Project

General

Profile

Actions

Task #66740

closed

Issue #66263 patch do not work with suhosin.executor.disable_eval

Added by Matthias Toscanelli about 9 years ago. Updated over 6 years ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
Extension Manager
Target version:
Start date:
2015-05-02
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
6.2
PHP Version:
Tags:
Complexity:
Sprint Focus:

Description

The patch for issue 66263 introduces use of PHP function "eval".

TYPO3 can run with "suhosin.executor.disable_eval" that prevent most of hackers obfuscated intrusion.

Before this patch, "eval" was only used in core:
  • for testing purpose
  • to migrate localconf to LocalConfiguration (TYPO3\CMS\Install\Controller\StepController::migrateLocalconfToLocalConfigurationIfNeeded)
  • for ADOBD_text (ADODB_text::_query)

In production testing is never used and localconf has already be migrated.
In case of using ADODB_text, "eval" can not be disabled.

In this patch, "eval" is used to dynamically rename the "ext_update" class name to prevent two "ext_update" when name-spaces are not used.
We could simple change this by generating a temporary PHP file in "typo3temp" with the PHP code, include it and then remove it.


Related issues 1 (0 open1 closed)

Related to TYPO3 Core - Bug #66263: Access method in extension manager not respectedClosed2015-04-03

Actions
Actions

Also available in: Atom PDF