3

I have a basic security question about Magento 2.1

Do any of the modules in a default installation allow the execution of arbitrary PHP code directly from a database field? I'm assuming not, but I need to check.

|improve this question
  • you can check all the files in the folders called Setup inside each module. I would say no, but you can check it yourself. – Marius♦ Jan 10 '17 at 17:58
3

No. This would be a major security flaw that I cannot imagine would make it through code review at Magento.

To confirm, search for usages of the eval PHP function in the code base: no results.

|improve this answer
  • 1
    Always remember: eval === evil. But beware of 3rd party extensions: there are some extensions out there that indeed store PHP code in the database and use eval() to run it. Always code review 3rd party extensions! – Giel Berkers Jan 11 '17 at 7:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.