Re: Security problems with TWIG webmail system

[João Gouveia <cercthar () TELEWEB PT>]

Hi ,

(snip)
> Another option... in index.php3, replace the line:
>
> if( $vhosts[$SERVER_NAME] )
>
> with:
>
> if( $vhosts[$SERVER_NAME] &&
> !isset($HTTP_GET_VARS[vhosts]) )
>
> This essentially checks to make sure that the
> vhosts element was defined locally (in
> config/config.inc.php3), not in the URL.

I think that's not a eficient fix. That or I'm seeing strange things.
Try this: index.php3?HTTP_GET_VARS=&vhosts[twig.server.tld]=test

Best regards,

Joao Gouveia aka Tharbad