a1dert/lh-tickets-test — Issue #184: Security issue: user can upload and execute php-file
Author: a1dert
Created: 2011-11-30 11:52:15+00:00
State: open

Imported from lighthouse. Original ticket at: http://redtape.lighthouseapp.com/projects/59696/tickets/412. Created by Alexey Derkach - 2011-07-28T12:20:33Z

Steps to reproduce:
1. Go to Expenses page.
2. Request expense.
3. Fill correct data.
4. Add attachment – php-file with code
@@@ php

@@@

5. Press Request.
6. Try to download php-file from expense.
7. You can see “Test!”.

Expected: users should not be able to upload php-files or php-files should not be execute.
Actual: user can upload and execute php-file

According to: [story 7104](https://tracker.anahoret.com/projects/44/stories/7104 "story 7104")