From 21fcfae6b7c9a3327a86ed4bcdebb0761d37ca70 Mon Sep 17 00:00:00 2001 From: Neill Magill Date: Thu, 18 Aug 2016 08:49:37 +0100 Subject: [PATCH] MDL-55617 backup: Possible fatal errors in backup and restore The unserialize() function will not always return an object especially when as can happen the controller field of a record in the backup_controllers table is empty. This change ensures that in this case the script will not cause a fatal error, but instead throw an error. --- backup/util/dbops/backup_controller_dbops.class.php | 6 ++++++ backup/util/dbops/restore_controller_dbops.class.php | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/backup/util/dbops/backup_controller_dbops.class.php b/backup/util/dbops/backup_controller_dbops.class.php index 06aa4230761..0b5fb9b6386 100644 --- a/backup/util/dbops/backup_controller_dbops.class.php +++ b/backup/util/dbops/backup_controller_dbops.class.php @@ -105,6 +105,12 @@ abstract class backup_controller_dbops extends backup_dbops { throw new backup_dbops_exception('backup_controller_dbops_nonexisting'); } $controller = unserialize(base64_decode($controllerrec->controller)); + if (!is_object($controller)) { + // The controller field of the table did not contain a serialized object. + // It is made empty after it has been used successfully, it is likely that + // the user has pressed the browser back button at some point. + throw new backup_dbops_exception('backup_controller_dbops_loading_invalid_controller'); + } // Check checksum is ok. Sounds silly but it isn't ;-) if (!$controller->is_checksum_correct($controllerrec->checksum)) { throw new backup_dbops_exception('backup_controller_dbops_loading_checksum_mismatch'); diff --git a/backup/util/dbops/restore_controller_dbops.class.php b/backup/util/dbops/restore_controller_dbops.class.php index b68358e22f6..5691a925c4e 100644 --- a/backup/util/dbops/restore_controller_dbops.class.php +++ b/backup/util/dbops/restore_controller_dbops.class.php @@ -95,6 +95,12 @@ abstract class restore_controller_dbops extends restore_dbops { throw new backup_dbops_exception('restore_controller_dbops_nonexisting'); } $controller = unserialize(base64_decode($controllerrec->controller)); + if (!is_object($controller)) { + // The controller field of the table did not contain a serialized object. + // It is made empty after it has been used successfully, it is likely that + // the user has pressed the browser back button at some point. + throw new backup_dbops_exception('restore_controller_dbops_loading_invalid_controller'); + } // Check checksum is ok. Sounds silly but it isn't ;-) if (!$controller->is_checksum_correct($controllerrec->checksum)) { throw new backup_dbops_exception('restore_controller_dbops_loading_checksum_mismatch');