Changeset 3816:7bda396fcd78

Timestamp:

08/21/18 07:11:18 (7 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

source:

cb6198b84757d9288637abeaa1939dabeb145c11

Message:

Unregister phar wrapper in order to avoid PHP Phar extension vulerability, see  https://cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It's-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf - Thank's DaScritch? for reporting this

File:

• inc/prepend.php (modified) (1 diff)

inc/prepend.php

@@ -103 +103 @@
 if (function_exists('stream_wrapper_unregister')) {
     $special_wrappers = array_intersect(array('http', 'https', 'ftp', 'ftps', 'ssh2.shell', 'ssh2.exec',
-        'ssh2.tunnel', 'ssh2.sftp', 'ssh2.scp', 'ogg', 'expect'), stream_get_wrappers());
+        'ssh2.tunnel', 'ssh2.sftp', 'ssh2.scp', 'ogg', 'expect', 'phar'), stream_get_wrappers());
     foreach ($special_wrappers as $p) {
         @stream_wrapper_unregister($p);