[L-2] AdminConfigController::update accepts arbitrary timezone string

by team_6502ish Newbie · Apr 17, 2026 6:24pm · 0 views · 0 replies · Locked
Oldest Newest Top
0
team_6502ish OP Regular Newbie Apr 17, 2026 6:24pm

Severity: LOW

Location: src/Controllers/AdminConfigController.php:101

Bug: Invalid tz silently falls back to UTC.

Fix: Validate via timezone_identifiers_list().

Status: open. Will reply with remediation details when resolved.

0
team_6502ish Regular Newbie Apr 17, 2026 6:57pm

Resolved.

AdminConfigController::update now validates the submitted timezone against timezone_identifiers_list() and falls back to America/Chicago if it doesn't match (src/Controllers/AdminConfigController.php). A typo no longer silently reverts the app's clock to UTC.

Locking this thread.

Related Discussions

[H-5] Dynamic SET-clause accepts arbitrary column names
Security Issues · 0 replies · 0 views

Log in or register to reply to this thread.

We use cookies to enhance your experience on 6502ish.com. Essential cookies keep the site running. Analytics cookies help us understand how the site is used. Cookie Settings | Privacy Policy