Merge pull request #4422 from devansh-webkul/vul-issue
Vulnerability Fixed For PHP Office
This commit is contained in:
Glenn Hermans
GitHub
commit
18111309a5
|
|
@ -1,13 +1,12 @@
|
|||
{
|
||||
"name": "bagisto/bagisto",
|
||||
"description": "Bagisto Laravel ECommerce",
|
||||
"description": "Bagisto Laravel E-Commerce",
|
||||
"keywords": [
|
||||
"framework",
|
||||
"laravel"
|
||||
],
|
||||
"license": "MIT",
|
||||
"type": "project",
|
||||
|
||||
"require": {
|
||||
"php": "^7.2.5",
|
||||
"ext-curl": "*",
|
||||
|
|
@ -40,12 +39,11 @@
|
|||
"laravel/socialite": "^4.4",
|
||||
"laravel/tinker": "^2.0",
|
||||
"laravel/ui": "^2.0",
|
||||
"maatwebsite/excel": "3.1.19",
|
||||
"maatwebsite/excel": "^3.1.26",
|
||||
"paypal/paypal-checkout-sdk": "1.0.1",
|
||||
"prettus/l5-repository": "^2.6",
|
||||
"tymon/jwt-auth": "^1.0.0"
|
||||
},
|
||||
|
||||
"require-dev": {
|
||||
"codeception/codeception": "4.1.1",
|
||||
"codeception/module-asserts": "^1.1",
|
||||
|
|
@ -57,7 +55,6 @@
|
|||
"nunomaduro/collision": "^4.1",
|
||||
"phpunit/phpunit": "^8.5"
|
||||
},
|
||||
|
||||
"replace": {
|
||||
"bagisto/laravel-user": "v0.1.0",
|
||||
"bagisto/laravel-admin": "v0.1.0",
|
||||
|
|
@ -79,7 +76,6 @@
|
|||
"bagisto/laravel-paypal": "v0.1.0",
|
||||
"bagisto/laravel-discount": "v0.1.0"
|
||||
},
|
||||
|
||||
"autoload": {
|
||||
"classmap": [
|
||||
"database/seeds",
|
||||
|
|
@ -116,7 +112,6 @@
|
|||
"Webkul\\Marketing\\": "packages/Webkul/Marketing/src"
|
||||
}
|
||||
},
|
||||
|
||||
"autoload-dev": {
|
||||
"psr-4": {
|
||||
"Tests\\Acceptance\\": "tests/acceptance/",
|
||||
|
|
@ -125,7 +120,6 @@
|
|||
"Tests\\Trigger\\": "tests/trigger/"
|
||||
}
|
||||
},
|
||||
|
||||
"extra": {
|
||||
"laravel": {
|
||||
"dont-discover": [
|
||||
|
|
@ -133,22 +127,18 @@
|
|||
]
|
||||
}
|
||||
},
|
||||
|
||||
"scripts": {
|
||||
"post-root-package-install": [
|
||||
"@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
|
||||
],
|
||||
|
||||
"post-create-project-cmd": [
|
||||
"@php artisan key:generate",
|
||||
"Webkul\\Core\\Events\\ComposerEvents::postCreateProject"
|
||||
],
|
||||
|
||||
"post-autoload-dump": [
|
||||
"Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
|
||||
"@php artisan package:discover"
|
||||
],
|
||||
|
||||
"test": [
|
||||
"set -e",
|
||||
"@php artisan migrate:fresh --env=testing",
|
||||
|
|
@ -156,7 +146,7 @@
|
|||
"vendor/bin/codecept run functional",
|
||||
"vendor/bin/codecept run trigger"
|
||||
],
|
||||
"test-win": [
|
||||
"test-win": [
|
||||
"@set -e",
|
||||
"@php artisan migrate:fresh --env=testing",
|
||||
"vendor\\bin\\codecept.bat run unit",
|
||||
|
|
@ -171,4 +161,4 @@
|
|||
},
|
||||
"minimum-stability": "dev",
|
||||
"prefer-stable": true
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
230
config/excel.php
230
config/excel.php
|
|
@ -3,7 +3,6 @@
|
|||
use Maatwebsite\Excel\Excel;
|
||||
|
||||
return [
|
||||
|
||||
'exports' => [
|
||||
|
||||
/*
|
||||
|
|
@ -24,6 +23,16 @@ return [
|
|||
*/
|
||||
'pre_calculate_formulas' => false,
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Enable strict null comparison
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| When enabling strict null comparison empty cells ('') will
|
||||
| be added to the sheet.
|
||||
*/
|
||||
'strict_null_comparison' => false,
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| CSV Settings
|
||||
|
|
@ -40,23 +49,66 @@ return [
|
|||
'include_separator_line' => false,
|
||||
'excel_compatibility' => false,
|
||||
],
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Worksheet properties
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| Configure e.g. default title, creator, subject,...
|
||||
|
|
||||
*/
|
||||
'properties' => [
|
||||
'creator' => '',
|
||||
'lastModifiedBy' => '',
|
||||
'title' => '',
|
||||
'description' => '',
|
||||
'subject' => '',
|
||||
'keywords' => '',
|
||||
'category' => '',
|
||||
'manager' => '',
|
||||
'company' => '',
|
||||
],
|
||||
],
|
||||
|
||||
'imports' => [
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Read Only
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| When dealing with imports, you might only be interested in the
|
||||
| data that the sheet exists. By default we ignore all styles,
|
||||
| however if you want to do some logic based on style data
|
||||
| you can enable it by setting read_only to false.
|
||||
|
|
||||
*/
|
||||
'read_only' => true,
|
||||
|
||||
'heading_row' => [
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Ignore Empty
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| When dealing with imports, you might be interested in ignoring
|
||||
| rows that have null values or empty strings. By default rows
|
||||
| containing empty strings or empty values are not ignored but can be
|
||||
| ignored by enabling the setting ignore_empty to true.
|
||||
|
|
||||
*/
|
||||
'ignore_empty' => false,
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Heading Row Formatter
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| Configure the heading row formatter.
|
||||
| Available options: none|slug|custom
|
||||
|
|
||||
*/
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Heading Row Formatter
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| Configure the heading row formatter.
|
||||
| Available options: none|slug|custom
|
||||
|
|
||||
*/
|
||||
'heading_row' => [
|
||||
'formatter' => 'slug',
|
||||
],
|
||||
|
||||
|
|
@ -69,12 +121,33 @@ return [
|
|||
|
|
||||
*/
|
||||
'csv' => [
|
||||
'delimiter' => ',',
|
||||
'enclosure' => '"',
|
||||
'escape_character' => '\\',
|
||||
'contiguous' => false,
|
||||
'input_encoding' => 'UTF-8',
|
||||
'delimiter' => ',',
|
||||
'enclosure' => '"',
|
||||
'escape_character' => '\\',
|
||||
'contiguous' => false,
|
||||
'input_encoding' => 'UTF-8',
|
||||
],
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Worksheet properties
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| Configure e.g. default title, creator, subject,...
|
||||
|
|
||||
*/
|
||||
'properties' => [
|
||||
'creator' => '',
|
||||
'lastModifiedBy' => '',
|
||||
'title' => '',
|
||||
'description' => '',
|
||||
'subject' => '',
|
||||
'keywords' => '',
|
||||
'category' => '',
|
||||
'manager' => '',
|
||||
'company' => '',
|
||||
],
|
||||
|
||||
],
|
||||
|
||||
/*
|
||||
|
|
@ -82,9 +155,8 @@ return [
|
|||
| Extension detector
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| Configure here which writer type should be used when
|
||||
| the package needs to guess the correct type
|
||||
| based on the extension alone.
|
||||
| Configure here which writer/reader type should be used when the package
|
||||
| needs to guess the correct type based on the extension alone.
|
||||
|
|
||||
*/
|
||||
'extension_detector' => [
|
||||
|
|
@ -116,39 +188,93 @@ return [
|
|||
'pdf' => Excel::DOMPDF,
|
||||
],
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Value Binder
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| PhpSpreadsheet offers a way to hook into the process of a value being
|
||||
| written to a cell. In there some assumptions are made on how the
|
||||
| value should be formatted. If you want to change those defaults,
|
||||
| you can implement your own default value binder.
|
||||
|
|
||||
| Possible value binders:
|
||||
|
|
||||
| [x] Maatwebsite\Excel\DefaultValueBinder::class
|
||||
| [x] PhpOffice\PhpSpreadsheet\Cell\StringValueBinder::class
|
||||
| [x] PhpOffice\PhpSpreadsheet\Cell\AdvancedValueBinder::class
|
||||
|
|
||||
*/
|
||||
'value_binder' => [
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Default Value Binder
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| PhpSpreadsheet offers a way to hook into the process of a value being
|
||||
| written to a cell. In there some assumptions are made on how the
|
||||
| value should be formatted. If you want to change those defaults,
|
||||
| you can implement your own default value binder.
|
||||
|
|
||||
*/
|
||||
'default' => Maatwebsite\Excel\DefaultValueBinder::class,
|
||||
],
|
||||
|
||||
'transactions' => [
|
||||
'cache' => [
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Default cell caching driver
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| By default PhpSpreadsheet keeps all cell values in memory, however when
|
||||
| dealing with large files, this might result into memory issues. If you
|
||||
| want to mitigate that, you can configure a cell caching driver here.
|
||||
| When using the illuminate driver, it will store each value in a the
|
||||
| cache store. This can slow down the process, because it needs to
|
||||
| store each value. You can use the "batch" store if you want to
|
||||
| only persist to the store when the memory limit is reached.
|
||||
|
|
||||
| Drivers: memory|illuminate|batch
|
||||
|
|
||||
*/
|
||||
'driver' => 'memory',
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Transaction Handler
|
||||
| Batch memory caching
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| By default the import is wrapped in a transaction. This is useful
|
||||
| for when an import may fail and you want to retry it. With the
|
||||
| transactions, the previous import gets rolled-back.
|
||||
|
|
||||
| You can disable the transaction handler by setting this to null.
|
||||
| Or you can choose a custom made transaction handler here.
|
||||
|
|
||||
| Supported handlers: null|db
|
||||
| When dealing with the "batch" caching driver, it will only
|
||||
| persist to the store when the memory limit is reached.
|
||||
| Here you can tweak the memory limit to your liking.
|
||||
|
|
||||
*/
|
||||
'batch' => [
|
||||
'memory_limit' => 60000,
|
||||
],
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Illuminate cache
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| When using the "illuminate" caching driver, it will automatically use
|
||||
| your default cache store. However if you prefer to have the cell
|
||||
| cache on a separate store, you can configure the store name here.
|
||||
| You can use any store defined in your cache config. When leaving
|
||||
| at "null" it will use the default store.
|
||||
|
|
||||
*/
|
||||
'illuminate' => [
|
||||
'store' => null,
|
||||
],
|
||||
],
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Transaction Handler
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| By default the import is wrapped in a transaction. This is useful
|
||||
| for when an import may fail and you want to retry it. With the
|
||||
| transactions, the previous import gets rolled-back.
|
||||
|
|
||||
| You can disable the transaction handler by setting this to null.
|
||||
| Or you can choose a custom made transaction handler here.
|
||||
|
|
||||
| Supported handlers: null|db
|
||||
|
|
||||
*/
|
||||
'transactions' => [
|
||||
'handler' => 'db',
|
||||
],
|
||||
|
||||
|
|
@ -163,7 +289,7 @@ return [
|
|||
| storing reading or downloading. Here you can customize that path.
|
||||
|
|
||||
*/
|
||||
'local_path' => sys_get_temp_dir(),
|
||||
'local_path' => storage_path('framework/laravel-excel'),
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
@ -179,8 +305,24 @@ return [
|
|||
| in conjunction with queued imports and exports.
|
||||
|
|
||||
*/
|
||||
'remote_disk' => null,
|
||||
'remote_prefix' => null,
|
||||
'remote_disk' => null,
|
||||
'remote_prefix' => null,
|
||||
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
| Force Resync
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
||||
| When dealing with a multi server setup as above, it's possible
|
||||
| for the clean up that occurs after entire queue has been run to only
|
||||
| cleanup the server that the last AfterImportJob runs on. The rest of the server
|
||||
| would still have the local temporary file stored on it. In this case your
|
||||
| local storage limits can be exceeded and future imports won't be processed.
|
||||
| To mitigate this you can set this config value to be true, so that after every
|
||||
| queued chunk is processed the local temporary file is deleted on the server that
|
||||
| processed it.
|
||||
|
|
||||
*/
|
||||
'force_resync_remote' => null,
|
||||
],
|
||||
];
|
||||
|
|
|
|||
|
|
@ -169,7 +169,8 @@ return [
|
|||
*/
|
||||
'acceptedConditions' => [
|
||||
'=',
|
||||
'like'
|
||||
'like',
|
||||
'in'
|
||||
],
|
||||
/*
|
||||
|--------------------------------------------------------------------------
|
||||
|
|
|
|||
|
|
@ -0,0 +1,17 @@
|
|||
<?php
|
||||
|
||||
namespace DummyNamespace;
|
||||
|
||||
use DummyFullModelClass;
|
||||
use Maatwebsite\Excel\Concerns\FromCollection;
|
||||
|
||||
class DummyClass implements FromCollection
|
||||
{
|
||||
/**
|
||||
* @return \Illuminate\Support\Collection
|
||||
*/
|
||||
public function collection()
|
||||
{
|
||||
return DummyModelClass::all();
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
<?php
|
||||
|
||||
namespace DummyNamespace;
|
||||
|
||||
use Maatwebsite\Excel\Concerns\FromCollection;
|
||||
|
||||
class DummyClass implements FromCollection
|
||||
{
|
||||
/**
|
||||
* @return \Illuminate\Support\Collection
|
||||
*/
|
||||
public function collection()
|
||||
{
|
||||
//
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
<?php
|
||||
|
||||
namespace DummyNamespace;
|
||||
|
||||
use DummyFullModelClass;
|
||||
use Maatwebsite\Excel\Concerns\FromQuery;
|
||||
|
||||
class DummyClass implements FromQuery
|
||||
{
|
||||
/**
|
||||
* @return \Illuminate\Database\Query\Builder
|
||||
*/
|
||||
public function query()
|
||||
{
|
||||
return DummyModelClass::query();
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
<?php
|
||||
|
||||
namespace DummyNamespace;
|
||||
|
||||
use Maatwebsite\Excel\Concerns\FromQuery;
|
||||
|
||||
class DummyClass implements FromQuery
|
||||
{
|
||||
/**
|
||||
* @return \Illuminate\Database\Query\Builder
|
||||
*/
|
||||
public function query()
|
||||
{
|
||||
//
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
<?php
|
||||
|
||||
namespace DummyNamespace;
|
||||
|
||||
use Illuminate\Support\Collection;
|
||||
use Maatwebsite\Excel\Concerns\ToCollection;
|
||||
|
||||
class DummyClass implements ToCollection
|
||||
{
|
||||
/**
|
||||
* @param Collection $collection
|
||||
*/
|
||||
public function collection(Collection $collection)
|
||||
{
|
||||
//
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
<?php
|
||||
|
||||
namespace DummyNamespace;
|
||||
|
||||
use DummyFullModelClass;
|
||||
use Maatwebsite\Excel\Concerns\ToModel;
|
||||
|
||||
class DummyClass implements ToModel
|
||||
{
|
||||
/**
|
||||
* @param array $row
|
||||
*
|
||||
* @return \Illuminate\Database\Eloquent\Model|null
|
||||
*/
|
||||
public function model(array $row)
|
||||
{
|
||||
return new DummyModelClass([
|
||||
//
|
||||
]);
|
||||
}
|
||||
}
|
||||
Loading…
Reference in New Issue