{"action":"opened","issue":{"url":"https://api.github.com/repos/StudA-EPR/EPR-CRC/issues/17","labels_url":"https://api.github.com/repos/StudA-EPR/EPR-CRC/issues/17/labels{/name}","comments_url":"https://api.github.com/repos/StudA-EPR/EPR-CRC/issues/17/comments","events_url":"https://api.github.com/repos/StudA-EPR/EPR-CRC/issues/17/events","html_url":"https://github.com/StudA-EPR/EPR-CRC/issues/17","id":64984307,"number":17,"title":"Dateimanager: Berechtigungen einschränken","user":{"login":"nsommer","id":5717791,"avatar_url":"https://avatars.githubusercontent.com/u/5717791?v=3","gravatar_id":"","url":"https://api.github.com/users/nsommer","html_url":"https://github.com/nsommer","followers_url":"https://api.github.com/users/nsommer/followers","following_url":"https://api.github.com/users/nsommer/following{/other_user}","gists_url":"https://api.github.com/users/nsommer/gists{/gist_id}","starred_url":"https://api.github.com/users/nsommer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nsommer/subscriptions","organizations_url":"https://api.github.com/users/nsommer/orgs","repos_url":"https://api.github.com/users/nsommer/repos","events_url":"https://api.github.com/users/nsommer/events{/privacy}","received_events_url":"https://api.github.com/users/nsommer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"nsommer","id":5717791,"avatar_url":"https://avatars.githubusercontent.com/u/5717791?v=3","gravatar_id":"","url":"https://api.github.com/users/nsommer","html_url":"https://github.com/nsommer","followers_url":"https://api.github.com/users/nsommer/followers","following_url":"https://api.github.com/users/nsommer/following{/other_user}","gists_url":"https://api.github.com/users/nsommer/gists{/gist_id}","starred_url":"https://api.github.com/users/nsommer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nsommer/subscriptions","organizations_url":"https://api.github.com/users/nsommer/orgs","repos_url":"https://api.github.com/users/nsommer/repos","events_url":"https://api.github.com/users/nsommer/events{/privacy}","received_events_url":"https://api.github.com/users/nsommer/received_events","type":"User","site_admin":false},"milestone":null,"comments":0,"created_at":"2015-03-28T20:34:04Z","updated_at":"2015-03-28T20:34:04Z","closed_at":null,"body":"Theoretisch kann über den *GET-Parameter* **location** jedes Verzeichnis des Betriebssystems dargstellt werden. Dementsprechend können auch überall Dateien entsprechend der Rechte, die der Benutzer, unter dem der HTTP-Webserver bzw. der PHP-Interpreter des Betriebssystems läuft, gelöscht, umbenannt und angesehen werden.\r\n\r\nDaher sollte als Location eventuell nur das `/www`Verzeichnis oder sogar nur das `/www/photos` Verzeichnis erlaubt werden um die Manipulation des Betriebssystems zu verhindern."}}