Fix unserialize Vulnerability

[AngelFQC]

No description provided.

[jmontoyaa]

Qué es esto? "Fix unserialize"? Había un "unserialize" antes? Cuál es la tarea?
No estoy de acuerdo con modificar todos esos archivos dentro de main.
Son cambios muy fuertes en 1.11.x
No tengo idea de lo que hace ese código, no hay ninguna referencia 👎

[AngelFQC]

@jmontoyaa es para corregir una vulnerabilidad de unserialize.

https://www.owasp.org/index.php/PHP_Object_Injection

[jmontoyaa]

No agregar "use Brumann\Polyfill\Unserialize;" por todos lados.
Mejor centralizar todo en una función api. Modificar lo mínimo los archivos dentro de "/main".

Algo como:

$type = 'career';
$value = 'my data...';
$serialized = api_serialize_content($type, $value);

//---------------------
    function api_serialize_data($type, $value)
    {
        switch ($type) {
            case 'not_allowed_classes':
                 ///-something...
             break;
            case 'career':
                $graph = Unserialize::unserialize(
                    $value,
                    [
                        'allowed_classes' => [
                            Graph::class,
                            VerticesMap::class,
                            Vertices::class,
                            Edges::class,
                        ],
                    ]
                );
                break;
        }
    }

[AngelFQC]

Corregido

[jmontoyaa]

career ;)

[AngelFQC]

Bien visto!
Corregido

[jmontoyaa]

ya no se necesita ese "use" supongo ...

[AngelFQC]

Sí... se usa para un /** @var Graph $graph */

[ywarnier]

@jmontoyaa wrote:

No tengo idea de lo que hace ese código, no hay ninguna referencia

Pero sí estás en copia de los correos de seguridad donde hemos estado explicando todo ;-)

[jmontoyaa]

@ywarnier no sabía que era el mismo tema.

[ywarnier]

Looks good to me now. Thanks @jmontoyaa for the additional review!

[NicoDucou]

It generates an error in the learning path, but I can only reproduce it with a scorm.
To reproduce import the course which zip is in https://11.chamilo.org/main/document/showinframes.php?cidReq=NICODU&id_session=0&gidReq=0&gradebook=0&origin=&id=2799

And then got to the learning path tool and edit the the learning path setting and click on the "Hide table of contents frame" checkbox and validate.

You then get the following error :

Fatal error: main(): The script tried to execute a method or access a property of an incomplete object. Please ensure that the class definition "scorm" of the object you are trying to operate on was loaded _before_ unserialize() gets called or provide an autoloader to load the class definition in /furanet/sites/11.chamilo.org/web/htdocs/main/lp/lp_controller.php on line 237

You can directly reproduce the error from here : https://11.chamilo.org/main/lp/lp_controller.php?cidReq=JEUXSERIEUXORTHOGRAPHE&id_session=0&gidReq=0&gradebook=0&origin=&action=edit&lp_id=36 clicking on the "Hide table of contents frame" checkbox and validating.

[AngelFQC]

It should be fixed now

[NicoDucou]

All good, thank you. 👍

[ywarnier]

I also have an error when restoring a backup, about CourseRestorer::restore_gradebook()
(The script tried to execute a method or access a property of an incomplete object. Please ensure that the class definition "Category" of the object you are trying to operate on was loaded before unserialize() gets called or provide an autoloader to load the class definition in /var/www/chamilo111x/src/Chamilo/CourseBundle/Component/CourseCopy/CourseRestorer.php on line 3442)

[jmontoyaa]

I have the same error Yannick reported.

[AngelFQC]

Fixed here be4f22b c18601c

And moving the api_unserialize_content to its own class file.