jekkos 03e0cbb36c fix(locale): validate language_code against known locales to block path traversal ...

postSaveLocale() stored language_code from user input with no allow-list validation, and it later flows into Language::setLocale()/load() where the locale segment is require()'d. An authenticated config-grant account could store a relative path (e.g. ../../public/uploads) and, combined with a planted file in public/uploads/, achieve unauthenticated RCE on the next request.

Validate the submitted language against array_keys(get_languages()) before storing, and harden languageExists() to reject path separators and dot-dot sequences. Adds regression tests.

2026-09-18 09:59:44 +00:00

..

Db_log.php

[Feature]: Case-sensitive attribute updates and CSV Import attribute deletion capability (#4384)

2026-04-09 11:13:22 +04:00

Load_config.php

fix(locale): validate language_code against known locales to block path traversal

2026-09-18 09:59:44 +00:00

Method.php

Improve code style and PSR-12 compliance (#4204)

2025-05-02 19:37:06 +02:00