TYPO3 Core

I always got a warning in the install tool that my suhosin.executor.include.whitelist does not contain phar (and vfs). PHP info tells me, that my config reads as " https://,http://,phar://,vfs:// ".

Looking at the config docs of Suhosin [[http://www.suhosin.org/stories/configuration.html#suhosin-executor-include-whitelist]] this seems to be right, especially that there are commas and something after phar ("://").

The check in typo3/sysext/install/Classes/SystemEnvironment/Check.php in line 696 tries to explode the string using the delimiter ' ' which will fail in cases of comma separated strings. Furthermore, using !in_array('phar') in the next line will also always fail if something is appended to phar in config.

I changed

            $currentWhiteListArray = $this->trimExplode(' ', ini_get('suhosin.executor.include.whitelist'));
            if (!in_array('phar', $currentWhiteListArray)) {

to

            if (strpos(ini_get('suhosin.executor.include.whitelist','phar' ) === false)) {

to solve both problems. Of course, I had to repeat that for the vfs check.

Best.