diff --git a/ChangeLog b/ChangeLog index c976fe08a27..7cd1e8b5b4a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -138,6 +138,12 @@ parameter. All methods addline in this case were modified to remove this paramet ***** ChangeLog for 3.4.3 compared to 3.4.2 ***** Fix: Bad get of localtaxes into contracts add lines +***** ChangeLog for 3.4.3 compared to 3.4.2 ***** +Fix: Warning into bank conciliation feature. +Fix: Bad get of localtaxes into contracts add lines. +Fix: Add a limit into list to avoid browser to hang when database is too large. +Fix: [ bug #1212 ] 'jqueryFileTree.php' directory traversal vulnerability + ***** ChangeLog for 3.4.2 compared to 3.4.1 ***** Fix: field's problem into company's page (RIB). Fix: Document cerfa doesn't contained firstname & lastname from donator. diff --git a/dev/dolibarr_changes.txt b/dev/dolibarr_changes.txt index 3f7f4767d4f..2bf2e1a5c99 100644 --- a/dev/dolibarr_changes.txt +++ b/dev/dolibarr_changes.txt @@ -54,3 +54,9 @@ window.location.href=pRef JCROP: ------ * Remove analytics tag into file index.html + + +JQUERYFILETREE: +--------------- +* Remove directory htdocs/includes/jquery/plugins/jqueryFileTree/connectors + diff --git a/htdocs/comm/index.php b/htdocs/comm/index.php index dff264b6f25..64ca064063a 100644 --- a/htdocs/comm/index.php +++ b/htdocs/comm/index.php @@ -473,8 +473,10 @@ if (! empty($conf->propal->enabled) && $user->rights->propal->lire) $var=true; print ''; - print ''; - while ($i < $num) + print ''; + + $nbofloop=min($num, (empty($conf->global->MAIN_MAXLIST_OVERLOAD)?1000:$conf->global->MAIN_MAXLIST_OVERLOAD)); + while ($i < $nbofloop) { $obj = $db->fetch_object($result); $var=!$var; @@ -511,7 +513,12 @@ if (! empty($conf->propal->enabled) && $user->rights->propal->lire) $i++; $total += $obj->total_ttc; } - if ($total>0) { + if ($num > $nbofloop) + { + print '"; + } + else if ($total>0) + { print '"; } print "
'.$langs->trans("ProposalsOpened").'
'.$langs->trans("ProposalsOpened").' ('.$num.')
'.$langs->trans("XMoreLines", ($num - $nbofloop))."
'.$langs->trans("Total")."".price($total)." 

"; diff --git a/htdocs/comm/propal/index.php b/htdocs/comm/propal/index.php index 45a594c12cd..cdd7e6840c9 100644 --- a/htdocs/comm/propal/index.php +++ b/htdocs/comm/propal/index.php @@ -313,8 +313,10 @@ if (! empty($conf->propal->enabled) && $user->rights->propale->lire) $var=true; print ''; - print ''; - while ($i < $num) + print ''; + + $nbofloop=min($num, (empty($conf->global->MAIN_MAXLIST_OVERLOAD)?1000:$conf->global->MAIN_MAXLIST_OVERLOAD)); + while ($i < $nbofloop) { $obj = $db->fetch_object($result); $var=!$var; @@ -356,7 +358,12 @@ if (! empty($conf->propal->enabled) && $user->rights->propale->lire) $i++; $total += $obj->total_ttc; } - if ($total>0) { + if ($num > $nbofloop) + { + print '"; + } + else if ($total>0) + { print '"; } print "
'.$langs->trans("ProposalsOpened").' ('.$num.')
'.$langs->trans("ProposalsOpened").' ('.$num.')
'.$langs->trans("XMoreLines", ($num - $nbofloop))."
'.$langs->trans("Total")."".price($total)." 

"; diff --git a/htdocs/core/lib/admin.lib.php b/htdocs/core/lib/admin.lib.php index 3eb92fb26a3..3cfb0adeb7d 100644 --- a/htdocs/core/lib/admin.lib.php +++ b/htdocs/core/lib/admin.lib.php @@ -557,7 +557,13 @@ function listOfSessions() global $conf; $arrayofSessions = array(); - $sessPath = ini_get("session.save_path").'/'; + // session.save_path can be returned empty so we set a default location and work from there + $sessPath = '/tmp'; + $iniPath = ini_get("session.save_path"); + if ($iniPath) { + $sessPath = $iniPath; + } + $sessPath .= '/'; // We need the trailing slash dol_syslog('admin.lib:listOfSessions sessPath='.$sessPath); $dh = @opendir(dol_osencode($sessPath)); diff --git a/htdocs/core/modules/modAgenda.class.php b/htdocs/core/modules/modAgenda.class.php index 1c22c61f3db..fea2915e011 100644 --- a/htdocs/core/modules/modAgenda.class.php +++ b/htdocs/core/modules/modAgenda.class.php @@ -23,15 +23,15 @@ /** * \defgroup agenda Module agenda - * \brief Module pour gerer l'agenda et actions + * \brief Module to manage agenda and events * \file htdocs/core/modules/modAgenda.class.php * \ingroup agenda - * \brief Fichier de description et activation du module agenda + * \brief File of class to describe and enable/disable module Agenda */ include_once DOL_DOCUMENT_ROOT .'/core/modules/DolibarrModules.class.php'; /** - * Classe de description et activation du module Adherent + * Class to describe and enable/disable module Agenda */ class modAgenda extends DolibarrModules { diff --git a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.asp b/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.asp deleted file mode 100755 index 41eb5b4d5b7..00000000000 --- a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.asp +++ /dev/null @@ -1,44 +0,0 @@ -<% -' -' jQuery File Tree ASP (VBS) Connector -' Copyright 2008 Chazzuka -' programmer@chazzuka.com -' http://www.chazzuka.com/ -' -' retrive base directory -dim BaseFileDir:BaseFileDir=Request.Form("dir") -' if blank give default value -if len(BaseFileDir)=0 then BaseFileDir="/userfiles/" - -dim ObjFSO,BaseFile,Html -' resolve the absolute path -BaseFile = Server.MapPath(BaseFileDir)&"\" -' create FSO -Set ObjFSO = Server.CreateObject("Scripting.FileSystemObject") -' if given folder is exists -if ObjFSO.FolderExists(BaseFile) then - dim ObjFolder,ObjSubFolder,ObjFile,i__Name,i__Ext - Html = Html + ""&VBCRLF -end if - -Response.Write Html -%> \ No newline at end of file diff --git a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.aspx b/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.aspx deleted file mode 100755 index f8443ae7123..00000000000 --- a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.aspx +++ /dev/null @@ -1,31 +0,0 @@ -<%@ Page Language="C#" AutoEventWireup="true" %> - -<% - // - // jQuery File Tree ASP Connector - // - // Version 1.0 - // - // Copyright (c)2008 Andrew Sweeny - // asweeny@fit.edu - // 24 March 2008 - // - string dir; - if(Request.Form["dir"] == null || Request.Form["dir"].Length <= 0) - dir = "/"; - else - dir = Server.UrlDecode(Request.Form["dir"]); - System.IO.DirectoryInfo di = new System.IO.DirectoryInfo(dir); - Response.Write(""); - %> \ No newline at end of file diff --git a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.cf b/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.cf deleted file mode 100755 index 815f83b6ed6..00000000000 --- a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.cf +++ /dev/null @@ -1,19 +0,0 @@ - - - - - \ No newline at end of file diff --git a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.jsp b/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.jsp deleted file mode 100755 index 27b34202174..00000000000 --- a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.jsp +++ /dev/null @@ -1,49 +0,0 @@ -<%@ page - import="java.io.File,java.io.FilenameFilter,java.util.Arrays"%> -<% -/** - * jQuery File Tree JSP Connector - * Version 1.0 - * Copyright 2008 Joshua Gould - * 21 April 2008 -*/ - String dir = request.getParameter("dir"); - if (dir == null) { - return; - } - - if (dir.charAt(dir.length()-1) == '\\') { - dir = dir.substring(0, dir.length()-1) + "/"; - } else if (dir.charAt(dir.length()-1) != '/') { - dir += "/"; - } - - dir = java.net.URLDecoder.decode(dir, "UTF-8"); - - if (new File(dir).exists()) { - String[] files = new File(dir).list(new FilenameFilter() { - public boolean accept(File dir, String name) { - return name.charAt(0) != '.'; - } - }); - Arrays.sort(files, String.CASE_INSENSITIVE_ORDER); - out.print(""); - } -%> \ No newline at end of file diff --git a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.php b/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.php deleted file mode 100644 index d983e2f1a44..00000000000 --- a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.php +++ /dev/null @@ -1,43 +0,0 @@ - 2 ) { /* The 2 accounts for . and .. */ - echo ""; - } -} - -?> \ No newline at end of file diff --git a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.pl b/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.pl deleted file mode 100755 index 200701695b7..00000000000 --- a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.pl +++ /dev/null @@ -1,102 +0,0 @@ -#!/usr/bin/perl -use strict; -use HTML::Entities (); - -#----------------------------------------------------------- -# jQuery File Tree Perl Connector -# -# Version 1.0 -# -# Oleg Burlaca -# http://www.burlaca.com/2009/02/jquery-file-tree-connector/ -# 12 February 2009 -#----------------------------------------------------------- - -# for security reasons, specify a root folder -# to prevent the whole filesystem to be shown -# for ex: the root folder of your webbrowser - -my $root = "/var/www/html/"; - -#---------------------------------------------------------- - -my $params = &getCGIParams(); -print "Content-type: text/html\n\n"; - -my $dir = $params->{dir}; -my $fullDir = $root . $dir; - -exit if ! -e $fullDir; - -opendir(BIN, $fullDir) or die "Can't open $dir: $!"; -my (@folders, @files); -my $total = 0; -while( defined (my $file = readdir BIN) ) { - next if $file eq '.' or $file eq '..'; - $total++; - if (-d "$fullDir/$file") { - push (@folders, $file); - } else { - push (@files, $file); - } -} -closedir(BIN); - -return if $total == 0; -print "\n"; - - - - -#-------------------------------------------------------------------------------------------------- -sub getCGIParams { - my $line; - - if ($ENV{'REQUEST_METHOD'} eq "POST") { - read(STDIN, $line, $ENV{'CONTENT_LENGTH'}); - } else { - $line = $ENV{'QUERY_STRING'}; - } - - my (@pairs) = split(/&/, $line); - my ($name, $value, %F); - - foreach (@pairs) { - ($name, $value) = split(/=/); - $value =~ tr/+/ /; - $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg; - - if (! exists $F{$name}) { - $F{$name} = $value; - } elsif (exists $F{$name} and ref($F{$name}) ne 'ARRAY') { - my $prev_value = $F{$name}; - delete $F{$name}; - $F{$name} = [ $prev_value, $value ]; - } else { push @{ $F{$name} }, $value } - } - return \%F; -} -#-------------------------------------------------------------------------------------------------- - \ No newline at end of file diff --git a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.py b/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.py deleted file mode 100755 index 6b63c06419f..00000000000 --- a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.py +++ /dev/null @@ -1,25 +0,0 @@ -# -# jQuery File Tree -# Python/Django connector script -# By Martin Skou -# -import os -import urllib - -def dirlist(request): - r=['') - return HttpResponse(''.join(r)) \ No newline at end of file diff --git a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.rb b/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.rb deleted file mode 100755 index b30b8a976a2..00000000000 --- a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.rb +++ /dev/null @@ -1,61 +0,0 @@ -# -# jQuery File Tree Ruby Connector -# -# Version 1.01 -# -# Erik Lax -# http://datahack.se -# 13 July 2008 -# -# History -# -# 1.01 Initial Release -# -# Output a list of files for jQuery File Tree -# - -# -#root = "/absolute/path/" -# or -root = File.expand_path(".") -# - -# -require "cgi" -cgi = CGI.new -cgi.header("type" => "text/html") -dir = cgi.params["dir"].to_s - -puts "
    " -begin - path = root + "/" + dir - - # chdir() to user requested dir (root + "/" + dir) - Dir.chdir(File.expand_path(path).untaint); - - # check that our base path still begins with root path - if Dir.pwd[0,root.length] == root then - - #loop through all directories - Dir.glob("*") { - |x| - if not File.directory?(x.untaint) then next end - puts "
  • #{x}
    • "; - } - - #loop through all files - Dir.glob("*") { - |x| - if not File.file?(x.untaint) then next end - ext = File.extname(x)[1..-1] - puts "
  • #{x}
    • " - } - else - #only happens when someone tries to go outside your root directory... - puts "You are way out of your league" - end -rescue - puts "Internal Error" -end -puts "
" -# diff --git a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree_huck.lasso b/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree_huck.lasso deleted file mode 100755 index 3359e29314f..00000000000 --- a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree_huck.lasso +++ /dev/null @@ -1,36 +0,0 @@ -[ - // - // jQuery File Tree Lasso Connector - // - // Version 1.00 - // - // Jason Huck - // http://devblog.jasonhuck.com/ - // 1 May 2008 - // - // History: - // - // 1.00 - released (1 May 2008) - // - // Output a list of files for jQuery File Tree - // - - !action_param('dir') ? abort; - var('dir') = action_param('dir'); - var('files') = file_listdirectory($dir); - - ''; -] diff --git a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree_sabourdin.lasso b/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree_sabourdin.lasso deleted file mode 100755 index 077258e2583..00000000000 --- a/htdocs/includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree_sabourdin.lasso +++ /dev/null @@ -1,48 +0,0 @@ -(Sort); - if:( $files->(Size) > 0 ); - output:''; - /if; -/if; - -/Encode_set; -?> \ No newline at end of file diff --git a/htdocs/langs/en_US/main.lang b/htdocs/langs/en_US/main.lang index 4465b660cf6..d889dedc9d6 100644 --- a/htdocs/langs/en_US/main.lang +++ b/htdocs/langs/en_US/main.lang @@ -666,6 +666,8 @@ SaveUploadedFileWithMask=Save file on server with name "%s" (ot OriginFileName=Original filename SetDemandReason=Set source ViewPrivateNote=View notes +XMoreLines=%s line(s) hidden + # Week day Monday=Monday Tuesday=Tuesday diff --git a/htdocs/langs/fr_FR/main.lang b/htdocs/langs/fr_FR/main.lang index dcbdd696002..dfd5f45f1f0 100644 --- a/htdocs/langs/fr_FR/main.lang +++ b/htdocs/langs/fr_FR/main.lang @@ -666,6 +666,7 @@ SaveUploadedFileWithMask=Sauver le fichier sur le serveur sous le nom "% OriginFileName=nom du fichier source SetDemandReason=Définir l'origine ViewPrivateNote=Voir notes +XMoreLines=%s ligne(s) non affichée(s) # Week day Monday=Lundi diff --git a/htdocs/projet/class/task.class.php b/htdocs/projet/class/task.class.php index 5abf23e6df3..7b21cbf57d0 100644 --- a/htdocs/projet/class/task.class.php +++ b/htdocs/projet/class/task.class.php @@ -27,7 +27,6 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/commonobject.class.php'; /** * Class to manage tasks - * Initialy built by build_class_from_table on 2008-09-10 12:41 */ class Task extends CommonObject { diff --git a/htdocs/theme/amarok/img/favicon.ico b/htdocs/theme/amarok/img/favicon.ico index 7d41c54d5bb..b93a86747d6 100644 Binary files a/htdocs/theme/amarok/img/favicon.ico and b/htdocs/theme/amarok/img/favicon.ico differ diff --git a/htdocs/theme/auguria/img/favicon.ico b/htdocs/theme/auguria/img/favicon.ico new file mode 100644 index 00000000000..b93a86747d6 Binary files /dev/null and b/htdocs/theme/auguria/img/favicon.ico differ diff --git a/htdocs/theme/bureau2crea/img/favicon.ico b/htdocs/theme/bureau2crea/img/favicon.ico index e0b4481f81e..b93a86747d6 100644 Binary files a/htdocs/theme/bureau2crea/img/favicon.ico and b/htdocs/theme/bureau2crea/img/favicon.ico differ diff --git a/htdocs/theme/cameleo/img/favicon.ico b/htdocs/theme/cameleo/img/favicon.ico index 7d41c54d5bb..b93a86747d6 100644 Binary files a/htdocs/theme/cameleo/img/favicon.ico and b/htdocs/theme/cameleo/img/favicon.ico differ diff --git a/htdocs/theme/cameleo/style.css.php b/htdocs/theme/cameleo/style.css.php index d739c71f93c..88858ee3211 100644 --- a/htdocs/theme/cameleo/style.css.php +++ b/htdocs/theme/cameleo/style.css.php @@ -967,7 +967,6 @@ td.photo { /* ============================================================================== */ .toolbar { - background-image: url(theme.'/img/tmenu2.png',1); ?>) !important; background-repeat: repeat-x !important; border: 1px solid #BBB !important; } diff --git a/htdocs/theme/eldy/img/favicon.ico b/htdocs/theme/eldy/img/favicon.ico index 7d41c54d5bb..b93a86747d6 100644 Binary files a/htdocs/theme/eldy/img/favicon.ico and b/htdocs/theme/eldy/img/favicon.ico differ