Code
- upgrade.php ➔ upgradeExit()
- upgrade.php ➔ redirectLocation()
- upgrade.php ➔ loadEssentialData()
- upgrade.php ➔ WelcomeLogin()
- upgrade.php ➔ checkLogin()
- upgrade.php ➔ UpgradeOptions()
- upgrade.php ➔ BackupDatabase()
- upgrade.php ➔ backupTable()
- upgrade.php ➔ DatabaseChanges()
- upgrade.php ➔ DeleteUpgrade()
- upgrade.php ➔ cli_scheduled_fetchSMfiles()
- upgrade.php ➔ convertSettingsToTheme()
- upgrade.php ➔ convertSettingstoOptions()
- upgrade.php ➔ php_version_check()
- upgrade.php ➔ db_version_check()
- upgrade.php ➔ fixRelativePath()
- upgrade.php ➔ parse_sql()
- upgrade.php ➔ upgrade_query()
- upgrade.php ➔ protected_alter()
- upgrade.php ➔ textfield_alter()
- upgrade.php ➔ checkChange()
- upgrade.php ➔ nextSubstep()
- upgrade.php ➔ cmdStep0()
- upgrade.php ➔ ConvertUtf8()
- upgrade.php ➔ serialize_to_json()
- upgrade.php ➔ move_db_last_error_to_cachedir()
- upgrade.php ➔ template_chmod()
- upgrade.php ➔ template_upgrade_above()
- upgrade.php ➔ template_upgrade_below()
- upgrade.php ➔ template_xml_above()
- upgrade.php ➔ template_xml_below()
- upgrade.php ➔ template_error_message()
- upgrade.php ➔ template_upgrade_options()
- upgrade.php ➔ template_backup_database()
- upgrade.php ➔ template_backup_xml()
- upgrade.php ➔ template_database_changes()
- upgrade.php ➔ template_database_xml()
- upgrade.php ➔ template_convert_utf8()
- upgrade.php ➔ template_convert_xml()
- upgrade.php ➔ template_serialize_json()
- upgrade.php ➔ template_serialize_json_xml()
- upgrade.php ➔ template_upgrade_complete()
- upgrade.php ➔ MySQLConvertOldIp()
- upgrade.php ➔ upgradeGetColumnInfo()

Loading history...
'location: ' . strtr($lo... array('&' => '&'))can contain request data and is used in response header context(s) leading to a potential security vulnerability.1 path for user data to reach this point
$_GET,and$locationis assignedin other/upgrade.php on line 423
$locationis passed through strtr()in other/upgrade.php on line 427
Response Splitting Attacks
Allowing an attacker to set a response header, opens your application to response splitting attacks; effectively allowing an attacker to send any response, he would like.
General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); }For numeric data, we recommend to explicitly cast the data: