Repository navigation

Security: Neutralize formulas in CSV exports - refs GHSA-8279-8m4m-g6g4 - #9266

Merged

christianbeeznest merged 1 commit into

chamilo:2.0from

christianbeeznest:security/GHSA-8279-8m4m-g6g4-2.0

Oct 18, 2026

Merged

Security: Neutralize formulas in CSV exports - refs GHSA-8279-8m4m-g6g4#9266
christianbeeznest merged 1 commit into
chamilo:2.0from
christianbeeznest:security/GHSA-8279-8m4m-g6g4-2.0

christianbeeznest commented Oct 18, 2026

Contributor

Fixes GHSA-8279-8m4m-g6g4 for the 2.0 branch.

Prevent CSV formula injection in shared export helpers.
Protect user, survey, reporting, and direct CSV exports.
Neutralize dangerous formula prefixes without modifying stored data.
Add regression tests for formula injection.

Validation:

PHP syntax checks passed for all 8 files.
PHPUnit: 4 tests passed, 23 assertions.
Git diff checks passed.
Browser-based testing remains pending on a compatible 2.0 installation.

Refs GHSA-8279-8m4m-g6g4


          Security: Neutralize formulas in CSV exports

christianbeeznest merged commit 79b87d8 into chamilo:2.0

1 of 7 checks passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet