[TikiWiki-commits] [Git][tikiwiki/tiki][24.x] [BP][FIX] Fix PHP object injection in inter-Tiki authentication

Elifeleti Mukisa Dan pushed to branch 24.x at Tiki Wiki CMS Groupware / Tiki


Commits:
aa30dbbb by Elifeleti Mukisa Dan at 2026-05-23T12:33:22+00:00
[BP][FIX] Fix PHP object injection in inter-Tiki authentication
---
* [BP][FIX] Fix PHP object injection in inter-Tiki authentication
---
* [BP][FIX] Fix PHP object injection in inter-Tiki authentication
---
* [BP][FIX] Fix PHP object injection in inter-Tiki authentication
---
* [FIX] Fix PHP object injection in inter-Tiki authentication
---
* [FIX] Fix PHP object injection in inter-Tiki authentication

(cherry picked from commit c22aab947cd3c650140fb67c1d74c31d93cb4e74)

c22aab94 [FIX] Fix PHP object injection in inter-Tiki authentication

Co-authored-by: Danelif <[email protected]>

See merge request tikiwiki/tiki!10288

(cherry picked from commit 9643d6249980d3eaaa4b3948ae2cd107af667d6a)

f537d3d9 [FIX] Fix PHP object injection in inter-Tiki authentication

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!10303

See merge request tikiwiki/tiki!10328

See merge request tikiwiki/tiki!10341

See merge request tikiwiki/tiki!10353

- - - - -


3 changed files:

- lib/userslib.php
- remote.php
- tiki-login.php


Changes:

=====================================
lib/userslib.php
=====================================
@@ -8306,7 +8306,7 @@ class UsersLib extends TikiLib
         $user_details = $userlib->get_user_details($user);
         $user_info = $userlib->get_user_info($user);
         $ret['avatarData'] = new XML_RPC_Value($user_info['avatarData'], 'base64');
-        $ret['user_details'] = new XML_RPC_Value(serialize($user_details), 'string');
+        $ret['user_details'] = new XML_RPC_Value(json_encode($user_details), 'string');
         $params[] = new XML_RPC_Value($ret, 'struct');
         $msg = new XML_RPC_Message('intertiki.setUserInfo', $params);
         $result = $client->send($msg);
@@ -8326,13 +8326,13 @@ class UsersLib extends TikiLib
                 if ($key == '') {
                     break;
                 } elseif ($key == 'user_details') {
-                    $user_details = unserialize($value->scalarval());
+                    $user_details = json_decode($value->scalarval(), true);
                 } elseif ($key == 'avatarData') {
                     $avatarData = $value->scalarval();
                 }
             }
         } else {
-            $user_details = unserialize($response_value->scalarval());
+            $user_details = json_decode($response_value->scalarval(), true);
         }
 
         $userlib->set_user_fields($user_details['info']);


=====================================
remote.php
=====================================
@@ -140,7 +140,7 @@ function validate($params)
         $user_details = $userlib->get_user_details($login);
         $user_info = $userlib->get_user_info($login);
         $ret['avatarData'] = new XML_RPC_Value($user_info['avatarData'], 'base64');
-        $ret['user_details'] = new XML_RPC_Value(serialize($user_details), 'string');
+        $ret['user_details'] = new XML_RPC_Value(json_encode($user_details), 'string');
 
         return new XML_RPC_Response(new XML_RPC_Value($ret, 'struct'));
     } else {


=====================================
tiki-login.php
=====================================
@@ -162,19 +162,20 @@ if (
                 // this is slave intertiki site
                 $response_value = $rpcauth->value();
                 $avatarData = '';
-                if ($response_value->kindOf() == 'struct') {
-                    for (;;) {
-                        list($key, $value) = $response_value->structeach();
-                        if ($key == '') {
-                            break;
-                        } elseif ($key == 'user_details') {
-                            $user_details = unserialize($value->scalarval());
-                        } elseif ($key == 'avatarData') {
-                            $avatarData = $value->scalarval();
+                if ($rpcauth->valueType() == 'xmlrpcvals') {
+                    if ($response_value->kindOf() == 'struct') {
+                        foreach ($response_value as $key => $value) {
+                            if ($key == '') {
+                                break;
+                            } elseif ($key == 'user_details') {
+                                $user_details = json_decode($value->scalarval(), true);
+                            } elseif ($key == 'avatarData') {
+                                $avatarData = $value->scalarval();
+                            }
                         }
+                    } else {
+                        $user_details = json_decode($response_value->scalarval(), true);
                     }
-                } else {
-                    $user_details = unserialize($response_value->scalarval());
                 }
                 $requestedUser = $user_details['info']['login']; // use the correct capitalization
                 if (! $userlib->user_exists($requestedUser)) {



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/aa30dbbb5de5c15b54dce6331cd715b4b657c9f4

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/aa30dbbb5de5c15b54dce6331cd715b4b657c9f4
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs