Skip to content

Security: Neutralize formulas in CSV exports - refs GHSA-8279-8m4m-g6g4 - #9265

Merged
christianbeeznest merged 1 commit into
chamilo:3.0from
christianbeeznest:security/GHSA-8279-8m4m-g6g4-3.0
Oct 18, 2026
Merged

christianbeeznest merged 1 commit into
chamilo:3.0from
christianbeeznest:security/GHSA-8279-8m4m-g6g4-3.0

Conversation

@christianbeeznest

Copy link
Copy Markdown
Contributor

Fixes GHSA-8279-8m4m-g6g4 for the 3.0 branch.

  • Prevent CSV formula injection in shared and direct CSV exports.
  • Protect user, survey, exercise, gradebook, and reporting exports.
  • Neutralize dangerous formula prefixes without changing stored data.
  • Add regression tests for formula injection.

Validation: PHP lint passed for all 23 files, PHPUnit passed (4 tests, 23 assertions), and ECS checks passed.

Browser-based testing remains pending on a compatible 3.0 installation.

Refs GHSA-8279-8m4m-g6g4

@christianbeeznest
christianbeeznest merged commit 781ce7a into chamilo:3.0 Oct 18, 2026
1 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant