Code
- upgrade.php ➔ upgradeExit()
- upgrade.php ➔ redirectLocation()
- upgrade.php ➔ loadEssentialData()
- upgrade.php ➔ WelcomeLogin()
- upgrade.php ➔ checkLogin()
- upgrade.php ➔ UpgradeOptions()
- upgrade.php ➔ BackupDatabase()
- upgrade.php ➔ backupTable()
- upgrade.php ➔ DatabaseChanges()
- upgrade.php ➔ DeleteUpgrade()
- upgrade.php ➔ cli_scheduled_fetchSMfiles()
- upgrade.php ➔ convertSettingsToTheme()
- upgrade.php ➔ convertSettingstoOptions()
- upgrade.php ➔ php_version_check()
- upgrade.php ➔ db_version_check()
- upgrade.php ➔ fixRelativePath()
- upgrade.php ➔ parse_sql()
- upgrade.php ➔ upgrade_query()
- upgrade.php ➔ protected_alter()
- upgrade.php ➔ textfield_alter()
- upgrade.php ➔ checkChange()
- upgrade.php ➔ nextSubstep()
- upgrade.php ➔ cmdStep0()
- upgrade.php ➔ ConvertUtf8()
- upgrade.php ➔ serialize_to_json()
- upgrade.php ➔ move_db_last_error_to_cachedir()
- upgrade.php ➔ template_chmod()
- upgrade.php ➔ template_upgrade_above()
- upgrade.php ➔ template_upgrade_below()
- upgrade.php ➔ template_xml_above()
- upgrade.php ➔ template_xml_below()
- upgrade.php ➔ template_error_message()
- upgrade.php ➔ template_upgrade_options()
- upgrade.php ➔ template_backup_database()
- upgrade.php ➔ template_backup_xml()
- upgrade.php ➔ template_database_changes()
- upgrade.php ➔ template_database_xml()
- upgrade.php ➔ template_convert_utf8()
- upgrade.php ➔ template_convert_xml()
- upgrade.php ➔ template_serialize_json()
- upgrade.php ➔ template_serialize_json_xml()
- upgrade.php ➔ template_upgrade_complete()
- upgrade.php ➔ MySQLConvertOldIp()
- upgrade.php ➔ upgradeGetColumnInfo()

dirname($_SERVER['PHP_SE...ERVER['PHP_SELF']) : ''can contain request data and is used in output context(s) leading to a potential security vulnerability.1 path for user data to reach this point
PHP_SELFfrom$_SERVER,and$_SERVER['PHP_SELF']is passed through dirname()in other/upgrade.php on line 472
Preventing Cross-Site-Scripting Attacks
Cross-Site-Scripting allows an attacker to inject malicious code into your website - in particular Javascript code, and have that code executed with the privileges of a visiting user. This can be used to obtain data, or perform actions on behalf of that visiting user.
In order to prevent this, make sure to escape all user-provided data:
General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); }For numeric data, we recommend to explicitly cast the data: