MAGETWO-48819: [GitHub #3233] Arbitrary PHP code execution in M2.0.2

Hayder Sharhan · Hayder Sharhan · commit 63786165cd7a · 2016-02-25T16:09:53.000-06:00
- No need to add slashes now that we do not do eval.
diff --git a/setup/src/Magento/Setup/Module/I18n/Dictionary/Phrase.php b/setup/src/Magento/Setup/Module/I18n/Dictionary/Phrase.php
@@ -271,7 +271,6 @@ private function getCompiledString($string)
         preg_match_all('/[^\\\\]' . $encloseQuote . '|' . $encloseQuote . '[^\\\\]/', $string, $matches);
         if (count($matches[0])) {
             $string = preg_replace('/([^\\\\])' . $encloseQuote . ' ?\. ?' . $encloseQuote . '/', '$1', $string);
-            $string = addslashes($string);
         }
         return $string;
     }

Original file line number	Diff line number	Diff line change
`@@ -271,7 +271,6 @@ private function getCompiledString($string)`
`271`	`271`	`preg_match_all('/[^\\\\]' . $encloseQuote . '\|' . $encloseQuote . '[^\\\\]/', $string, $matches);`
`272`	`272`	`if (count($matches[0])) {`
`273`	`273`	`$string = preg_replace('/([^\\\\])' . $encloseQuote . ' ?\. ?' . $encloseQuote . '/', '$1', $string);`
`274`		`- $string = addslashes($string);`
`275`	`274`	`}`
`276`	`275`	`return $string;`
`277`	`276`	`}`