It's possible to access: /umbraco/robots-txt/editRobotsTxtFile.aspx without being logged into umbraco! This came up in a security test of one of our umbraco installations last week.
I haven't had a chance to run reflector on it and check, but it looks like the page doesn't inherit from umbracoBasePage, which checks if you're logged in.
Major Security Issue!
Hi,
It's possible to access: /umbraco/robots-txt/editRobotsTxtFile.aspx without being logged into umbraco! This came up in a security test of one of our umbraco installations last week.
I haven't had a chance to run reflector on it and check, but it looks like the page doesn't inherit from umbracoBasePage, which checks if you're logged in.
Any chance of a fix ASAP?
As a temp fix, could you not use web.config security to deny access to that folder?
http://support.microsoft.com/kb/316871
Matt
Hi Tim,
This has been fixed in the latest version (v3.0). If you need a hotfix for the previous version (v2.0), let me know.
- Lee
Thanks Lee! I've dropped you an email via the link in your post.
:)
I have packaged up the hotfix, released as v2.0.1.
is working on a reply...