From 875893212a9c0a89d018466d023bd2fbd339dbb0 Mon Sep 17 00:00:00 2001
From: dweeves <dweeves@gmail.com>
Date: Mon, 20 Oct 2014 21:01:42 +0200
Subject: [PATCH] removing upload functions for security reasons

---
 magmi/web/magmi_config_setup.php | 8 ++++----
 magmi/web/magmi_upload.php       | 4 ++--
 magmi/web/plugin_upload.php      | 4 ++--
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/magmi/web/magmi_config_setup.php b/magmi/web/magmi_config_setup.php
index f416d0e7..4aa425f6 100755
--- a/magmi/web/magmi_config_setup.php
+++ b/magmi/web/magmi_config_setup.php
@@ -32,7 +32,7 @@
     $conf_ok = 0;
 }
 ?>
-<!-- MAGMI UPLOADER -->
+<!-- MAGMI UPLOADER DISABLED FOR SECURITY REASONS -->
 <?php $zipok=class_exists("ZipArchive");?>
 <div class="container_12">
 	<div class="grid_12 subtitle">
@@ -40,7 +40,7 @@
 	</div>
 </div>
 <div class="container_12">
-<?php if($zipok){?>
+<?php if(false){?>
 <form method="post" enctype="multipart/form-data"
 		action="magmi_upload.php">
 		<div class="grid_12 col">
@@ -89,8 +89,8 @@
 <?php } else {?>
 <div class="grid_12 col">
 		<h3>Update Disabled</h3>
-		<div class="error">Zip library not available, Upgrade/Upload function
-			are not enabled</div>
+		<div class="error">Upgrade/Upload function
+			are disabled for security reasons</div>
 	</div>
 <?php }?>
 </div>
diff --git a/magmi/web/magmi_upload.php b/magmi/web/magmi_upload.php
index 3f369c85..703c02c4 100644
--- a/magmi/web/magmi_upload.php
+++ b/magmi/web/magmi_upload.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+/*session_start();
 
 function extractZipDir($zip, $bdir, $zdir)
 {
@@ -62,5 +62,5 @@ function extractZipDir($zip, $bdir, $zdir)
 {
     session_write_close();
     die($e->getMessage());
-}
+}*/
 header("Location: ./magmi.php");
\ No newline at end of file
diff --git a/magmi/web/plugin_upload.php b/magmi/web/plugin_upload.php
index 2167802c..99dc54d4 100644
--- a/magmi/web/plugin_upload.php
+++ b/magmi/web/plugin_upload.php
@@ -1,5 +1,5 @@
 <?php
-session_start();
+/*session_start();
 unset($_SESSION["plugin_install_error"]);
 require_once ("../inc/magmi_pluginhelper.php");
 $ph = Magmi_PluginHelper::getInstance();
@@ -12,5 +12,5 @@
 {
     $_SESSION["plugin_install"] = array("info","Plugin packaged installed");
 }
-session_write_close();
+session_write_close();*/
 header("Location: ./magmi.php");
\ No newline at end of file