lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX CVE-2019-11200

Browse Source
This commit is contained in:
Laurent Destailleur 2019-04-25 22:25:19 +02:00
parent a15f1350be
commit 01075081cb
3 changed files with 23 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/admin/tools/dolibarr_export.php
View File

@ -50,7 +50,7 @@ if (! $user->admin)
if ($action == 'delete') if ($action == 'delete')
{ {
$file=$conf->admin->dir_output.'/'.GETPOST('urlfile'); $file=$conf->admin->dir_output.'/backup/'.basename(GETPOST('urlfile', 'alpha'));
$ret=dol_delete_file($file, 1); $ret=dol_delete_file($file, 1);
if ($ret) setEventMessages($langs->trans("FileWasRemoved", GETPOST('urlfile')), null, 'mesgs'); if ($ret) setEventMessages($langs->trans("FileWasRemoved", GETPOST('urlfile')), null, 'mesgs');
else setEventMessages($langs->trans("ErrorFailToDeleteFile", GETPOST('urlfile')), null, 'errors'); else setEventMessages($langs->trans("ErrorFailToDeleteFile", GETPOST('urlfile')), null, 'errors');

3
htdocs/admin/tools/export.php
View File

@ -133,7 +133,8 @@ if ($what == 'mysql')
dol_syslog("Command are restricted to ".$dolibarr_main_restrict_os_commands.". We check that one of this command is inside ".$cmddump); dol_syslog("Command are restricted to ".$dolibarr_main_restrict_os_commands.". We check that one of this command is inside ".$cmddump);
foreach($arrayofallowedcommand as $allowedcommand) foreach($arrayofallowedcommand as $allowedcommand)
{ {
if (preg_match('/'.preg_quote($allowedcommand,'/').'/', $cmddump)) $basenamecmddump=basename($cmddump);
if (preg_match('/^'.preg_quote($allowedcommand,'/').'$/', $basenamecmddump)) // the provided command $cmddump must be an allowed command
{ {
$ok=1; $ok=1;
break; break;

32
htdocs/core/class/utils.class.php
View File

@ -240,35 +240,36 @@ class Utils
// Parameteres execution // Parameteres execution
$command = $cmddump; $command = $cmddump;
if (preg_match("/\s/",$command)) $command=escapeshellarg($command); // Use quotes on command $command = preg_replace('/(\$|%)/', '', $command); // We removed chars that can be used to inject vars that contains space inside path of command without seeing there is a space to bypass the escapeshellarg.
if (preg_match("/\s/",$command)) $command=escapeshellarg($command); // If there is spaces, we add quotes on command to be sure $command is only a program and not a program+parameters
//$param=escapeshellarg($dolibarr_main_db_name)." -h ".escapeshellarg($dolibarr_main_db_host)." -u ".escapeshellarg($dolibarr_main_db_user)." -p".escapeshellarg($dolibarr_main_db_pass); //$param=escapeshellarg($dolibarr_main_db_name)." -h ".escapeshellarg($dolibarr_main_db_host)." -u ".escapeshellarg($dolibarr_main_db_user)." -p".escapeshellarg($dolibarr_main_db_pass);
$param=$dolibarr_main_db_name." -h ".$dolibarr_main_db_host; $param=$dolibarr_main_db_name." -h ".$dolibarr_main_db_host;
$param.=" -u ".$dolibarr_main_db_user; $param.=" -u ".$dolibarr_main_db_user;
if (! empty($dolibarr_main_db_port)) $param.=" -P ".$dolibarr_main_db_port; if (! empty($dolibarr_main_db_port)) $param.=" -P ".$dolibarr_main_db_port;
if (! GETPOST("use_transaction")) $param.=" -l --single-transaction"; if (! GETPOST("use_transaction", "alpha")) $param.=" -l --single-transaction";
if (GETPOST("disable_fk") || $usedefault) $param.=" -K"; if (GETPOST("disable_fk", "alpha") || $usedefault) $param.=" -K";
if (GETPOST("sql_compat") && GETPOST("sql_compat") != 'NONE') $param.=" --compatible=".escapeshellarg(GETPOST("sql_compat","alpha")); if (GETPOST("sql_compat", "alpha") && GETPOST("sql_compat", "alpha") != 'NONE') $param.=" --compatible=".escapeshellarg(GETPOST("sql_compat", "alpha"));
if (GETPOST("drop_database")) $param.=" --add-drop-database"; if (GETPOST("drop_database", "alpha")) $param.=" --add-drop-database";
if (GETPOST("sql_structure") || $usedefault) if (GETPOST("sql_structure", "alpha") || $usedefault)
{ {
if (GETPOST("drop") || $usedefault) $param.=" --add-drop-table=TRUE"; if (GETPOST("drop", "alpha") || $usedefault) $param.=" --add-drop-table=TRUE";
else $param.=" --add-drop-table=FALSE"; else $param.=" --add-drop-table=FALSE";
} }
else else
{ {
$param.=" -t"; $param.=" -t";
} }
if (GETPOST("disable-add-locks")) $param.=" --add-locks=FALSE"; if (GETPOST("disable-add-locks", "alpha")) $param.=" --add-locks=FALSE";
if (GETPOST("sql_data") || $usedefault) if (GETPOST("sql_data", "alpha") || $usedefault)
{ {
$param.=" --tables"; $param.=" --tables";
if (GETPOST("showcolumns") || $usedefault) $param.=" -c"; if (GETPOST("showcolumns", "alpha") || $usedefault) $param.=" -c";
if (GETPOST("extended_ins") || $usedefault) $param.=" -e"; if (GETPOST("extended_ins", "alpha") || $usedefault) $param.=" -e";
else $param.=" --skip-extended-insert"; else $param.=" --skip-extended-insert";
if (GETPOST("delayed")) $param.=" --delayed-insert"; if (GETPOST("delayed", "alpha")) $param.=" --delayed-insert";
if (GETPOST("sql_ignore")) $param.=" --insert-ignore"; if (GETPOST("sql_ignore", "alpha")) $param.=" --insert-ignore";
if (GETPOST("hexforbinary") || $usedefault) $param.=" --hex-blob"; if (GETPOST("hexforbinary", "alpha") || $usedefault) $param.=" --hex-blob";
} }
else else
{ {
@ -437,7 +438,8 @@ class Utils
// Parameteres execution // Parameteres execution
$command = $cmddump; $command = $cmddump;
if (preg_match("/\s/",$command)) $command=escapeshellarg($command); // Use quotes on command $command = preg_replace('/(\$|%)/', '', $command); // We removed chars that can be used to inject vars that contains space inside path of command without seeing there is a space to bypass the escapeshellarg.
if (preg_match("/\s/",$command)) $command=escapeshellarg($command); // If there is spaces, we add quotes on command to be sure $command is only a program and not a program+parameters
//$param=escapeshellarg($dolibarr_main_db_name)." -h ".escapeshellarg($dolibarr_main_db_host)." -u ".escapeshellarg($dolibarr_main_db_user)." -p".escapeshellarg($dolibarr_main_db_pass); //$param=escapeshellarg($dolibarr_main_db_name)." -h ".escapeshellarg($dolibarr_main_db_host)." -u ".escapeshellarg($dolibarr_main_db_user)." -p".escapeshellarg($dolibarr_main_db_pass);
//$param="-F c"; //$param="-F c";