mirror of
https://github.com/silverstripe/silverstripe-framework
synced 2024-09-05 17:21:16 +02:00
It shouldnt be possible to get ConfigStaticManifest to parse a user uploaded file, and if you could it shouldnt be possible to form PHP that token_get_all could parse which would end up executing any code. However just in case it is, this changes the eval to assign to a static, so the eval will give a syntax error if an attacker manages to make $value look like `ls` or some other expression |
||
---|---|---|
.. | ||
ClassLoader.php | ||
ClassManifest.php | ||
ConfigManifest.php | ||
ConfigStaticManifest.php | ||
ManifestFileFinder.php | ||
TemplateLoader.php | ||
TemplateManifest.php | ||
TokenisedRegularExpression.php |