I upgraded Joomla from 3.10.11 to 4.2. Since then I’m getting the error:
Uncaught TYPO3PharStreamWrapperException Unexpected file extension in “Phar://httpful.phar/……/Response.php”
I tried various forums facing quoting similar issue but could not find a solution.
Since phar deserialization vulnerability is fixed in php8+ , I want to** completely bypass typo 3’s phar stream wrapper and use php8.1’s built in stream handlers**.
How can I completely remove/bypass typo3-phar-stream-wrapper from Joomla4.2?
In PharExtensionInterceptor.php, I modified the function baseFileContainsPharExtension to return true even if file extension is php
private function baseFileContainsPharExtension(string $path): bool
{
$invocation = Manager::instance()->resolve($path);
if ($invocation === null) {
return false;
}
$fileExtension = pathinfo($invocation->getBaseName(), PATHINFO_EXTENSION);
return strtolower($fileExtension) === 'phar';
}
}
I modified it to:
private function baseFileContainsPharExtension(string $path): bool
{
$invocation = Manager::instance()->resolve($path);
if ($invocation === null) {
return false;
}
$fileExtension = pathinfo($invocation->getBaseName(), PATHINFO_EXTENSION);
return (strtolower($fileExtension) === 'phar'||strtolower($fileExtension) === 'php');
}
}
This did not help either….
Phar stream handlers are already loaded, I checked in phpinfo()