Atomic Edge analysis of CVE-2024-13362: The Freemius SDK versions up to 2.10.1 contain a reflected DOM-based cross-site scripting vulnerability via the `url` parameter. This affects any WordPress plugin or theme using the vulnerable SDK. The CVSS score is 6.1 (Medium), reflecting the requirement for user interaction.
The root cause is insufficient input sanitization and output escaping of the `url` parameter within the Freemius SDK’s trial promotion notice handling. The vulnerable code resides in `class-freemius.php`, specifically in the method near line 24000. The SDK constructs a trial promotion button using unsanitized user-supplied URL data, which is then injected into the DOM via `add_sticky`. The parameter `url` flows directly into the `href` attribute of an anchor tag without proper encoding or validation against XSS payloads.
Exploitation requires tricking an authenticated WordPress administrator into clicking a crafted link. An attacker can craft a URL containing the `url` parameter with a malicious JavaScript payload, such as `javascript:alert(document.cookie)`. When the admin clicks the crafted link, the SDK renders the unsanitized URL into an anchor tag within an admin notice, causing the browser to execute the attacker’s script in the context of the WordPress admin dashboard.
The patch in Freemius SDK version 2.11.0 restructures the HTML output to use a `
` element with an inner container for the message text and a separate button element. The patch wraps the message text with `apply_filters( ‘trial_promotion_message’, … )` which allows escaping within the filter, and separates the button HTML so it is not part of the message string that could contain unsanitized user input. The old code concatenated the button directly into the filter string, allowing the unsanitized URL to be embedded in the HTML output.
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim’s WordPress admin session. This can lead to session hijacking, administrative account creation, plugin/theme installation, data exfiltration, or complete site compromise. The attack requires user interaction (clicking a malicious link) but no authentication for initial access, as reflected XSS triggers against an authenticated user.
Differential between vulnerable and patched code
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
Code Diff
--- a/interactive-geo-maps/interactive-geo-maps.php
+++ b/interactive-geo-maps/interactive-geo-maps.php
@@ -7,7 +7,7 @@
* Plugin Name: MapGeo - Interactive Geo Maps
* Plugin URI: https://interactivegeomaps.com/
* Description: Create interactive geographic vector maps of the world, continents or any country in the world. Color full regions or create markers on specific locations that will have information on hover and can also have actions on click. This plugin uses the online amcharts library to generate the maps.
- * Version: 1.6.22
+ * Version: 1.6.23
* Requires PHP: 7.0
* Author: MapGeo
* Author URI: https://interactivegeomaps.com
@@ -118,7 +118,7 @@
add_action( 'plugins_loaded', function () use($framework) {
$plugin = new Core(
'interactive-geo-maps',
- '1.6.22',
+ '1.6.23',
__FILE__,
$framework
);
--- a/interactive-geo-maps/vendor/autoload.php
+++ b/interactive-geo-maps/vendor/autoload.php
@@ -22,4 +22,4 @@
require_once __DIR__ . '/composer/autoload_real.php';
-return ComposerAutoloaderInit5445a3d5180e037fbbcef6c07fbc859f::getLoader();
+return ComposerAutoloaderInitdf5adc35bf14130dc5b68d17d30eea7d::getLoader();
--- a/interactive-geo-maps/vendor/composer/autoload_files.php
+++ b/interactive-geo-maps/vendor/composer/autoload_files.php
@@ -6,6 +6,5 @@
$baseDir = dirname($vendorDir).'/build';
return array(
- '8d50dc88e56bace65e1e72f6017983ed' => $vendorDir . '/freemius/wordpress-sdk/start.php',
'57aea4427272562eb78cf61f6733ec6a' => $vendorDir . '/saltus/framework/lib/codestar-framework/codestar-framework.php',
);
--- a/interactive-geo-maps/vendor/composer/autoload_real.php
+++ b/interactive-geo-maps/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@
// autoload_real.php @generated by Composer
-class ComposerAutoloaderInit5445a3d5180e037fbbcef6c07fbc859f
+class ComposerAutoloaderInitdf5adc35bf14130dc5b68d17d30eea7d
{
private static $loader;
@@ -22,16 +22,16 @@
return self::$loader;
}
- spl_autoload_register(array('ComposerAutoloaderInit5445a3d5180e037fbbcef6c07fbc859f', 'loadClassLoader'), true, true);
+ spl_autoload_register(array('ComposerAutoloaderInitdf5adc35bf14130dc5b68d17d30eea7d', 'loadClassLoader'), true, true);
self::$loader = $loader = new ComposerAutoloadClassLoader(dirname(__DIR__));
- spl_autoload_unregister(array('ComposerAutoloaderInit5445a3d5180e037fbbcef6c07fbc859f', 'loadClassLoader'));
+ spl_autoload_unregister(array('ComposerAutoloaderInitdf5adc35bf14130dc5b68d17d30eea7d', 'loadClassLoader'));
require __DIR__ . '/autoload_static.php';
- call_user_func(ComposerAutoloadComposerStaticInit5445a3d5180e037fbbcef6c07fbc859f::getInitializer($loader));
+ call_user_func(ComposerAutoloadComposerStaticInitdf5adc35bf14130dc5b68d17d30eea7d::getInitializer($loader));
$loader->register(true);
- $filesToLoad = ComposerAutoloadComposerStaticInit5445a3d5180e037fbbcef6c07fbc859f::$files;
+ $filesToLoad = ComposerAutoloadComposerStaticInitdf5adc35bf14130dc5b68d17d30eea7d::$files;
$requireFile = Closure::bind(static function ($fileIdentifier, $file) {
if (empty($GLOBALS['__composer_autoload_files'][$fileIdentifier])) {
$GLOBALS['__composer_autoload_files'][$fileIdentifier] = true;
--- a/interactive-geo-maps/vendor/composer/autoload_static.php
+++ b/interactive-geo-maps/vendor/composer/autoload_static.php
@@ -4,10 +4,9 @@
namespace ComposerAutoload;
-class ComposerStaticInit5445a3d5180e037fbbcef6c07fbc859f
+class ComposerStaticInitdf5adc35bf14130dc5b68d17d30eea7d
{
public static $files = array (
- '8d50dc88e56bace65e1e72f6017983ed' => __DIR__ . '/..' . '/freemius/wordpress-sdk/start.php',
'57aea4427272562eb78cf61f6733ec6a' => __DIR__ . '/..' . '/saltus/framework/lib/codestar-framework/codestar-framework.php',
);
@@ -143,9 +142,9 @@
public static function getInitializer(ClassLoader $loader)
{
return Closure::bind(function () use ($loader) {
- $loader->prefixLengthsPsr4 = ComposerStaticInit5445a3d5180e037fbbcef6c07fbc859f::$prefixLengthsPsr4;
- $loader->prefixDirsPsr4 = ComposerStaticInit5445a3d5180e037fbbcef6c07fbc859f::$prefixDirsPsr4;
- $loader->classMap = ComposerStaticInit5445a3d5180e037fbbcef6c07fbc859f::$classMap;
+ $loader->prefixLengthsPsr4 = ComposerStaticInitdf5adc35bf14130dc5b68d17d30eea7d::$prefixLengthsPsr4;
+ $loader->prefixDirsPsr4 = ComposerStaticInitdf5adc35bf14130dc5b68d17d30eea7d::$prefixDirsPsr4;
+ $loader->classMap = ComposerStaticInitdf5adc35bf14130dc5b68d17d30eea7d::$classMap;
}, null, ClassLoader::class);
}
--- a/interactive-geo-maps/vendor/composer/installed.php
+++ b/interactive-geo-maps/vendor/composer/installed.php
@@ -3,7 +3,7 @@
'name' => 'carmoreira/interactive-geo-maps',
'pretty_version' => 'dev-main',
'version' => 'dev-main',
- 'reference' => '8762bc33d5bf1ff6c663ded2611a2fd37fc20d43',
+ 'reference' => 'fb4dd0a4488075cb3eec7bca51b1face79b6c5dc',
'type' => 'wordpress-plugin',
'install_path' => __DIR__ . '/../../build',
'aliases' => array(),
@@ -13,25 +13,25 @@
'carmoreira/interactive-geo-maps' => array(
'pretty_version' => 'dev-main',
'version' => 'dev-main',
- 'reference' => '8762bc33d5bf1ff6c663ded2611a2fd37fc20d43',
+ 'reference' => 'fb4dd0a4488075cb3eec7bca51b1face79b6c5dc',
'type' => 'wordpress-plugin',
'install_path' => __DIR__ . '/../../build',
'aliases' => array(),
'dev_requirement' => false,
),
'freemius/wordpress-sdk' => array(
- 'pretty_version' => '2.10.0',
- 'version' => '2.10.0.0',
- 'reference' => 'd3c35b9bd430ba335600ef979b8f7f742504ed3a',
+ 'pretty_version' => '2.11.0',
+ 'version' => '2.11.0.0',
+ 'reference' => null,
'type' => 'library',
'install_path' => __DIR__ . '/../freemius/wordpress-sdk',
'aliases' => array(),
'dev_requirement' => false,
),
'hassankhan/config' => array(
- 'pretty_version' => '3.1.0',
- 'version' => '3.1.0.0',
- 'reference' => '8e1c07f4fdc2b986b8a781f0dcba155af2a579b6',
+ 'pretty_version' => '3.2.0',
+ 'version' => '3.2.0.0',
+ 'reference' => 'cf63da451c4d226df983017932b9cef1b6d49db5',
'type' => 'library',
'install_path' => __DIR__ . '/../hassankhan/config',
'aliases' => array(),
--- a/interactive-geo-maps/vendor/freemius/wordpress-sdk/assets/scripts/index.php
+++ b/interactive-geo-maps/vendor/freemius/wordpress-sdk/assets/scripts/index.php
@@ -1,3 +0,0 @@
-<?php
- // Silence is golden.
- // Hide file structure from users on unprotected servers.
No newline at end of file
--- a/interactive-geo-maps/vendor/freemius/wordpress-sdk/assets/scss/admin/index.php
+++ b/interactive-geo-maps/vendor/freemius/wordpress-sdk/assets/scss/admin/index.php
@@ -1,3 +0,0 @@
-<?php
- // Silence is golden.
- // Hide file structure from users on unprotected servers.
No newline at end of file
--- a/interactive-geo-maps/vendor/freemius/wordpress-sdk/assets/scss/index.php
+++ b/interactive-geo-maps/vendor/freemius/wordpress-sdk/assets/scss/index.php
@@ -1,3 +0,0 @@
-<?php
- // Silence is golden.
- // Hide file structure from users on unprotected servers.
No newline at end of file
--- a/interactive-geo-maps/vendor/freemius/wordpress-sdk/includes/class-freemius.php
+++ b/interactive-geo-maps/vendor/freemius/wordpress-sdk/includes/class-freemius.php
@@ -1661,9 +1661,9 @@
if (
$this->is_user_in_admin() &&
$this->is_parallel_activation() &&
- $this->_premium_plugin_basename !== $this->premium_plugin_basename_from_parallel_activation
+ $this->_premium_plugin_basename !== $this->_premium_plugin_basename_from_parallel_activation
) {
- $this->_premium_plugin_basename = $this->premium_plugin_basename_from_parallel_activation;
+ $this->_premium_plugin_basename = $this->_premium_plugin_basename_from_parallel_activation;
register_activation_hook(
dirname( $this->_plugin_dir_path ) . '/' . $this->_premium_plugin_basename,
@@ -1681,7 +1681,7 @@
* @return bool
*/
private function is_parallel_activation() {
- return ! empty( $this->premium_plugin_basename_from_parallel_activation );
+ return ! empty( $this->_premium_plugin_basename_from_parallel_activation );
}
/**
@@ -5205,7 +5205,7 @@
throw new Exception('You need to specify the premium version basename to enable parallel version activation.');
}
- $this->premium_plugin_basename_from_parallel_activation = $premium_basename;
+ $this->_premium_plugin_basename_from_parallel_activation = $premium_basename;
if ( is_plugin_active( $premium_basename ) ) {
$is_premium = true;
@@ -24000,13 +24000,15 @@
// Start trial button.
$button = ' ' . sprintf(
- '<a style="margin-left: 10px; vertical-align: super;" href="%s"><button class="button button-primary">%s ➜</button></a>',
+ '<div><a class="button button-primary" href="%s">%s ➜</a></div>',
$trial_url,
$this->get_text_x_inline( 'Start free trial', 'call to action', 'start-free-trial' )
);
+ $message_text = $this->apply_filters( 'trial_promotion_message', "{$message} {$cc_string}" );
+
$this->_admin_notices->add_sticky(
- $this->apply_filters( 'trial_promotion_message', "{$message} {$cc_string} {$button}" ),
+ "<div class="fs-trial-message-container"><div>{$message_text}</div> {$button}</div>",
'trial_promotion',
'',
'promotion'
@@ -25476,7 +25478,7 @@
$img_dir = WP_FS__DIR_IMG;
// Locate the main assets folder.
- if ( 1 < count( $fs_active_plugins->plugins ) ) {
+ if ( ! empty( $fs_active_plugins->plugins ) ) {
$plugin_or_theme_img_dir = ( $this->is_plugin() ? WP_PLUGIN_DIR : get_theme_root( get_stylesheet() ) );
foreach ( $fs_active_plugins->plugins as $sdk_path => &$data ) {
--- a/interactive-geo-maps/vendor/freemius/wordpress-sdk/includes/class-fs-plugin-updater.php
+++ b/interactive-geo-maps/vendor/freemius/wordpress-sdk/includes/class-fs-plugin-updater.php
@@ -542,24 +542,8 @@
global $wp_current_filter;
- $current_plugin_version = $this->_fs->get_plugin_version();
-
- if ( ! empty( $wp_current_filter ) && 'upgrader_process_complete' === $wp_current_filter[0] ) {
- if (
- is_null( $this->_update_details ) ||
- ( is_object( $this->_update_details ) && $this->_update_details->new_version !== $current_plugin_version )
- ) {
- /**
- * After an update, clear the stored update details and reparse the plugin's main file in order to get
- * the updated version's information and prevent the previous update information from showing up on the
- * updates page.
- *
- * @author Leo Fajardo (@leorw)
- * @since 2.3.1
- */
- $this->_update_details = null;
- $current_plugin_version = $this->_fs->get_plugin_version( true );
- }
+ if ( ! empty( $wp_current_filter ) && in_array( 'upgrader_process_complete', $wp_current_filter ) ) {
+ return $transient_data;
}
if ( ! isset( $this->_update_details ) ) {
@@ -568,7 +552,7 @@
false,
fs_request_get_bool( 'force-check' ),
FS_Plugin_Updater::UPDATES_CHECK_CACHE_EXPIRATION,
- $current_plugin_version
+ $this->_fs->get_plugin_version()
);
$this->_update_details = false;
--- a/interactive-geo-maps/vendor/freemius/wordpress-sdk/includes/entities/class-fs-plugin-plan.php
+++ b/interactive-geo-maps/vendor/freemius/wordpress-sdk/includes/entities/class-fs-plugin-plan.php
@@ -13,7 +13,6 @@
/**
* Class FS_Plugin_Plan
*
- * @property FS_Pricing[] $pricing
*/
class FS_Plugin_Plan extends FS_Entity {
--- a/interactive-geo-maps/vendor/freemius/wordpress-sdk/includes/entities/class-fs-site.php
+++ b/interactive-geo-maps/vendor/freemius/wordpress-sdk/includes/entities/class-fs-site.php
@@ -10,16 +10,16 @@
exit;
}
- /**
- * @property int $blog_id
- */
- #[AllowDynamicProperties]
class FS_Site extends FS_Scope_Entity {
/**
* @var number
*/
public $site_id;
/**
+ * @var int
+ */
+ public $blog_id;
+ /**
* @var number
*/
public $plugin_id;
@@ -231,6 +231,7 @@
foreach ( $sandbox_wp_environment_domains as $domain) {
if (
+ ( $host === $domain ) ||
fs_ends_with( $host, '.' . $domain ) ||
fs_ends_with( $host, '-' . $domain )
) {
--- a/interactive-geo-maps/vendor/freemius/wordpress-sdk/includes/entities/class-fs-user.php
+++ b/interactive-geo-maps/vendor/freemius/wordpress-sdk/includes/entities/class-fs-user.php
@@ -48,6 +48,19 @@
parent::__construct( $user );
}
+ /**
+ * This method removes the deprecated 'is_beta' property from the serialized data.
+ * Should clean up the serialized data to avoid PHP 8.2 warning on next execution.
+ *
+ * @return void
+ */
+ function __wakeup() {
+ if ( property_exists( $this, 'is_beta' ) ) {
+ // If we enter here, and we are running PHP 8.2, we already had the warning. But we sanitize data for next execution.
+ unset( $this->is_beta );
+ }
+ }
+
function get_name() {
return trim( ucfirst( trim( is_string( $this->first ) ? $this->first : '' ) ) . ' ' . ucfirst( trim( is_string( $this->last ) ? $this->last : '' ) ) );
}
--- a/interactive-geo-maps/vendor/freemius/wordpress-sdk/includes/managers/class-fs-admin-menu-manager.php
+++ b/interactive-geo-maps/vendor/freemius/wordpress-sdk/includes/managers/class-fs-admin-menu-manager.php
@@ -699,16 +699,36 @@
$menu = $this->find_main_submenu();
}
+ $menu_slug = $menu['menu'][2];
$parent_slug = isset( $menu['parent_slug'] ) ?
- $menu['parent_slug'] :
- 'admin.php';
+ $menu['parent_slug'] :
+ 'admin.php';
- return admin_url(
- $parent_slug .
- ( false === strpos( $parent_slug, '?' ) ? '?' : '&' ) .
- 'page=' .
- $menu['menu'][2]
- );
+ if ( fs_apply_filter( $this->_module_unique_affix, 'enable_cpt_advanced_menu_logic', false ) ) {
+ $parent_slug = 'admin.php';
+
+ /**
+ * This line and the `if` block below it are based on the `menu_page_url()` function of WordPress.
+ *
+ * @author Leo Fajardo (@leorw)
+ * @since 2.10.2
+ */
+ global $_parent_pages;
+
+ if ( ! empty( $_parent_pages[ $menu_slug ] ) ) {
+ $_parent_slug = $_parent_pages[ $menu_slug ];
+ $parent_slug = isset( $_parent_pages[ $_parent_slug ] ) ?
+ $parent_slug :
+ $menu['parent_slug'];
+ }
+ }
+
+ return admin_url(
+ $parent_slug .
+ ( false === strpos( $parent_slug, '?' ) ? '?' : '&' ) .
+ 'page=' .
+ $menu_slug
+ );
}
/**
--- a/interactive-geo-maps/vendor/freemius/wordpress-sdk/includes/managers/class-fs-admin-notice-manager.php
+++ b/interactive-geo-maps/vendor/freemius/wordpress-sdk/includes/managers/class-fs-admin-notice-manager.php
@@ -194,8 +194,14 @@
* @since 1.0.7
*/
static function _add_sticky_dismiss_javascript() {
+ $sticky_admin_notice_js_template_name = 'sticky-admin-notice-js.php';
+
+ if ( ! file_exists( fs_get_template_path( $sticky_admin_notice_js_template_name ) ) ) {
+ return;
+ }
+
$params = array();
- fs_require_once_template( 'sticky-admin-notice-js.php', $params );
+ fs_require_once_template( $sticky_admin_notice_js_template_name, $params );
}
private static $_added_sticky_javascript = false;
--- a/interactive-geo-maps/vendor/freemius/wordpress-sdk/patches/index.php
+++ b/interactive-geo-maps/vendor/freemius/wordpress-sdk/patches/index.php
@@ -1,3 +0,0 @@
-<?php
- // Silence is golden.
- // Hide file structure from users on unprotected servers.
No newline at end of file
--- a/interactive-geo-maps/vendor/freemius/wordpress-sdk/start.php
+++ b/interactive-geo-maps/vendor/freemius/wordpress-sdk/start.php
@@ -15,7 +15,7 @@
*
* @var string
*/
- $this_sdk_version = '2.10.0';
+ $this_sdk_version = '2.11.0';
#region SDK Selection Logic --------------------------------------------------------------------
@@ -108,15 +108,33 @@
$is_current_sdk_from_parent_theme = $file_path == $themes_directory . '/' . get_template() . '/' . $theme_candidate_sdk_basename . '/' . basename( $file_path );
}
+ $theme_name = null;
if ( $is_current_sdk_from_active_theme ) {
- $this_sdk_relative_path = '../' . $themes_directory_name . '/' . get_stylesheet() . '/' . $theme_candidate_sdk_basename;
+ $theme_name = get_stylesheet();
+ $this_sdk_relative_path = '../' . $themes_directory_name . '/' . $theme_name . '/' . $theme_candidate_sdk_basename;
$is_theme = true;
} else if ( $is_current_sdk_from_parent_theme ) {
- $this_sdk_relative_path = '../' . $themes_directory_name . '/' . get_template() . '/' . $theme_candidate_sdk_basename;
+ $theme_name = get_template();
+ $this_sdk_relative_path = '../' . $themes_directory_name . '/' . $theme_name . '/' . $theme_candidate_sdk_basename;
$is_theme = true;
} else {
$this_sdk_relative_path = plugin_basename( $fs_root_path );
$is_theme = false;
+
+ /**
+ * If this file was included from another plugin with lower SDK version, and if this plugin is symlinked, then we need to get the actual plugin path,
+ * as the value right now will be wrong, it will only remove the directory separator from the file_path.
+ *
+ * The check of `fs_find_direct_caller_plugin_file` determines that this file was indeed included by a different plugin than the main plugin.
+ */
+ if ( DIRECTORY_SEPARATOR . $this_sdk_relative_path === $fs_root_path && function_exists( 'fs_find_direct_caller_plugin_file' ) ) {
+ $original_plugin_dir_name = dirname( fs_find_direct_caller_plugin_file( $file_path ) );
+
+ // Remove everything before the original plugin directory name.
+ $this_sdk_relative_path = substr( $this_sdk_relative_path, strpos( $this_sdk_relative_path, $original_plugin_dir_name ) );
+
+ unset( $original_plugin_dir_name );
+ }
}
if ( ! isset( $fs_active_plugins ) ) {
@@ -202,7 +220,7 @@
) {
if ( $is_theme ) {
// Saving relative path and not only directory name as it could be a subfolder
- $plugin_path = $this_sdk_relative_path;
+ $plugin_path = $theme_name;
} else {
$plugin_path = plugin_basename( fs_find_direct_caller_plugin_file( $file_path ) );
}
@@ -357,7 +375,7 @@
return;
}
- if ( version_compare( $this_sdk_version, $fs_active_plugins->newest->version, '<' ) ) {
+ if ( isset( $fs_active_plugins->newest ) && version_compare( $this_sdk_version, $fs_active_plugins->newest->version, '<' ) ) {
$newest_sdk = $fs_active_plugins->plugins[ $fs_active_plugins->newest->sdk_path ];
$plugins_or_theme_dir_path = ( ! isset( $newest_sdk->type ) || 'theme' !== $newest_sdk->type ) ?
--- a/interactive-geo-maps/vendor/hassankhan/config/src/AbstractConfig.php
+++ b/interactive-geo-maps/vendor/hassankhan/config/src/AbstractConfig.php
@@ -123,7 +123,7 @@
// nested case
foreach ($segments as $segment) {
- if (array_key_exists($segment, $root)) {
+ if (is_array($root) && array_key_exists($segment, $root)) {
$root = $root[$segment];
continue;
} else {
--- a/interactive-geo-maps/vendor/hassankhan/config/src/Config.php
+++ b/interactive-geo-maps/vendor/hassankhan/config/src/Config.php
@@ -67,10 +67,10 @@
* Loads a Config instance.
*
* @param string|array $values Filenames or string with configuration
- * @param ParserInterface $parser Configuration parser
+ * @param ?ParserInterface $parser Configuration parser
* @param bool $string Enable loading from string
*/
- public function __construct($values, ParserInterface $parser = null, $string = false)
+ public function __construct($values, ?ParserInterface $parser = null, $string = false)
{
if ($string === true) {
$this->loadFromString($values, $parser);
@@ -85,11 +85,11 @@
* Loads configuration from file.
*
* @param string|array $path Filenames or directories with configuration
- * @param ParserInterface $parser Configuration parser
+ * @param ?ParserInterface $parser Configuration parser
*
* @throws EmptyDirectoryException If `$path` is an empty directory
*/
- protected function loadFromFile($path, ParserInterface $parser = null)
+ protected function loadFromFile($path, ?ParserInterface $parser = null)
{
$paths = $this->getValidPath($path);
$this->data = [];
@@ -125,11 +125,11 @@
* Writes configuration to file.
*
* @param string $filename Filename to save configuration to
- * @param WriterInterface $writer Configuration writer
+ * @param ?WriterInterface $writer Configuration writer
*
* @throws WriteException if the data could not be written to the file
*/
- public function toFile($filename, WriterInterface $writer = null)
+ public function toFile($filename, ?WriterInterface $writer = null)
{
if ($writer === null) {
// Get file information
--- a/interactive-geo-maps/vendor/hassankhan/config/tests/AbstractConfigTest.php
+++ b/interactive-geo-maps/vendor/hassankhan/config/tests/AbstractConfigTest.php
@@ -247,6 +247,7 @@
$this->assertTrue($this->config->has('application.runtime'));
$this->assertFalse($this->config->has('application.not_exist'));
$this->assertFalse($this->config->has('not_exist.name'));
+ $this->assertFalse($this->config->has('application.name.not_exist'));
}
/**
