From cd367dabbd5b07f3d2d0e928a73fb15513b83c90 Mon Sep 17 00:00:00 2001 From: Tim Starling Date: Thu, 30 Apr 2009 05:21:27 +0000 Subject: [PATCH] Sanitize cleanCallback on wakeup. Extra security check for APIs like SecurePoll/auth-api.php. --- includes/Status.php | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/includes/Status.php b/includes/Status.php index 1eb2b66a45..516ed95bcd 100644 --- a/includes/Status.php +++ b/includes/Status.php @@ -84,6 +84,13 @@ class Status { $this->ok = false; } + /** + * Sanitize the callback parameter on wakeup, to avoid arbitrary execution. + */ + function __wakeup() { + $this->cleanCallback = false; + } + protected function cleanParams( $params ) { if ( !$this->cleanCallback ) { return $params; -- 2.20.1