Actions
Bug #89937
closed
Insecure Deserialization when knowing encryptionKey in Extbase
Status:
Closed
Priority:
Should have
Assignee:
-
Category:
-
Target version:
-
Start date:
2019-12-13
Due date:
% Done:
100%
Estimated time:
TYPO3 Version:
8
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:
Description
Back-porting https://review.typo3.org/c/Packages/TYPO3.CMS/+/61223 might be the best way to do it.
However existing application might have use their own way in creating those requests with PHP's serialize - that's why
- for v8 and v8
unserialize(..., [allowed_classes => false])should be used - for earlier version
unserialize(..., [allowed_classes => false])should be used in combination with https://packagist.org/packages/brumann/polyfill-unserialize should be used
Updated by 
Updated by 
Updated by
Actions