field...

To be fully sure there is no path disclosure we should replace all downloadable file types, not only .pdf. More work to do! :silly:

Regards,
Jose

I have some path there are correct... so i need only the .pdf's

If somebody else have the same problem here my Script

UPDATE `xxx_kunena_attachments` SET `folder` = "media/kunena/attachments" WHERE `folder` LIKE "%.pdf"

Now everything works okay

Have a nice Day
Corinne

The userid should appear in the path and in your case it doesn't appear...

I'am investigating on the issue actually, but if you set protected attachments on ON the path of attachment that you can see when you hover it is the following :

mysite.com/kunena_test/index.php/forum/attachment/5

Hi xillibit,

When I discovered the issue, the protect attachments option was set to OFF. After that, I enabled it, edited a post and uploaded a file but the issue still remained...

Regards,
Jose