[GH-ISSUE #161] use of fopen #128

New issue

Closed

opened 2026-02-26 09:36:08 +03:00 by kerem · 1 comment

kerem commented

2026-02-26 09:36:08 +03:00

Owner

Originally created by @simongareste on GitHub (Dec 7, 2015).
Original GitHub issue: https://github.com/opensolutions/ViMbAdmin/issues/161

Hi,

You currently use fopen to check for new versions:

# library/ViMbAdmin/Version.php
$handle = fopen( 'http://www.opensolutions.ie/open-source/vimbadmin/latest-v3', 'r' );

We recently had an attack through this very function last week, on another server, and had to switch off allow_url_fopen in php.ini
Would it be possible to check the latest version using another way?

Originally created by @simongareste on GitHub (Dec 7, 2015). Original GitHub issue: https://github.com/opensolutions/ViMbAdmin/issues/161 Hi, You currently use fopen to check for new versions: ``` # library/ViMbAdmin/Version.php $handle = fopen( 'http://www.opensolutions.ie/open-source/vimbadmin/latest-v3', 'r' ); ``` We recently had an attack through this very function last week, on another server, and had to switch off allow_url_fopen in php.ini Would it be possible to check the latest version using another way?

kerem closed this issue

2026-02-26 09:36:09 +03:00

kerem commented

2026-02-26 09:36:10 +03:00

Author

Owner

@barryo commented on GitHub (Jan 7, 2016):

Would it be possible to check the latest version using another way?

No, sorry 😢

There's nothing more or less insecure about fopen() than any other function. It's just about how it's used.

You're free to disable the version check altogether:

https://github.com/opensolutions/ViMbAdmin/blob/master/application/configs/application.ini.dist#L330

I do however appreciate that we could parse the response better. I'll commit a fix for that now - thanks for making me have a closer look 😄

@barryo commented on GitHub (Jan 7, 2016): > Would it be possible to check the latest version using another way? No, sorry :cry: There's nothing more or less insecure about `fopen()` than any other function. It's just about how it's used. You're free to disable the version check altogether: https://github.com/opensolutions/ViMbAdmin/blob/master/application/configs/application.ini.dist#L330 I do however appreciate that we could parse the response better. I'll commit a fix for that now - thanks for making me have a closer look :smile: