[TikiWiki-commits] [Git][tikiwiki/tiki][27.x] [BP][FIX] Fix PHP object injection in inter-Tiki authentication

Elifeleti Mukisa Dan pushed to branch 27.x at Tiki Wiki CMS Groupware / Tiki


Commits:
57875d28 by Elifeleti Mukisa Dan at 2026-05-22T23:05:11+00:00
[BP][FIX] Fix PHP object injection in inter-Tiki authentication
---
* [BP][FIX] Fix PHP object injection in inter-Tiki authentication
---
* [BP][FIX] Fix PHP object injection in inter-Tiki authentication
---
* [FIX] Fix PHP object injection in inter-Tiki authentication
---
* [FIX] Fix PHP object injection in inter-Tiki authentication


(cherry picked from commit c22aab947cd3c650140fb67c1d74c31d93cb4e74)

c22aab94 [FIX] Fix PHP object injection in inter-Tiki authentication

Co-authored-by: Danelif <[email protected]>

See merge request tikiwiki/tiki!10288


(cherry picked from commit 9643d6249980d3eaaa4b3948ae2cd107af667d6a)

f537d3d9 [FIX] Fix PHP object injection in inter-Tiki authentication

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!10303

See merge request tikiwiki/tiki!10328

See merge request tikiwiki/tiki!10341

- - - - -


3 changed files:

- lib/userslib.php
- remote.php
- tiki-login.php


Changes:

=====================================
lib/userslib.php
=====================================
@@ -8414,7 +8414,7 @@ class UsersLib extends TikiLib
         $user_details = $userlib->get_user_details($user);
         $user_info = $userlib->get_user_info($user);
         $ret['avatarData'] = new XML_RPC_Value($user_info['avatarData'], 'base64');
-        $ret['user_details'] = new XML_RPC_Value(serialize($user_details), 'string');
+        $ret['user_details'] = new XML_RPC_Value(json_encode($user_details), 'string');
         $params[] = new XML_RPC_Value($ret, 'struct');
         $msg = new XML_RPC_Message('intertiki.setUserInfo', $params);
         $result = $client->send($msg);
@@ -8433,13 +8433,13 @@ class UsersLib extends TikiLib
                 if ($key == '') {
                     break;
                 } elseif ($key == 'user_details') {
-                    $user_details = unserialize($value->scalarval());
+                    $user_details = json_decode($value->scalarval(), true);
                 } elseif ($key == 'avatarData') {
                     $avatarData = $value->scalarval();
                 }
             }
         } else {
-            $user_details = unserialize($response_value->scalarval());
+            $user_details = json_decode($response_value->scalarval(), true);
         }
 
         $userlib->set_user_fields($user_details['info']);


=====================================
remote.php
=====================================
@@ -142,7 +142,7 @@ function validate($params)
         $user_details = $userlib->get_user_details($login);
         $user_info = $userlib->get_user_info($login);
         $ret['avatarData'] = new XML_RPC_Value($user_info['avatarData'], 'base64');
-        $ret['user_details'] = new XML_RPC_Value(serialize($user_details), 'string');
+        $ret['user_details'] = new XML_RPC_Value(json_encode($user_details), 'string');
 
         return new XML_RPC_Response(new XML_RPC_Value($ret, 'struct'));
     } else {


=====================================
tiki-login.php
=====================================
@@ -171,13 +171,13 @@ if (
                             if ($key == '') {
                                 break;
                             } elseif ($key == 'user_details') {
-                                $user_details = unserialize($value->scalarval());
+                                $user_details = json_decode($value->scalarval(), true);
                             } elseif ($key == 'avatarData') {
                                 $avatarData = $value->scalarval();
                             }
                         }
                     } else {
-                        $user_details = unserialize($response_value->scalarval());
+                        $user_details = json_decode($response_value->scalarval(), true);
                     }
                 }
                 $requestedUser = $user_details['info']['login']; // use the correct capitalization



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/57875d28fd341781676d6168fd237ea4379d888c

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/57875d28fd341781676d6168fd237ea4379d888c
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs