maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

get rid of serialization completely to avoid possible code execution, fixes #555

Browse Source 
Signed-off-by: Michael Kaufmann <michael.kaufmann@aixit.com>
This commit is contained in:
Michael Kaufmann
2018-05-29 15:47:41 +02:00
parent 10330f8a7a
commit c1e62e6be7
13 changed files with 71 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/classes/output/class.paging.php
View File

@@ -114,7 +114,7 @@ class paging {
$this->userinfo = $userinfo;
if (!is_array($this->userinfo['lastpaging'])) {
$this->userinfo['lastpaging'] = unserialize($this->userinfo['lastpaging']);
$this->userinfo['lastpaging'] = json_decode($this->userinfo['lastpaging'], true);
}
$this->table = $table;
@@ -224,7 +224,7 @@ class paging {
AND `adminsession` = :adminsession
");
$upd_data = array(
'lastpaging' => serialize($this->userinfo['lastpaging']),
'lastpaging' => json_encode($this->userinfo['lastpaging']),
'hash' => $userinfo['hash'],
'userid' => $userinfo['userid'],
'ipaddr' => $userinfo['ipaddress'],