Upgrade 1-11.38

main/install/update-configuration.inc.php

@@ -36,22 +36,27 @@ if (defined('SYSTEM_INSTALLATION')) {
     $found_software_name = false;
     $found_software_url = false;
 
+    // Escape values before writing into PHP config to prevent code injection.
+    $safe = function ($value) {
+        return addcslashes((string) $value, "'\\");
+    };
+
     foreach ($file as $line) {
         $ignore = false;
         if (stripos($line, '$_configuration[\'system_version\']') !== false) {
             $found_version = true;
-            $line = '$_configuration[\'system_version\'] = \''.$GLOBALS['new_version'].'\';'."\r\n";
+            $line = '$_configuration[\'system_version\'] = \''.$safe($GLOBALS['new_version']).'\';'."\r\n";
         } elseif (stripos($line, '$_configuration[\'system_stable\']') !== false) {
             $found_stable = true;
             $line = '$_configuration[\'system_stable\'] = '.($GLOBALS['new_version_stable'] ? 'true' : 'false').';'."\r\n";
         } elseif (stripos($line, '$_configuration[\'software_name\']') !== false) {
             $found_software_name = true;
-            $line = '$_configuration[\'software_name\'] = \''.$GLOBALS['software_name'].'\';'."\r\n";
+            $line = '$_configuration[\'software_name\'] = \''.$safe($GLOBALS['software_name']).'\';'."\r\n";
         } elseif (stripos($line, '$_configuration[\'software_url\']') !== false) {
             $found_software_url = true;
-            $line = '$_configuration[\'software_url\'] = \''.$GLOBALS['software_url'].'\';'."\r\n";
+            $line = '$_configuration[\'software_url\'] = \''.$safe($GLOBALS['software_url']).'\';'."\r\n";
         } elseif (stripos($line, '$userPasswordCrypted') !== false) {
-            $line = '$_configuration[\'password_encryption\'] = \''.$userPasswordCrypted.'\';'."\r\n";
+            $line = '$_configuration[\'password_encryption\'] = \''.$safe($userPasswordCrypted).'\';'."\r\n";
         } elseif (stripos($line, '?>') !== false) {
             $ignore = true;
         }
@@ -61,16 +66,16 @@ if (defined('SYSTEM_INSTALLATION')) {
     }
 
     if (!$found_version) {
-        fwrite($fh, '$_configuration[\'system_version\'] = \''.$new_version.'\';'."\r\n");
+        fwrite($fh, '$_configuration[\'system_version\'] = \''.$safe($new_version).'\';'."\r\n");
     }
     if (!$found_stable) {
         fwrite($fh, '$_configuration[\'system_stable\'] = '.($new_version_stable ? 'true' : 'false').';'."\r\n");
     }
     if (!$found_software_name) {
-        fwrite($fh, '$_configuration[\'software_name\'] = \''.$software_name.'\';'."\r\n");
+        fwrite($fh, '$_configuration[\'software_name\'] = \''.$safe($software_name).'\';'."\r\n");
     }
     if (!$found_software_url) {
-        fwrite($fh, '$_configuration[\'software_url\'] = \''.$software_url.'\';'."\r\n");
+        fwrite($fh, '$_configuration[\'software_url\'] = \''.$safe($software_url).'\';'."\r\n");
     }
     fclose($fh);