Pages select function vunerability

[Rmacar]

There's a vulnerability in the select function within the pages controller.

The filter variable takes in any input that is posted to it without sanitising the input, this led to someone managing to post files onto our server and run functions from them.

If you look at line 897 in the pages controller you will see what I mean.

It also doesn't verify if the user is logged in at all, so is wide open for any user to access without needing to know a login

[daylightstudio]

Thanks for the report. We'll change to require access for now. Do you have an example you can directly email me (dave@bydaylight.com)?