[#15698] - Path disclosure: PHP Notice on Sysinfo
- Fixed in Code Base
- 22 May 2017
- Medium
- Build: staging
- # 15698
- Diff
- demis-palma:sysinfo-notice
User tests: Successful: Unsuccessful:
While creating a list of the installed extensions, AdminModelSysInfo::getExtensions() accesses properties whose existence is not guaranteed, and depends on third party extensions xml manifests files.
PHP Notice: Undefined property: stdClass::$authorUrl in [...]/administrator/components/com_admin/models/sysinfo.php on line 496
Summary of Changes
Replaced
"array based access" + "validation of data parsed"
with
"usage of JRegistry".
Testing Instructions
- Enable error reporting.
- Install an extension whose manifest xml file lacks one of the following fields: author, version, creationDate or authorUrl.
- Alternatively, remove one of the fields listed above by editing the column manifest_cache field in #__extensions table. Ensure to respect the json syntax in this case.
- Once in "System Information" menu, press "Download as text" or "Download as json" button.
Actual result
The PHP warning appears at the beginning of the export plain text file, and in the error log of the web server.
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Administration com_admin |
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/15698.
Does anyone know the reason why AppVeyor fails here?
@demis-palma see #15706 for the explanation - basically dont worry
| Status | Pending | ⇒ | Ready to Commit |
RTC after two successful tests.
rdeutz
- | Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2017-05-22 19:16:36 |
| Closed_By | ⇒ | rdeutz | |
| Labels |
Added:
?
|
||
I have tested this item✅ successfully on b7d5ba4
Confirmed the issue and confirmed that this pr resolves the issue
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/15698.