Fixed CVE-2019-18888

shinsenter · shinsenter · commit b2105fdf96f7 · 2019-12-06T17:23:14.000+09:00
diff --git a/composer.json b/composer.json
@@ -64,7 +64,7 @@
     "require":
     {
         "php": ">=5.6",
-        "symfony/http-foundation": ">2.6"
+        "symfony/polyfill-mbstring": "^1.0.0"
     },
     "minimum-stability": "dev",
     "prefer-stable": true,
diff --git a/composer.lock b/composer.lock
diff --git a/src/Defer.php b/src/Defer.php
@@ -209,7 +209,9 @@ protected function nodefer()
     {
         $no_libxml   = !$this->native_libxml;
         $request     = $this->http->request();
-        $has_nodefer = $request ? (bool) $request->get($this->no_defer_parameter) : false;
+        $has_nodefer = $request
+            ? (bool) $request->get($this->no_defer_parameter)
+            : !empty($_REQUEST[$this->no_defer_parameter]);
 
         return $has_nodefer || $no_libxml;
     }

Original file line number	Diff line number	Diff line change
`@@ -209,7 +209,9 @@ protected function nodefer()`
`209`	`209`	`{`
`210`	`210`	`$no_libxml = !$this->native_libxml;`
`211`	`211`	`$request = $this->http->request();`
`212`		`- $has_nodefer = $request ? (bool) $request->get($this->no_defer_parameter) : false;`
	`212`	`+ $has_nodefer = $request`
	`213`	`+ ? (bool) $request->get($this->no_defer_parameter)`
	`214`	`+ : !empty($_REQUEST[$this->no_defer_parameter]);`
`213`	`215`
`214`	`216`	`return $has_nodefer \|\| $no_libxml;`
`215`	`217`	`}`