CVE-2022-0921 (PHP, published 2022-03-11T18:15Z)
Description: value: Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.
Severity: MEDIUM (CVSS v3 base score: 6.7)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/microweber/microweber
Files changed:
composer.json
composer.lock
src/MicroweberPackages/Backup/Loggers/DefaultLogger.php
src/MicroweberPackages/Import/DatabaseWriter.php
src/MicroweberPackages/Import/Formats/ZipReader.php
src/MicroweberPackages/Import/tests/ReadersTest.php
userfiles/modules/admin/backup/backup_modal.php
Commit message: secure upgrade on php files upload


Vulnerable code:
        "symplify/monorepo-builder": "^8.1",
    "content-hash": "d022c816080bcecc0ba4a49f3890a244",
        {
            "name": "composer/package-versions-deprecated",
            "version": "dev-master",
            "source": {
                "type": "git",
                "url": "https://github.com/composer/package-versions-deprecated.git",
                "reference": "b4f54f74ef3453349c24a845d22392cd31e65f1d"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/composer/package-versions-deprecated/zipball/b4f54f74ef3453349c24a845d22392cd31e65f1d",
                "reference": "b4f54f74ef3453349c24a845d22392cd31e65f1d",
                "shasum": ""
            },
            "require": {
                "composer-plugin-api": "^1.1.0 || ^2.0",
                "php": "^7 || ^8"
            },
            "replace": {
                "ocramius/package-versions": "1.11.99"
            },
            "require-dev": {
                "composer/composer": "^1.9.3 || ^2.0@dev",
                "ext-zip": "^1.13",
                "phpunit/phpunit": "^6.5 || ^7"
            },
            "default-branch": true,
            "type": "composer-plugin",
            "extra": {
                "class": "PackageVersions\\Installer",
                "branch-alias": {
                    "dev-master": "1.x-dev"
                }
            },
            "autoload": {
                "psr-4": {
                    "PackageVersions\\": "src/PackageVersions"
                }
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "authors": [
                {
                    "name": "Marco Pivetta",
                    "email": "ocramius@gmail.com"
                },
                {
                    "name": "Jordi Boggiano",
                    "email": "j.boggiano@seld.be"
                }
            ],
            "description": "Composer plugin that provides efficient querying for installed package versions (no runtime IO)",
            "support": {
                "issues": "https://github.com/composer/package-versions-deprecated/issues",
                "source": "https://github.com/composer/package-versions-deprecated/tree/1.11.99.5"
            },
            "funding": [
                {
                    "url": "https://packagist.com",
                    "type": "custom"
                },
                {
                    "url": "https://github.com/composer",
                    "type": "github"
                },
                {
                    "url": "https://tidelift.com/funding/github/packagist/composer/composer",
                    "type": "tidelift"
                }
            ],
            "time": "2022-01-17T14:14:24+00:00"
        },
        {
            "name": "jean85/pretty-package-versions",
            "version": "dev-master",
            "source": {
                "type": "git",
                "url": "https://github.com/Jean85/pretty-package-versions.git",
                "reference": "a917488320c20057da87f67d0d40543dd9427f7a"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/Jean85/pretty-package-versions/zipball/a917488320c20057da87f67d0d40543dd9427f7a",
                "reference": "a917488320c20057da87f67d0d40543dd9427f7a",
                "shasum": ""
            },
            "require": {
                "composer/package-versions-deprecated": "^1.8.0",
                "php": "^7.0|^8.0"
            },
            "require-dev": {
                "phpunit/phpunit": "^6.0|^8.5|^9.2"
            },
            "default-branch": true,
            "type": "library",
            "extra": {
                "branch-alias": {
                    "dev-master": "1.x-dev"
                }
            },
            "autoload": {
                "psr-4": {
                    "Jean85\\": "src/"
                }
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "authors": [
                {
                    "name": "Alessandro Lai",
                    "email": "alessandro.lai85@gmail.com"
                }
            ],
            "description": "A wrapper for ocramius/package-versions to get pretty versions strings",
            "keywords": [
                "composer",
                "package",
                "release",
                "versions"
            ],
            "support": {
                "issues": "https://github.com/Jean85/pretty-package-versions/issues",
                "source": "https://github.com/Jean85/pretty-package-versions/tree/1.5.1"
            },
            "time": "2020-09-14T08:43:34+00:00"
        },
        {
            "name": "nette/finder",
            "version": "v2.6.x-dev",
            "source": {
                "type": "git",
                "url": "https://github.com/nette/finder.git",
                "reference": "2071d25db90e7e2a483b18e463466d13dc78f2a1"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/nette/finder/zipball/2071d25db90e7e2a483b18e463466d13dc78f2a1",
                "reference": "2071d25db90e7e2a483b18e463466d13dc78f2a1",
                "shasum": ""
            },
            "require": {
                "nette/utils": "^2.4 || ^3.0",
                "php": ">=7.1"
            },
            "conflict": {
                "nette/nette": "<2.2"
            },
            "require-dev": {
                "nette/tester": "^2.0",
                "phpstan/phpstan": "^0.12",
                "tracy/tracy": "^2.3"
            },
            "type": "library",
            "extra": {
                "branch-alias": {
                    "dev-master": "2.6-dev"
                }
            },
            "autoload": {
                "classmap": [
                    "src/"
                ]
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "BSD-3-Clause",
                "GPL-2.0-only",
                "GPL-3.0-only"
            ],
            "authors": [
                {
                    "name": "David Grudl",
                    "homepage": "https://davidgrudl.com"
                },
                {
                    "name": "Nette Community",
                    "homepage": "https://nette.org/contributors"
                }
            ],
            "description": "🔍 Nette Finder: find files and directories with an intuitive API.",
            "homepage": "https://nette.org",
            "keywords": [
                "filesystem",
                "glob",
                "iterator",
                "nette"
            ],
            "support": {
                "issues": "https://github.com/nette/finder/issues",
                "source": "https://github.com/nette/finder/tree/v2.6"
            },
            "time": "2022-01-06T04:58:28+00:00"
        },
        {
            "name": "nette/utils",
            "version": "v3.2.x-dev",
            "source": {
                "type": "git",
                "url": "https://github.com/nette/utils.git",
                "reference": "32091bbafd8a543d255855bf44fc795742adaf49"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/nette/utils/zipball/32091bbafd8a543d255855bf44fc795742adaf49",
                "reference": "32091bbafd8a543d255855bf44fc795742adaf49",
                "shasum": ""
            },
            "require": {
                "php": ">=7.2 <8.2"
            },
            "conflict": {
                "nette/di": "<3.0.6"
            },
            "require-dev": {
                "nette/tester": "~2.0",
                "phpstan/phpstan": "^1.0",
                "tracy/tracy": "^2.3"
            },
            "suggest": {
                "ext-gd": "to use Image",
                "ext-iconv": "to use Strings::webalize(), toAscii(), chr() and reverse()",
                "ext-intl": "to use Strings::webalize(), toAscii(), normalize() and compare()",
                "ext-json": "to use Nette\\Utils\\Json",
                "ext-mbstring": "to use Strings::lower() etc...",
                "ext-tokenizer": "to use Nette\\Utils\\Reflection::getUseStatements()",
                "ext-xml": "to use Strings::length() etc. when mbstring is not available"
            },
            "type": "library",
            "extra": {
                "branch-alias": {
                    "dev-master": "3.2-dev"
                }
            },
            "autoload": {
                "classmap": [
                    "src/"
                ]
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "BSD-3-Clause",
                "GPL-2.0-only",
                "GPL-3.0-only"
            ],
            "authors": [
                {
                    "name": "David Grudl",
                    "homepage": "https://davidgrudl.com"
                },
                {
                    "name": "Nette Community",
                    "homepage": "https://nette.org/contributors"
                }
            ],
            "description": "🛠  Nette Utils: lightweight utilities for string & array manipulation, image handling, safe JSON encoding/decoding, validation, slug or strong password generating etc.",
            "homepage": "https://nette.org",
            "keywords": [
                "array",
                "core",
                "datetime",
                "images",
                "json",
                "nette",
                "paginator",
                "password",
                "slugify",
                "string",
                "unicode",
                "utf-8",
                "utility",
                "validation"
            ],
            "support": {
                "issues": "https://github.com/nette/utils/issues",
                "source": "https://github.com/nette/utils/tree/v3.2"
            },
            "time": "2022-01-28T15:10:59+00:00"
        },
        {
            "name": "phar-io/version",
            "version": "3.2.1",
            "source": {
                "type": "git",
                "url": "https://github.com/phar-io/version.git",
                "reference": "4f7fd7836c6f332bb2933569e566a0d6c4cbed74"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/phar-io/version/zipball/4f7fd7836c6f332bb2933569e566a0d6c4cbed74",
                "reference": "4f7fd7836c6f332bb2933569e566a0d6c4cbed74",
                "shasum": ""
            },
            "require": {
                "php": "^7.2 || ^8.0"
            },
            "type": "library",
            "autoload": {
                "classmap": [
                    "src/"
                ]
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "BSD-3-Clause"
            ],
            "authors": [
                {
                    "name": "Arne Blankerts",
                    "email": "arne@blankerts.de",
                    "role": "Developer"
                },
                {
                    "name": "Sebastian Heuer",
                    "email": "sebastian@phpeople.de",
                    "role": "Developer"
                },
                {
                    "name": "Sebastian Bergmann",
                    "email": "sebastian@phpunit.de",
                    "role": "Developer"
                }
            ],
            "description": "Library for handling version information and constraints",
            "support": {
                "issues": "https://github.com/phar-io/version/issues",
                "source": "https://github.com/phar-io/version/tree/3.2.1"
            },
            "time": "2022-02-21T01:04:05+00:00"
        },
            "name": "symfony/config",
                "url": "https://github.com/symfony/config.git",
                "reference": "d65e1bd990c740e31feb07d2b0927b8d4df9956f"
                "url": "https://api.github.com/repos/symfony/config/zipball/d65e1bd990c740e31feb07d2b0927b8d4df9956f",
                "reference": "d65e1bd990c740e31feb07d2b0927b8d4df9956f",
                "symfony/filesystem": "^4.4|^5.0|^6.0",
                "symfony/polyfill-ctype": "~1.8",
                "symfony/polyfill-php81": "^1.22"
                "symfony/finder": "<4.4"
                "symfony/event-dispatcher": "^4.4|^5.0|^6.0",
                "symfony/finder": "^4.4|^5.0|^6.0",
                "symfony/messenger": "^4.4|^5.0|^6.0",
                "symfony/service-contracts": "^1.1|^2|^3",
                "symfony/yaml": "^4.4|^5.0|^6.0"
            },
            "suggest": {
                "symfony/yaml": "To use the yaml reference dumper"
            },
            "default-branch": true,
            "type": "library",
            "autoload": {
                "psr-4": {
                    "Symfony\\Component\\Config\\": ""
                },
                "exclude-from-classmap": [
                    "/Tests/"
                ]
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "authors": [
                {
                    "name": "Fabien Potencier",
                    "email": "fabien@symfony.com"
                },
                {
                    "name": "Symfony Community",
                    "homepage": "https://symfony.com/contributors"
                }
            ],
            "description": "Helps you find, load, combine, autofill and validate configuration values of any kind",
            "homepage": "https://symfony.com",
            "support": {
                "source": "https://github.com/symfony/config/tree/v5.4.3"
            },
            "funding": [
                {
                    "url": "https://symfony.com/sponsor",
                    "type": "custom"
                },
                {
                    "url": "https://github.com/fabpot",
                    "type": "github"
                },
                {
                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
                    "type": "tidelift"
                }
            ],
            "time": "2022-01-03T09:50:52+00:00"
        },
        {
            "name": "symfony/console",
            "version": "5.4.x-dev",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/console.git",
                "reference": "d8111acc99876953f52fe16d4c50eb60940d49ad"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/symfony/console/zipball/d8111acc99876953f52fe16d4c50eb60940d49ad",
                "reference": "d8111acc99876953f52fe16d4c50eb60940d49ad",
                "shasum": ""
            },
            "require": {
                "php": ">=7.2.5",
                "symfony/deprecation-contracts": "^2.1|^3",
                "symfony/polyfill-mbstring": "~1.0",
                "symfony/polyfill-php73": "^1.9",
                "symfony/polyfill-php80": "^1.16",
                "symfony/service-contracts": "^1.1|^2|^3",
                "symfony/string": "^5.1|^6.0"
            },
            "conflict": {
                "psr/log": ">=3",
                "symfony/dependency-injection": "<4.4",
                "symfony/dotenv": "<5.1",
                "symfony/event-dispatcher": "<4.4",
                "symfony/lock": "<4.4",
                "symfony/process": "<4.4"
            },
            "provide": {
                "psr/log-implementation": "1.0|2.0"
            },
            "require-dev": {
                "psr/log": "^1|^2",
                "symfony/config": "^4.4|^5.0|^6.0",
                "symfony/dependency-injection": "^4.4|^5.0|^6.0",
        {
            "name": "symfony/dependency-injection",
            "version": "5.4.x-dev",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/dependency-injection.git",
                "reference": "35588b2afb08ea3a142d62fefdcad4cb09be06ed"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/symfony/dependency-injection/zipball/35588b2afb08ea3a142d62fefdcad4cb09be06ed",
                "reference": "35588b2afb08ea3a142d62fefdcad4cb09be06ed",
                "shasum": ""
            },
            "require": {
                "php": ">=7.2.5",
                "psr/container": "^1.1.1",
                "symfony/deprecation-contracts": "^2.1|^3",
                "symfony/polyfill-php80": "^1.16",
                "symfony/polyfill-php81": "^1.22",
                "symfony/service-contracts": "^1.1.6|^2"
            },
            "conflict": {
                "ext-psr": "<1.1|>=2",
                "symfony/config": "<5.3",
                "symfony/finder": "<4.4",
                "symfony/proxy-manager-bridge": "<4.4",
                "symfony/yaml": "<4.4.26"
            },
            "provide": {
                "psr/container-implementation": "1.0",
                "symfony/service-implementation": "1.0|2.0"
            },
            "require-dev": {
                "symfony/config": "^5.3|^6.0",
                "symfony/expression-language": "^4.4|^5.0|^6.0",
                "symfony/yaml": "^4.4.26|^5.0|^6.0"
            },
            "suggest": {
                "symfony/config": "",
                "symfony/expression-language": "For using expressions in service container configuration",
                "symfony/finder": "For using double-star glob patterns or when GLOB_BRACE portability is required",
                "symfony/proxy-manager-bridge": "Generate service proxies to lazy load them",
                "symfony/yaml": ""
            },
            "default-branch": true,
            "type": "library",
            "autoload": {
                "psr-4": {
                    "Symfony\\Component\\DependencyInjection\\": ""
                },
                "exclude-from-classmap": [
                    "/Tests/"
                ]
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "authors": [
                {
                    "name": "Fabien Potencier",
                    "email": "fabien@symfony.com"
                },
                {
                    "name": "Symfony Community",
                    "homepage": "https://symfony.com/contributors"
                }
            ],
            "description": "Allows you to standardize and centralize the way objects are constructed in your application",
            "homepage": "https://symfony.com",
            "support": {
                "source": "https://github.com/symfony/dependency-injection/tree/5.4"
            },
            "funding": [
                {
                    "url": "https://symfony.com/sponsor",
                    "type": "custom"
                },
                {
                    "url": "https://github.com/fabpot",
                    "type": "github"
                },
                {
                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
                    "type": "tidelift"
                }
            ],
            "time": "2022-03-08T15:43:06+00:00"
        },
        {
            "name": "symplify/autowire-array-parameter",
            "version": "8.3.48",
            "source": {
                "type": "git",
                "url": "https://github.com/symplify/autowire-array-parameter.git",
                "reference": "721e29f2e656cc3cf1101fcc0dbb4f4a44d9309b"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/symplify/autowire-array-parameter/zipball/721e29f2e656cc3cf1101fcc0dbb4f4a44d9309b",
                "reference": "721e29f2e656cc3cf1101fcc0dbb4f4a44d9309b",
                "shasum": ""
            },
            "require": {
                "nette/utils": "^3.0",
                "php": ">=7.2",
                "symfony/dependency-injection": "^4.4|^5.1",
                "symplify/package-builder": "^8.3.48"
            },
            "require-dev": {
                "phpunit/phpunit": "^8.5|^9.0"
            },
            "type": "library",
            "extra": {
                "branch-alias": {
                    "dev-master": "8.4-dev"
                }
            },
            "autoload": {
                "psr-4": {
                    "Symplify\\AutowireArrayParameter\\": "src"
                }
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "description": "Autowire array parameters for your Symfony applications",
            "support": {
                "source": "https://github.com/symplify/autowire-array-parameter/tree/8.3.48"
            },
            "funding": [
                {
                    "url": "https://www.paypal.me/rectorphp",
                    "type": "custom"
                },
                {
                    "url": "https://github.com/tomasvotruba",
                    "type": "github"
                }
            ],
            "time": "2020-10-26T10:38:48+00:00"
        },
        {
            "name": "symplify/composer-json-manipulator",
            "version": "8.3.48",
            "source": {
                "type": "git",
                "url": "https://github.com/symplify/composer-json-manipulator.git",
                "reference": "44346fecb95fd0f435ab43d6603995d1e0796353"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/symplify/composer-json-manipulator/zipball/44346fecb95fd0f435ab43d6603995d1e0796353",
                "reference": "44346fecb95fd0f435ab43d6603995d1e0796353",
                "shasum": ""
            },
            "require": {
                "nette/utils": "^3.0",
                "php": ">=7.2",
                "symfony/config": "^4.4|^5.1",
                "symfony/dependency-injection": "^4.4|^5.1",
                "symfony/filesystem": "^4.4|^5.1",
                "symfony/http-kernel": "^4.4|^5.1",
                "symplify/package-builder": "^8.3.48",
                "symplify/smart-file-system": "^8.3.48"
            },
            "require-dev": {
                "phpunit/phpunit": "^8.5|^9.0"
            },
            "type": "symfony-bundle",
            "extra": {
                "branch-alias": {
                    "dev-master": "8.4-dev"
                }
            },
            "autoload": {
                "psr-4": {
                    "Symplify\\ComposerJsonManipulator\\": "src"
                }
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "description": "Package to load, merge and save composer.json file(s)",
            "support": {
                "source": "https://github.com/symplify/composer-json-manipulator/tree/8.3.48"
            },
            "funding": [
                {
                    "url": "https://www.paypal.me/rectorphp",
                    "type": "custom"
                },
                {
                    "url": "https://github.com/tomasvotruba",
                    "type": "github"
                }
            ],
            "time": "2020-10-26T10:38:48+00:00"
        },
        {
            "name": "symplify/monorepo-builder",
            "version": "8.3.48",
            "source": {
                "type": "git",
                "url": "https://github.com/symplify/monorepo-builder.git",
                "reference": "e945d0f541c5202eed626c576522ebab6b10a3d3"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/symplify/monorepo-builder/zipball/e945d0f541c5202eed626c576522ebab6b10a3d3",
                "reference": "e945d0f541c5202eed626c576522ebab6b10a3d3",
                "shasum": ""
            },
            "require": {
                "jean85/pretty-package-versions": "^1.2",
                "nette/utils": "^3.0",
                "phar-io/version": "^2.0.1|^3.0",
                "php": ">=7.2",
                "symfony/console": "^4.4|^5.1",
                "symfony/dependency-injection": "^4.4|^5.1",
                "symfony/finder": "^4.4|^5.1",
                "symfony/process": "^4.4|^5.1",
                "symplify/autowire-array-parameter": "^8.3.48",
                "symplify/composer-json-manipulator": "^8.3.48",
                "symplify/package-builder": "^8.3.48",
                "symplify/set-config-resolver": "^8.3.48",
                "symplify/smart-file-system": "^8.3.48",
                "symplify/symplify-kernel": "^8.3.48"
            },
            "require-dev": {
                "phpunit/phpunit": "^8.5|^9.0"
            },
            "bin": [
                "bin/monorepo-builder"
            ],
            "type": "library",
            "extra": {
                "branch-alias": {
                    "dev-master": "8.4-dev"
                }
            },
            "autoload": {
                "psr-4": {
                    "Symplify\\MonorepoBuilder\\": "src",
                    "Symplify\\MonorepoBuilder\\Init\\": "packages/init/src",
                    "Symplify\\MonorepoBuilder\\Merge\\": "packages/merge/src",
                    "Symplify\\MonorepoBuilder\\Split\\": "packages/split/src",
                    "Symplify\\MonorepoBuilder\\Release\\": "packages/release/src",
                    "Symplify\\MonorepoBuilder\\Testing\\": "packages/testing/src"
                }
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "description": "Not only Composer tools to build a Monorepo.",
            "support": {
                "source": "https://github.com/symplify/monorepo-builder/tree/8.3.48"
            },
            "funding": [
                {
                    "url": "https://www.paypal.me/rectorphp",
                    "type": "custom"
                },
                {
                    "url": "https://github.com/tomasvotruba",
                    "type": "github"
                }
            ],
            "time": "2020-10-26T10:38:48+00:00"
        },
        {
            "name": "symplify/package-builder",
            "version": "8.3.48",
            "source": {
                "type": "git",
                "url": "https://github.com/symplify/package-builder.git",
                "reference": "d262d5c2043c669f145d3eabf7d8114ae64cf169"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/symplify/package-builder/zipball/d262d5c2043c669f145d3eabf7d8114ae64cf169",
                "reference": "d262d5c2043c669f145d3eabf7d8114ae64cf169",
                "shasum": ""
            },
            "require": {
                "nette/finder": "^2.5",
                "nette/utils": "^3.0",
                "php": ">=7.2",
                "symfony/config": "^4.4|^5.1",
                "symfony/console": "^4.4|^5.1",
                "symfony/dependency-injection": "^4.4|^5.1",
                "symfony/finder": "^4.4|^5.1",
                "symfony/http-kernel": "^4.4|^5.1",
                "symfony/yaml": "^4.4|^5.1",
                "symplify/autowire-array-parameter": "^8.3.48",
                "symplify/symplify-kernel": "^8.3.48"
            },
            "require-dev": {
                "phpunit/phpunit": "^8.5|^9.0"
            },
            "type": "library",
            "extra": {
                "branch-alias": {
                    "dev-master": "8.4-dev"
                }
            },
            "autoload": {
                "psr-4": {
                    "Symplify\\PackageBuilder\\": "src"
                }
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "description": "Dependency Injection, Console and Kernel toolkit for Symplify packages.",
            "support": {
                "source": "https://github.com/symplify/package-builder/tree/8.3.48"
            },
            "funding": [
                {
                    "url": "https://www.paypal.me/rectorphp",
                    "type": "custom"
                },
                {
                    "url": "https://github.com/tomasvotruba",
                    "type": "github"
                }
            ],
            "time": "2020-10-26T10:38:48+00:00"
        },
        {
            "name": "symplify/set-config-resolver",
            "version": "8.3.48",
            "source": {
                "type": "git",
                "url": "https://github.com/symplify/set-config-resolver.git",
                "reference": "1333995e30b7acfa7c4378c5f85de1dd96226c93"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/symplify/set-config-resolver/zipball/1333995e30b7acfa7c4378c5f85de1dd96226c93",
                "reference": "1333995e30b7acfa7c4378c5f85de1dd96226c93",
                "shasum": ""
            },
            "require": {
                "nette/utils": "^3.0",
                "php": ">=7.2",
                "symfony/config": "^4.4|^5.1",
                "symfony/console": "^4.4|^5.1",
                "symfony/dependency-injection": "^4.4|^5.1",
                "symfony/filesystem": "^4.4|^5.1",
                "symfony/finder": "^4.4|^5.1",
                "symfony/yaml": "^4.4|^5.1",
                "symplify/smart-file-system": "^8.3.48",
                "symplify/symplify-kernel": "^8.3.48"
            },
            "require-dev": {
                "phpunit/phpunit": "^8.5|^9.0"
            },
            "type": "library",
            "extra": {
                "branch-alias": {
                    "dev-master": "8.4-dev"
                }
            },
            "autoload": {
                "psr-4": {
                    "Symplify\\SetConfigResolver\\": "src"
                }
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "description": "Resolve config and sets from configs and cli opptions for CLI applications",
            "support": {
                "issues": "https://github.com/symplify/set-config-resolver/issues",
                "source": "https://github.com/symplify/set-config-resolver/tree/8.3.48"
            },
            "funding": [
                {
                    "url": "https://www.paypal.me/rectorphp",
                    "type": "custom"
                },
                {
                    "url": "https://github.com/tomasvotruba",
                    "type": "github"
                }
            ],
            "abandoned": true,
            "time": "2020-10-26T10:38:48+00:00"
        },
        {
            "name": "symplify/smart-file-system",
            "version": "8.3.48",
            "source": {
                "type": "git",
                "url": "https://github.com/symplify/smart-file-system.git",
                "reference": "4146069c725b7c6e2f53924a151286f1e26c132f"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/symplify/smart-file-system/zipball/4146069c725b7c6e2f53924a151286f1e26c132f",
                "reference": "4146069c725b7c6e2f53924a151286f1e26c132f",
                "shasum": ""
            },
            "require": {
                "nette/utils": "^3.0",
                "php": ">=7.2",
                "symfony/filesystem": "^4.4|^5.1",
                "symfony/finder": "^4.4|^5.1"
            },
            "require-dev": {
                "nette/finder": "^2.5",
                "phpunit/phpunit": "^8.5|^9.0"
            },
            "type": "library",
            "extra": {
                "branch-alias": {
                    "dev-master": "8.4-dev"
                }
            },
            "autoload": {
                "psr-4": {
                    "Symplify\\SmartFileSystem\\": "src"
                }
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "description": "Sanitized FileInfo with safe getRealPath() and other handy methods",
            "support": {
                "source": "https://github.com/symplify/smart-file-system/tree/8.3.48"
            },
            "funding": [
                {
                    "url": "https://www.paypal.me/rectorphp",
                    "type": "custom"
                },
                {
                    "url": "https://github.com/tomasvotruba",
                    "type": "github"
                }
            ],
            "time": "2020-10-26T10:38:48+00:00"
        },
        {
            "name": "symplify/symplify-kernel",
            "version": "8.3.48",
            "source": {
                "type": "git",
                "url": "https://github.com/symplify/symplify-kernel.git",
                "reference": "c79dc6ce559b408c08e9fbc044f59cbb64961cf9"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/symplify/symplify-kernel/zipball/c79dc6ce559b408c08e9fbc044f59cbb64961cf9",
                "reference": "c79dc6ce559b408c08e9fbc044f59cbb64961cf9",
                "shasum": ""
            },
            "require": {
                "php": ">=7.2",
                "symfony/console": "^4.4|^5.1",
                "symfony/dependency-injection": "^4.4|^5.1",
                "symfony/http-kernel": "^4.4|^5.1",
                "symplify/package-builder": "^8.3.48",
                "symplify/smart-file-system": "^8.3.48"
            },
            "require-dev": {
                "phpunit/phpunit": "^8.5|^9.0"
            },
            "type": "library",
            "extra": {
                "branch-alias": {
                    "dev-master": "8.4-dev"
                }
            },
            "autoload": {
                "psr-4": {
                    "Symplify\\SymplifyKernel\\": "src"
                }
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "description": "Internal Kernel for Symplify packages",
            "support": {
                "issues": "https://github.com/symplify/symplify-kernel/issues",
                "source": "https://github.com/symplify/symplify-kernel/tree/8.3.48"
            },
            "time": "2020-10-26T10:38:48+00:00"
        },


            $unzip = new Unzip();
            $unzip->extract($this->file, $backupLocation, true);
			ImportLogger::setLogInfo('Media restored!');



Fixed code:
    "content-hash": "8361e998f6732306b5c86f3f1b12f36b",
            "name": "symfony/console",
                "url": "https://github.com/symfony/console.git",
                "reference": "d8111acc99876953f52fe16d4c50eb60940d49ad"
                "url": "https://api.github.com/repos/symfony/console/zipball/d8111acc99876953f52fe16d4c50eb60940d49ad",
                "reference": "d8111acc99876953f52fe16d4c50eb60940d49ad",
                "symfony/polyfill-mbstring": "~1.0",
                "symfony/polyfill-php73": "^1.9",
                "symfony/service-contracts": "^1.1|^2|^3",
                "symfony/string": "^5.1|^6.0"
                "psr/log": ">=3",
                "symfony/dependency-injection": "<4.4",
                "symfony/dotenv": "<5.1",
                "symfony/event-dispatcher": "<4.4",
                "symfony/lock": "<4.4",
                "symfony/process": "<4.4"
            },
            "provide": {
                "psr/log-implementation": "1.0|2.0"
                "psr/log": "^1|^2",
                "symfony/config": "^4.4|^5.0|^6.0",
                "symfony/dependency-injection": "^4.4|^5.0|^6.0",
        {
            "name": "phar-io/version",
            "version": "3.2.1",
            "source": {
                "type": "git",
                "url": "https://github.com/phar-io/version.git",
                "reference": "4f7fd7836c6f332bb2933569e566a0d6c4cbed74"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/phar-io/version/zipball/4f7fd7836c6f332bb2933569e566a0d6c4cbed74",
                "reference": "4f7fd7836c6f332bb2933569e566a0d6c4cbed74",
                "shasum": ""
            },
            "require": {
                "php": "^7.2 || ^8.0"
            },
            "type": "library",
            "autoload": {
                "classmap": [
                    "src/"
                ]
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "BSD-3-Clause"
            ],
            "authors": [
                {
                    "name": "Arne Blankerts",
                    "email": "arne@blankerts.de",
                    "role": "Developer"
                },
                {
                    "name": "Sebastian Heuer",
                    "email": "sebastian@phpeople.de",
                    "role": "Developer"
                },
                {
                    "name": "Sebastian Bergmann",
                    "email": "sebastian@phpunit.de",
                    "role": "Developer"
                }
            ],
            "description": "Library for handling version information and constraints",
            "support": {
                "issues": "https://github.com/phar-io/version/issues",
                "source": "https://github.com/phar-io/version/tree/3.2.1"
            },
            "time": "2022-02-21T01:04:05+00:00"
        },
    public static function getLog()
    {
        return file_get_contents(static::getLogFilepath());
    }


           // $unzip = new Unzip();
          //  $unzip->extract($this->file, $backupLocation, true);

            $allowPhpFilesUpload = config('microweber.allow_php_files_upload');

            $zipArchive = new \ZipArchive();
            $zipArchive->open($this->file);
            $selectedFilesForUnzip = [];
            for ($i = 0; $i < $zipArchive->numFiles; $i++) {
                $stat = $zipArchive->statIndex($i);
                $zipFileBasename = basename($stat['name']);

                if ($allowPhpFilesUpload) {
                    $selectedFilesForUnzip[] = $zipFileBasename;
                    ImportLogger::setLogInfo('Unzipping queue '.$zipFileBasename.'...');
                } else {
                    $filesUtils = new \MicroweberPackages\Utils\System\Files();
                    $isDangerous = $filesUtils->is_dangerous_file($zipFileBasename);
                    if (!$isDangerous) {
                        $selectedFilesForUnzip[] = $zipFileBasename;
                        ImportLogger::setLogInfo('Unzipping queue '.$zipFileBasename.'...');
                    }
                }
            }

            if (empty($selectedFilesForUnzip)) {
                ImportLogger::setLogInfo('The zip file has no files.');
                return;
            }

            $zipArchive->extractTo($backupLocation, $selectedFilesForUnzip);
            $zipArchive->close();

            if (is_dir($backupLocation . DS. 'userfiles' . DS.'media')) {
                ImportLogger::setLogInfo('Media restored!');
            }

<?php
namespace MicroweberPackages\Import\tests;

use Illuminate\Support\Facades\Config;
use MicroweberPackages\Core\tests\TestCase;
use MicroweberPackages\Import\Formats\ZipReader;
use MicroweberPackages\Import\Loggers\ImportLogger;


/**
 * Run test
 * @author Bobi Microweber
 * @command php phpunit.phar --filter Import
 */

class ReadersTest extends TestCase
{
	public function testZipReader() {

        ImportLogger::clearLog();
        $zip = new ZipReader(__DIR__ . DS. 'strange-file.zip');
        $zip->readData();
        $zip->clearCache();
        $log = ImportLogger::getLog();

        $this->assertTrue((strpos($log, 'The zip file has no files.')!==false));


        ImportLogger::clearLog();
        Config::set('microweber.allow_php_files_upload', true);

        $zip = new ZipReader(__DIR__ . DS. 'strange-file.zip');
        $zip->readData();
        $zip->clearCache();

        $log = ImportLogger::getLog();

        $this->assertTrue((strpos($log, 'queue strange-file.php')!==false));
        $this->assertTrue((strpos($log, 'no files to import')!==false));

    }
}
            <?php if (config('microweber.allow_php_files_upload')): ?>
            <?php endif; ?>