Skip to content

Commit 6a6d143

Browse files
committed
remove unsafe unserialize
1 parent 10abc61 commit 6a6d143

File tree

3 files changed

+3
-17
lines changed

3 files changed

+3
-17
lines changed

Diff for: alpha/apps/kaltura/lib/kalturaAction.class.php

+1-15
Original file line numberDiff line numberDiff line change
@@ -453,21 +453,7 @@ protected function setExpiryCredential ( $cred_name , $ttl_in_sec )
453453

454454
protected function getUserzoneCookie()
455455
{
456-
$cookie = $this->getContext()->getRequest()->getCookie('userzone');
457-
$length = strlen($cookie);
458-
if ($length <= 0)
459-
return null;
460-
461-
$serialized_data = substr($cookie, 0, $length - 32);
462-
$hash_signiture = substr($cookie, $length - 32);
463-
464-
// check the signiture
465-
if (md5($serialized_data . $this->cookieSecret) != $hash_signiture)
466-
return null;
467-
468-
$userzone_data = unserialize(base64_decode($serialized_data));
469-
470-
return array($userzone_data['id'], $userzone_data['email'], $userzone_data['screenname']);
456+
return null;
471457
}
472458

473459
protected function followRedirectCookie()

Diff for: alpha/apps/kaltura/modules/system/actions/helperAction.class.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ public function execute()
2828
}
2929
elseif ( $algo == "wiki_decode" )
3030
{
31-
$res = @unserialize ( base64_decode (str_replace ( array ( "|02" , "|01" ) , array ( "/" , "|" ) , $str ) ) ) ;
31+
$res = null;
3232
}
3333
elseif ( $algo == "wiki_decode_no_serialize" )
3434
{

Diff for: plugins/admin_console/kaltura_internal_tools/admin/KalturaInternalToolsSystemHelperAction.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ public function doAction(Zend_Controller_Action $action)
5151
}
5252
elseif ( $algo == "wiki_decode" )
5353
{
54-
$res = @unserialize ( base64_decode (str_replace ( array ( "|02" , "|01" ) , array ( "/" , "|" ) , $str ) ) ) ;
54+
$res = null;
5555
}
5656
elseif ( $algo == "wiki_decode_no_serialize" )
5757
{

0 commit comments

Comments
 (0)