vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update filefunc.inc.php

Browse source 
Fix #28993
This commit is contained in:
le-reparateur 2024-03-21 17:08:14 +01:00 committed by GitHub
parent fd1322c095
commit 68cd3d657f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
htdocs/filefunc.inc.php
View file

@ -143,7 +143,8 @@ $result = @include_once $conffile; // Keep @ because with some error reporting m
$listofwrappers = stream_get_wrappers();
// We need '.phar' for geoip2. TODO Replace phar in geoip with exploded files so we can disable phar by default.
// phar stream does not auto unserialize content (possible code execution) since PHP 8.1
$arrayofstreamtodisable = array('compress.zlib', 'compress.bzip2', 'ftp', 'ftps', 'glob', 'data', 'expect', 'ogg', 'rar', 'zip', 'zlib');
// zip stream is necessary in import module
$arrayofstreamtodisable = array('compress.zlib', 'compress.bzip2', 'ftp', 'ftps', 'glob', 'data', 'expect', 'ogg', 'rar', 'zlib');
if (!empty($dolibarr_main_stream_to_disable) && is_array($dolibarr_main_stream_to_disable)) {
$arrayofstreamtodisable = $dolibarr_main_stream_to_disable;
}