Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[10.x] fix compiled view file ends with .php #46755

Merged
merged 4 commits into from
Apr 12, 2023
Merged

[10.x] fix compiled view file ends with .php #46755

merged 4 commits into from
Apr 12, 2023

Conversation

kstych
Copy link
Contributor

@kstych kstych commented Apr 12, 2023

hi, current implementation fails when a view contains following

<?php
eval("dump(Auth::user());");

with error : failed to open file .../storage/framework/views/some-file-name.php(3) : eval()'d code

"file_get_contents(...storage/framework/views/some-file-name.php(3) : eval()'d code): Failed to open stream: No such file or directory"

this is due to the "eval' code" string appended at the end of the file name.

This fix also checks the file name ends with .php to correctly validate before reading the file

Thanks

@kstych kstych changed the title fix compiled view file ends with .php [10.x] fix compiled view file ends with .php Apr 12, 2023
@taylorotwell taylorotwell merged commit 1c2eef8 into laravel:10.x Apr 12, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants