maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

get rid of serialization completely to avoid possible code execution, fixes #555

Browse Source 
Signed-off-by: Michael Kaufmann <michael.kaufmann@aixit.com>
This commit is contained in:
Michael Kaufmann
2018-05-29 15:47:41 +02:00
parent 10330f8a7a
commit c1e62e6be7
13 changed files with 71 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
install/updates/froxlor/0.9/update_0.9.inc.php
View File

@@ -3968,3 +3968,33 @@ if (isDatabaseVersion('201805240')) {
updateToDbVersion('201805241');
}
if (isDatabaseVersion('201805241')) {
$do_update = true;
showUpdateStep("Checking for required PHP json-extension");
if (! extension_loaded('json')) {
$do_update = false;
lastStepStatus(2, 'not installed');
} else {
lastStepStatus(0);
showUpdateStep("Checking for current cronjobs that need converting");
$result_tasks_stmt = Database::query("
SELECT * FROM `" . TABLE_PANEL_TASKS . "` ORDER BY `id` ASC
");
$upd_stmt = Database::prepare("UPDATE `" . TABLE_PANEL_TASKS . "` SET `data` = :data WHERE `id` = :taskid");
while ($row = $result_tasks_stmt->fetch(PDO::FETCH_ASSOC)) {
if (! empty($row['data'])) {
$data = unserialize($row['data']);
Database::pexecute($upd_stmt, array(
'data' => json_encode($data),
'taskid' => $row['id']
));
}
}
lastStepStatus(0);
updateToDbVersion('201805290');
}
}