3 ms·

Doesn't this mean if '/admin/factory_reset' normally requires authentication, requesting '/admin/factory_reset?_=graphic/' would bypass this without the need fo

• zwily 13y ago
  No, the query string is not part of the URL.
  • bigiain 13y ago
    I wonder if '/admin/graphic/../factory_reset' woud work?
    • xyzzy123 13y ago
      Or /admin;graphic/factory_reset (URI path parameters)
• pritambaral 13y ago
  The check seems to happen in the path portion of the url, and the parameters part isn't checked.