Updated dependencies and prevent CVE-2023-43655

Author: aschempp

api/console

@@ -8,6 +8,11 @@
  * @license LGPL-3.0+
  */
 
+if (0 === strpos(__FILE__, 'phar:') && ini_get('register_argc_argv')) {
+    echo 'Contao Manager cannot be run safely on non-CLI SAPIs with register_argc_argv=On. Aborting.'.PHP_EOL;
+    exit(1);
+}
+
 setlocale(LC_ALL, 'C');
 require __DIR__.'/../vendor/autoload.php';
 
@@ -29,38 +34,50 @@ if (function_exists('ini_set')) {
     @ini_set('display_errors', 1);
     @ini_set('zlib.output_compression', 0);
 
-    $memoryInBytes = static function ($value) {
-        $unit = strtolower(substr($value, -1, 1));
-        $value = (int) $value;
-        switch($unit) {
-            /** @noinspection PhpMissingBreakStatementInspection */
-            case 'g':
-                $value *= 1024;
-                // no break (cumulative multiplier)
-            /** @noinspection PhpMissingBreakStatementInspection */
-            case 'm':
-                $value *= 1024;
-                // no break (cumulative multiplier)
-            case 'k':
-                $value *= 1024;
-        }
-
-        return $value;
-    };
-
-    $memoryLimit = trim(ini_get('memory_limit'));
-    // Increase memory_limit if it is lower than 1.5GB
-    if ($memoryLimit != -1 && $memoryInBytes($memoryLimit) < 1024 * 1024 * 1536) {
-        @ini_set('memory_limit', '1536M');
-    }
     // Set user defined memory limit
     if ($memoryLimit = getenv('COMPOSER_MEMORY_LIMIT')) {
         @ini_set('memory_limit', $memoryLimit);
+    } else {
+        $memoryInBytes = static function ($value) {
+            $unit = strtolower(substr($value, -1, 1));
+            $value = (int) $value;
+            switch($unit) {
+                /** @noinspection PhpMissingBreakStatementInspection */
+                case 'g':
+                    $value *= 1024;
+                    // no break (cumulative multiplier)
+                /** @noinspection PhpMissingBreakStatementInspection */
+                case 'm':
+                    $value *= 1024;
+                    // no break (cumulative multiplier)
+                case 'k':
+                    $value *= 1024;
+            }
+
+            return $value;
+        };
+
+        $memoryLimit = trim(ini_get('memory_limit'));
+        // Increase memory_limit if it is lower than 1.5GB
+        if ($memoryLimit != -1 && $memoryInBytes($memoryLimit) < 1024 * 1024 * 1536) {
+            @ini_set('memory_limit', '1536M');
+        }
+        unset($memoryInBytes);
+    }
+    unset($memoryLimit);
+}
+
+// Workaround PHP bug on Windows where env vars containing Unicode chars are mangled in $_SERVER
+// see https://github.com/php/php-src/issues/7896
+if (PHP_VERSION_ID >= 70113 && (PHP_VERSION_ID < 80016 || (PHP_VERSION_ID >= 80100 && PHP_VERSION_ID < 80103)) && Platform::isWindows()) {
+    foreach ($_SERVER as $serverVar => $serverVal) {
+        if (($serverVal = getenv($serverVar)) !== false) {
+            $_SERVER[$serverVar] = $serverVal;
+        }
     }
-    unset($memoryInBytes, $memoryLimit);
 }
 
-putenv('COMPOSER_BINARY='.realpath($_SERVER['argv'][0]));
+Platform::putEnv('COMPOSER_BINARY', realpath($_SERVER['argv'][0]));
 
 // Always create kernel to initialize the application
 $kernel = new ApiKernel('@symfony_env@' === 'prod' ? 'prod' : 'dev');