Fatal BUG: eval() with unescaped code

[Lumpi23]

Dear Stefano Lissa,

After installing Newsletter 3.0.2 on WP 3.4.2 I encountered fatal bug.

/plugin.php line 843

eval('function ' . $name . '(){global $newsletter;require "' . $file . '";}');

Here You have a string variable wrapped by doublequotes inside Your evaluating code. This means, a path like

D:\n_as_first_letter/newsletter

Is parsed as

D:
_as_first_letter/newsletter

And raises a Fatal error on a later request command. Note that mixing up backslashes and forward slashes is not pretty, but unavoidable on a Windows server.

A quick Fix would be, to replace the doublequotes by escaped single quotes:

eval('function ' . $name . '(){global $newsletter;require \'' . $file . '\';}');

[Stefano]

You’re right, thank you!

Stefano.

 

[Author]

Posts