[SECURITY] Fix insecure unserialize in colorpicker 69/30269/2
authorHelmut Hummel <helmut.hummel@typo3.org>
Thu, 22 May 2014 07:31:03 +0000 (09:31 +0200)
committerOliver Hader <oliver.hader@typo3.org>
Thu, 22 May 2014 07:31:07 +0000 (09:31 +0200)
Change-Id: Iee9d2712ae3b489a89604cb7be8c2af27a924fe0
Fixes: #56458
Releases: 6.1, 6.0, 4.7, 4.5
Security-Commit: 36eb11e44d7faca68b3d6fefb1633a463cc22fac
Security-Bulletin: TYPO3-CORE-SA-2014-001
Reviewed-on: https://review.typo3.org/30269
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
typo3/wizard_colorpicker.php

index b6ae2ae..af1b364 100644 (file)
@@ -131,10 +131,10 @@ class SC_wizard_colorpicker {
                        }
                }
 
-                       // Setting field-change functions:
-               $fieldChangeFuncArr = unserialize($this->fieldChangeFunc);
                $update = '';
                if ($this->areFieldChangeFunctionsValid()) {
+                               // Setting field-change functions:
+                       $fieldChangeFuncArr = unserialize($this->fieldChangeFunc);
                        unset($fieldChangeFuncArr['alert']);
                        foreach($fieldChangeFuncArr as $v)      {
                                $update.= '