diff --git a/config/global.ini.php b/config/global.ini.php index 1dc2dda8252b797b54349db983df4f0ae1ebe8a6..d12f73c1c0d6a66c60a492ed21e34fc4e0382299 100644 --- a/config/global.ini.php +++ b/config/global.ini.php @@ -539,8 +539,9 @@ enable_load_data_infile = 1 ; - links to Uninstall themes will be disabled (but user can still enable/disable themes) enable_plugins_admin = 1 -; By setting this option to 1, it will be possible to upload plugin archives directly in Piwik -; Enabling this opens a remote code execution vulnarability, which yould be used by attackers gaining access to Piwik admin +; By setting this option to 1, it will be possible for Super Users to upload Piwik plugin ZIP archives directly in Piwik Administration. +; Enabling this opens a remote code execution vulnerability where +; an attacker who gained Super User access could execute custom PHP code in a Piwik plugin. enable_plugin_upload = 0 ; By setting this option to 0, you can prevent Super User from editing the Geolocation settings. diff --git a/core/CronArchive.php b/core/CronArchive.php index cc8a1de71c85a459f103d7ab90930ccc81977b22..d9ed8c6311d4477d737a4c10ea768bfafb396f6b 100644 --- a/core/CronArchive.php +++ b/core/CronArchive.php @@ -1017,7 +1017,7 @@ class CronArchive private function checkResponse($response, $url) { if (empty($response) - || stripos($response, 'error') + || stripos($response, 'error') !== false ) { return $this->logNetworkError($url, $response); }