L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-17274 security: register globals not supported- now we are preventing upgrades and installs too; backported from HEAD

Browse Source
This commit is contained in:
skodak
2008-11-19 09:46:38 +00:00
parent 934f6bd973
commit f92fbb037d
2 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/environment.xml
+2 -2
View File
@@ -200,7 +200,7 @@
<ON_OK message="questioncwqpfsok" />
</FEEDBACK>
</CUSTOM_CHECK>
<CUSTOM_CHECK file="lib/customcheckslib.php" function="php_check_register_globals" level="optional">
<CUSTOM_CHECK file="lib/customcheckslib.php" function="php_check_register_globals" level="required">
<FEEDBACK>
<ON_CHECK message="globalswarning" />
</FEEDBACK>
@@ -272,7 +272,7 @@
</PHP_EXTENSION>
</PHP_EXTENSIONS>
<CUSTOM_CHECKS>
<CUSTOM_CHECK file="lib/customcheckslib.php" function="php_check_register_globals" level="optional">
<CUSTOM_CHECK file="lib/customcheckslib.php" function="php_check_register_globals" level="required">
<FEEDBACK>
<ON_CHECK message="globalswarning" />
</FEEDBACK>
install.php
+13 -3
View File
@@ -753,6 +753,8 @@ if ($nextstage == SAVE) {
function form_table($nextstage = WELCOME, $formaction = "install.php") {
global $INSTALL, $db;
$enablenext = true;
/// Print the standard form if we aren't in the DOWNLOADLANG page
/// because it has its own form.
if ($nextstage != DOWNLOADLANG) {
@@ -787,12 +789,16 @@ function form_table($nextstage = WELCOME, $formaction = "install.php") {
/// Check that PHP is of a sufficient version
print_compatibility_row(inst_check_php_version(), get_string('phpversion', 'install'), get_string('phpversionerror', 'install'), 'phpversionhelp');
$enablenext = $enablenext && inst_check_php_version();
/// Check session auto start
print_compatibility_row(!ini_get_bool('session.auto_start'), get_string('sessionautostart', 'install'), get_string('sessionautostarterror', 'install'), 'sessionautostarthelp');
$enablenext = $enablenext && !ini_get_bool('session.auto_start');
/// Check magic quotes
print_compatibility_row(!ini_get_bool('magic_quotes_runtime'), get_string('magicquotesruntime', 'install'), get_string('magicquotesruntimeerror', 'install'), 'magicquotesruntimehelp');
$enablenext = $enablenext && !ini_get_bool('magic_quotes_runtime');
/// Check unsupported PHP configuration
print_compatibility_row(ini_get_bool('magic_quotes_gpc') || (!ini_get_bool('register_globals')), get_string('globalsquotes', 'install'), get_string('globalsquoteserror', 'install'), 'globalsquoteshelp');
print_compatibility_row(!ini_get_bool('register_globals'), get_string('globalsquotes', 'install'), get_string('globalswarning', 'install'));
$enablenext = $enablenext && !ini_get_bool('register_globals');
/// Check safe mode
print_compatibility_row(!ini_get_bool('safe_mode'), get_string('safemode', 'install'), get_string('safemodeerror', 'install'), 'safemodehelp', true);
/// Check file uploads
@@ -965,9 +971,11 @@ function form_table($nextstage = WELCOME, $formaction = "install.php") {
<div><input type="hidden" name="stage" value="<?php echo $nextstage ?>" /></div>
<?php
}
$disabled = $enablenext ? '' : 'disabled="disabled"';
?>
<?php echo ($nextstage < SAVE) ? "<div><input type=\"submit\" name=\"next\" value=\"".get_string('next')." &raquo;\" style=\"float: ".fix_align_rtl("right")."\"/></div>\n" : "&nbsp;\n" ?>
<?php echo ($nextstage < SAVE) ? "<div><input $disabled type=\"submit\" name=\"next\" value=\"".get_string('next')." &raquo;\" style=\"float: ".fix_align_rtl("right")."\"/></div>\n" : "&nbsp;\n" ?>
<?php echo ($nextstage > WELCOME) ? "<div><input type=\"submit\" name=\"prev\" value=\"&laquo; ".get_string('previous')."\" style=\"float: ".fix_align_rtl("left")."\"/></div>\n" : "&nbsp;\n" ?>
<?php
@@ -1011,7 +1019,9 @@ function print_compatibility_row($success, $testtext, $errormessage, $helpfield=
echo "</p></td>\n";
echo "<td valign=\"top\">";
echo "<p class=\"p_install\">$errormessage ";
install_helpbutton("install.php?help=$helpfield");
if ($helpfield !== '') {
install_helpbutton("install.php?help=$helpfield");
}
echo "</p></td>\n";
}
echo "</tr>\n";