Changeset 9023

Timestamp:

09/16/2014 02:47:06 PM (11 years ago)

Author:

boonebgorges

Message:

Use JSON encoding rather than PHP serialization for storing group creation details in a browser cookie

PHP serialization and unserialization of user-provided input introduces
security vulnerabilities.

This is a port of r9017 to trunk.

Props DJPaul

File:

• trunk/src/bp-groups/bp-groups-actions.php (modified) (2 diffs)

trunk/src/bp-groups/bp-groups-actions.php

@@ -135 +135 @@
     // Fetch the currently completed steps variable
     if ( isset( $_COOKIE['bp_completed_create_steps'] ) && !isset( $reset_steps ) )
-        $bp->groups->completed_create_steps = unserialize( stripslashes( $_COOKIE['bp_completed_create_steps'] ) );
+        $bp->groups->completed_create_steps = json_decode( base64_decode( stripslashes( $_COOKIE['bp_completed_create_steps'] ) ) );
 
     // Set the ID of the new group, if it has already been created in a previous step
     if ( isset( $_COOKIE['bp_new_group_id'] ) ) {
-        $bp->groups->new_group_id = $_COOKIE['bp_new_group_id'];
+        $bp->groups->new_group_id = (int) $_COOKIE['bp_new_group_id'];
         $bp->groups->current_group = groups_get_group( array( 'group_id' => $bp->groups->new_group_id ) );
 
@@ -227 +227 @@
         // Reset cookie info
         setcookie( 'bp_new_group_id', $bp->groups->new_group_id, time()+60*60*24, COOKIEPATH );
-        setcookie( 'bp_completed_create_steps', serialize( $bp->groups->completed_create_steps ), time()+60*60*24, COOKIEPATH );
+        setcookie( 'bp_completed_create_steps', base64_encode( json_encode( $bp->groups->completed_create_steps ) ), time()+60*60*24, COOKIEPATH );
 
         // If we have completed all steps and hit done on the final step we