From d4f163386219b3e682032f7d478f64605a0b9dd4 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Tim=20D=C3=BCsterhus?= Date: Mon, 27 Jun 2022 16:56:56 +0200 Subject: [PATCH] Strengthen check for non-instantiable classes in ControllerMap::getClassData() --- .../files/lib/system/request/ControllerMap.class.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/wcfsetup/install/files/lib/system/request/ControllerMap.class.php b/wcfsetup/install/files/lib/system/request/ControllerMap.class.php index ac0b7aa771..de01cb4297 100644 --- a/wcfsetup/install/files/lib/system/request/ControllerMap.class.php +++ b/wcfsetup/install/files/lib/system/request/ControllerMap.class.php @@ -444,9 +444,11 @@ class ControllerMap extends SingletonFactory } } - // check for abstract classes + // Verify that the class can be instantiated. This excludes + // abstract classes, interfaces, classes with a private constructor + // and more. $reflectionClass = new \ReflectionClass($className); - if ($reflectionClass->isAbstract()) { + if (!$reflectionClass->isInstantiable()) { return null; } -- 2.20.1