SA-CORE-2019-012 by samuel.mortenson, larowlan, pwolanin, Sam152, Jasu_M,...

SA-CORE-2019-012 by samuel.mortenson, larowlan, pwolanin, Sam152, Jasu_M, David_Rothstein, michieltcs, Ayesh, alexpott, xjm, vijaycs85, mcdruid

composer.lock

@@ -653,7 +653,7 @@
             "dist": {
                 "type": "path",
                 "url": "core",
-                "reference": "fccc4c0fffd3f4d3aa239dff24ace99b9c52074e"
+                "reference": "5e617499e0c484e70f24bdf4334359cf37c95f9a"
             },
             "require": {
                 "asm89/stack-cors": "^1.1",
@@ -676,7 +676,7 @@
                 "ext-xml": "*",
                 "guzzlehttp/guzzle": "^6.3",
                 "masterminds/html5": "^2.1",
-                "pear/archive_tar": "^1.4.8",
+                "pear/archive_tar": "^1.4.9",
                 "php": ">=7.2.3",
                 "psr/log": "^1.0",
                 "stack/builder": "^1.0",
@@ -1252,16 +1252,16 @@
         },
         {
             "name": "pear/archive_tar",
-            "version": "1.4.8",
+            "version": "1.4.9",
             "source": {
                 "type": "git",
                 "url": "https://github.com/pear/Archive_Tar.git",
-                "reference": "442bdffb7edb84c898cfd94f7ac8500e49d5bbb5"
+                "reference": "c5b00053770e1d72128252c62c2c1a12c26639f0"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/pear/Archive_Tar/zipball/442bdffb7edb84c898cfd94f7ac8500e49d5bbb5",
-                "reference": "442bdffb7edb84c898cfd94f7ac8500e49d5bbb5",
+                "url": "https://api.github.com/repos/pear/Archive_Tar/zipball/c5b00053770e1d72128252c62c2c1a12c26639f0",
+                "reference": "c5b00053770e1d72128252c62c2c1a12c26639f0",
                 "shasum": ""
             },
             "require": {
@@ -1314,7 +1314,7 @@
                 "archive",
                 "tar"
             ],
-            "time": "2019-10-21T13:31:24+00:00"
+            "time": "2019-12-04T10:17:28+00:00"
         },
         {
             "name": "pear/console_getopt",

composer/Metapackage/CoreRecommended/composer.json

@@ -22,7 +22,7 @@
         "guzzlehttp/promises": "v1.3.1",
         "guzzlehttp/psr7": "1.6.1",
         "masterminds/html5": "2.7.0",
-        "pear/archive_tar": "1.4.8",
+        "pear/archive_tar": "1.4.9",
         "pear/console_getopt": "v1.4.2",
         "pear/pear-core-minimal": "v1.10.9",
         "pear/pear_exception": "v1.0.0",

core/composer.json

@@ -45,7 +45,7 @@
         "zendframework/zend-diactoros": "^1.8",
         "composer/semver": "^1.0",
         "asm89/stack-cors": "^1.1",
-        "pear/archive_tar": "^1.4.8",
+        "pear/archive_tar": "^1.4.9",
         "psr/log": "^1.0"
     },
     "conflict": {

core/lib/Drupal/Core/Archiver/Tar.php

@@ -54,10 +54,10 @@ public function remove($file_path) {
    */
   public function extract($path, array $files = []) {
     if ($files) {
-      $this->tar->extractList($files, $path);
+      $this->tar->extractList($files, $path, '', FALSE, FALSE);
     }
     else {
-      $this->tar->extract($path);
+      $this->tar->extract($path, FALSE, FALSE);
     }
 
     return $this;

core/modules/config/src/Form/ConfigImportForm.php

@@ -123,7 +123,7 @@ public function submitForm(array &$form, FormStateInterface $form_state) {
         foreach ($archiver->listContent() as $file) {
           $files[] = $file['filename'];
         }
-        $archiver->extractList($files, $this->settings->get('config_sync_directory'));
+        $archiver->extractList($files, $this->settings->get('config_sync_directory'), '', FALSE, FALSE);
         $this->messenger()->addStatus($this->t('Your configuration files were successfully uploaded and are ready for import.'));
         $form_state->setRedirect('config.sync');
       }