MAGETWO-42038: RCE/DOS via cron.php

safwkhan · safwkhan · commit b1d70fcb5b3b · 2015-10-15T14:57:16.000-05:00
- Changes based on code review feedback.
diff --git a/app/code/Magento/Cron/Observer/ProcessCronQueueObserver.php b/app/code/Magento/Cron/Observer/ProcessCronQueueObserver.php
@@ -149,7 +149,7 @@ public function execute(\Magento\Framework\Event\Observer $observer)
 
         foreach ($jobGroupsRoot as $groupId => $jobsRoot) {
             if ($this->_request->getParam('group') !== null
-                && $this->_request->getParam('group') !== escapeshellarg($groupId)
+                && $this->_request->getParam('group') !== '\'' . ($groupId) . '\''
                 && $this->_request->getParam('group') !== $groupId) {
                 continue;
             }

Original file line number	Diff line number	Diff line change
`@@ -149,7 +149,7 @@ public function execute(\Magento\Framework\Event\Observer $observer)`
`149`	`149`
`150`	`150`	`foreach ($jobGroupsRoot as $groupId => $jobsRoot) {`
`151`	`151`	`if ($this->_request->getParam('group') !== null`
`152`		`- && $this->_request->getParam('group') !== escapeshellarg($groupId)`
	`152`	`+ && $this->_request->getParam('group') !== '\'' . ($groupId) . '\''`
`153`	`153`	`&& $this->_request->getParam('group') !== $groupId) {`
`154`	`154`	`continue;`
`155`	`155`	`}`