malyshev/yii-debug-toolbar — Issue #29: assets/ajax.php is dangerous
Author: mytskine
Created: 2011-11-03 17:10:11+00:00
State: open

This file has many problems.
1. It contains hard-coded paths that may not work, e.g. if there is no directory named `yii-1.1.8.r3324` or if the application is not in the document root of the web server.
2. It won't work on some well-configured servers, because the PHP engine is disabled in the assets/ directory.
3. While the access to the toolbar is filtered, this file is in free access to everyone.
4. When the assets directory allows php files, this "ajax.php" file is **dangerous** with GET parameters like `?deleteasset=../`. It will recursively delete files in the document root of the server.

I believe this makes "assets/ajax.php" a critical bug with a **major security concern**.