RSS Feed/News XF\Service\AddOnArchive\Validator::validate() is not particularly robust is addon.json is in a weird state

[ENXF NET]

PHP:

if (!$zip->extractTo(File::createTempDir(), $jsonFile))
{
    $error = \XF::phrase('files_could_not_be_extracted_from_add_on_archive');
    return false;
}

$json = json_decode($zip->getFromName($jsonFile), true);
$addOnManager = $this->app->addOnManager();

$title = $json['title'];
$newVersionId = $json['version_id'];

This extracts the the addon file twice, and if the addon file fails to decode this can silently fail on production copies instead of giving a saner error message...

Read more

Continue reading...