L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-62947 core_form: fix remote code execution exploit in QuickForms

Browse Source 
Applies the patch found upstream:
https://github.com/pear/HTML_QuickForm/commit/
d3a6d5c44dedf3c164c6c79198e4ef479bcedcd2 and make util methods static
for php7 compatibility.
This commit is contained in:
Jake Dallimore
2018-09-05 12:13:28 +08:00
committed by Jun Pataleta
parent 444d046f9e
commit 59de100b8b
4 changed files with 204 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/pear/HTML/QuickForm.php
+12 -2
View File
@@ -21,6 +21,10 @@
require_once('PEAR.php');
require_once('HTML/Common.php');
/**
* Static utility methods.
*/
require_once('HTML/QuickForm/utils.php');
$GLOBALS['HTML_QUICKFORM_ELEMENT_TYPES'] =
array(
@@ -834,9 +838,15 @@ class HTML_QuickForm extends HTML_Common {
} elseif (false !== ($pos = strpos($elementName, '['))) {
$base = substr($elementName, 0, $pos);
$idx = "['" . str_replace(array(']', '['), array('', "']['"), substr($elementName, $pos + 1, -1)) . "']";
$keys = str_replace(
array('\\', '\'', ']', '['), array('\\\\', '\\\'', '', "']['"),
substr($elementName, $pos + 1, -1)
);
$idx = "['" . $keys . "']";
$keyArray = explode("']['", $keys);
if (isset($this->_submitValues[$base])) {
$value = eval("return (isset(\$this->_submitValues['{$base}']{$idx})) ? \$this->_submitValues['{$base}']{$idx} : null;");
$value = HTML_QuickForm_utils::recursiveValue($this->_submitValues[$base], $keyArray, NULL);
}
if ((is_array($value) || null === $value) && isset($this->_submitFiles[$base])) {