View source of any file on server (PHP end not already parsed code)

[eXodus]

Just take a look at the link below for example:

Code:

http://demo.opensourcecms.com/getsimple/admin/download.php?file=/home/opencms/public_html/demo/getsimple/index.php

I can view the pre-parsed code from any file on the server (that the user (of the server) it's on has access to)

Just droppin' a note

[Zegnåt]

Thanks for telling us about this. We already use a parser to stop you from being able to use “../” but we didn’t think about absolute paths. This will be fixed in the next update.

[RobA]

Only if logged in to the admin panel, though, correct?

-Rob A>

[Zegnåt]

Only if logged in to the admin panel, though, correct?

Yes, only if logged in. download.php checks your login before allowing you to download anything.