3

I have a basic security question about Magento 2.1

Do any of the modules in a default installation allow the execution of arbitrary PHP code directly from a database field? I'm assuming not, but I need to check.

Improve this question
1
  • you can check all the files in the folders called Setup inside each module. I would say no, but you can check it yourself.
    – Marius ♦
    Commented Jan 10, 2017 at 17:58

1 Answer 1

Reset to default
3

No. This would be a major security flaw that I cannot imagine would make it through code review at Magento.

To confirm, search for usages of the eval PHP function in the code base: no results.

Improve this answer
1
  • 1
    Always remember: eval === evil. But beware of 3rd party extensions: there are some extensions out there that indeed store PHP code in the database and use eval() to run it. Always code review 3rd party extensions!
    – Giel Berkers
    Commented Jan 11, 2017 at 7:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.