Merge pull request #41406 from owncloud/disable_phar_wrapper

fix: disable the phar wrapper globally

Author: DeepDiver1975

console.php

@@ -54,6 +54,8 @@ function exceptionHandler($exception) {
 	// set to run indefinitely if needed
 	\set_time_limit(0);
 
+	stream_wrapper_unregister('phar'); // disable phar wrapper
+
 	if (!OC::$CLI) {
 		echo "This script can be run from the command line only" . PHP_EOL;
 		exit(1);

cron.php

@@ -33,6 +33,7 @@
 
 require_once __DIR__ . '/lib/base.php';
 
+stream_wrapper_unregister('phar'); // disable phar wrapper
 if (!\OC::$CLI) {
 	$url = \OC::$server->getURLGenerator()->linkToRoute('core.Cron.run');
 	\header("Location: $url");

index.php

@@ -29,6 +29,7 @@
 
 try {
 	require_once __DIR__ . '/lib/base.php';
+	stream_wrapper_unregister('phar'); // disable phar wrapper
 	OC::handleRequest();
 } catch (\OC\ServiceUnavailableException $ex) {
 	\OC::$server->getLogger()->logException($ex, ['app' => 'index']);

lib/kernel.php

@@ -569,11 +569,6 @@ public static function init() {
 		@\ini_set('post_max_size', '10G');
 		@\ini_set('file_uploads', '50');
 
-		// disable phar handler in web requests
-		if (!self::$CLI) {
-			stream_wrapper_unregister("phar");
-		}
-
 		self::setRequiredIniValues();
 		self::handleAuthHeaders();
 		self::registerAutoloaderCache();

public.php

@@ -28,6 +28,7 @@
  */
 try {
 	require_once __DIR__ . '/lib/base.php';
+	stream_wrapper_unregister('phar'); // disable phar wrapper
 	if (\OCP\Util::needUpgrade()) {
 		// since the behavior of apps or remotes are unpredictable during
 		// an upgrade, return a 503 directly

remote.php

@@ -116,6 +116,7 @@ function resolveService($service) {
 try {
 	require_once __DIR__ . '/lib/base.php';
 
+	stream_wrapper_unregister('phar'); // disable phar wrapper
 	// All resources served via the DAV endpoint should have the strictest possible
 	// policy. Exempted from this is the SabreDAV browser plugin which overwrites
 	// this policy with a softer one if debug mode is enabled.