harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Do not store serialized pconfig value received via to Module/Pconfig.php

Browse Source 
(cherry picked from commit 6b02c664fb)
This commit is contained in:
M. Dent 2018-11-25 09:22:09 +00:00 committed by Mario
parent a151532ffa
commit 3b42bd43ab
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
Zotlabs/Module/Pconfig.php
View File

@ -23,6 +23,11 @@ class Pconfig extends \Zotlabs\Web\Controller {
$v = trim($_POST['v']);
$aj = intval($_POST['aj']);
// Do not store "serialized" data received in the $_POST
if (preg_match('|^a:[0-9]+:{.*}$|s',$v) || preg_match('O:8:"stdClass":[0-9]+:{.*}$|s',$v)) {
return;
}
if(in_array(argv(2),$this->disallowed_pconfig())) {
notice( t('This setting requires special processing and editing has been blocked.') . EOL);
return;