Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-27318

Rating can be corrupted as score value is not validated

    Details

      Description

      Ratings score value is not checked, and any possibly values can be injected with a special URL :

      http://localhost:8080/c/ratings/rate_entry?className=com.liferay.portlet.blogs.model.BlogsEntry&classPK=10714&p_l_id=10183&score=500000

      It will be counted in the average so it is usable to radically modify rankings.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              pani.gui Pani Gui (Inactive)
              Reporter:
              vilmos.papp Vilmos Papp
              Participants of an Issue:
              Recent user:
              Esther Sanz
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Days since last comment:
                8 years, 24 weeks, 3 days ago

                  Packages

                  Version Package
                  6.0.X EE
                  6.1.1 CE GA2
                  6.1.20 EE GA2
                  6.2.0 CE M2