diff --git a/htdocs/public/test/test_arrays.php b/htdocs/public/test/test_arrays.php index b2a87a75480..05fc13c0dbc 100644 --- a/htdocs/public/test/test_arrays.php +++ b/htdocs/public/test/test_arrays.php @@ -22,19 +22,22 @@ if (!defined("NOLOGIN")) { define("NOLOGIN", '1'); // If this page is public (can be called outside logged session) } - require '../../main.inc.php'; +// Security if ($dolibarr_main_prod) { accessforbidden(); } -$usedolheader = 1; // 1 = Test inside a dolibarr page, 0 = Use hard coded header + + +/* + * View + */ $form = new Form($db); - - +$usedolheader = 1; // 1 = Test inside a dolibarr page, 0 = Use hard coded header // HEADER //-------- diff --git a/htdocs/public/test/test_csrf.php b/htdocs/public/test/test_csrf.php index 1c23dc7070a..94d76469f81 100644 --- a/htdocs/public/test/test_csrf.php +++ b/htdocs/public/test/test_csrf.php @@ -1,11 +1,44 @@ This is a form to test if a CSRF exists into a Dolibarr page.

-- Change url to send request to into this file (server B, hard coded page)
+- Change url to send request to into this file (URL to a hard coded page on a server B)
- Open this form into a virtual server A.
- Send the request to the virtual server B by clicking submit.
- Check that Anticsrf protection is triggered.
diff --git a/htdocs/public/test/test_exec.php b/htdocs/public/test/test_exec.php new file mode 100644 index 00000000000..a25e860021c --- /dev/null +++ b/htdocs/public/test/test_exec.php @@ -0,0 +1,87 @@ +\n"; +print 'PHP_SESSION_DISABLED='.PHP_SESSION_DISABLED."
\n"; +print 'PHP_SESSION_NONE='.PHP_SESSION_NONE."
\n"; +print 'PHP_SESSION_ACTIVE='.PHP_SESSION_ACTIVE."
\n"; +print '
'; + +print 'session_status='.session_status().' (before main.inc.php)'; +print '
'; + +require '../../main.inc.php'; + +// Security +if ($dolibarr_main_prod) { + accessforbidden(); +} + + +/* + * View + */ + +echo "Test
\n"; +$out=''; +$ret=0; + +$file = '/tmp/aaa'; +$f=fopen($file, 'r'); +if ($f) { + $s=fread($f, 4096); + print $s; + fclose($f); +} else { + print "Failed to open file ".$file."
\n"; +} + +exec('cat /aaa; ls /dev/std*; sleep 1;', $out, $ret); +print $ret."
\n"; +print_r($out); + +$ret = 0; +$out = null; +exec('/usr/bin/clamdscan --fdpass filethatdoesnotexists.php', $out, $ret); +print $ret."
\n"; +print_r($out); diff --git a/htdocs/public/test/test_forms.php b/htdocs/public/test/test_forms.php index d89e04e12a6..c025151bdb9 100644 --- a/htdocs/public/test/test_forms.php +++ b/htdocs/public/test/test_forms.php @@ -8,10 +8,16 @@ if (!defined('NOSESSION')) { require '../../main.inc.php'; include_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php'; +// Security if ($dolibarr_main_prod) { accessforbidden(); } + +/* + * View + */ + llxHeader(); ?> diff --git a/htdocs/public/test/test_sessionlock.php b/htdocs/public/test/test_sessionlock.php index 18a1ef73d08..8464ba2eb4f 100644 --- a/htdocs/public/test/test_sessionlock.php +++ b/htdocs/public/test/test_sessionlock.php @@ -52,11 +52,15 @@ print '
'; require '../../main.inc.php'; -/* No need for this. +// Security if ($dolibarr_main_prod) { accessforbidden(); } -*/ + + +/* + * View + */ print 'session_status='.session_status().' (after main.inc.php)'; print '
'; diff --git a/htdocs/public/ticket/create_ticket.php b/htdocs/public/ticket/create_ticket.php index 00eff71da78..1a11b16d1ea 100644 --- a/htdocs/public/ticket/create_ticket.php +++ b/htdocs/public/ticket/create_ticket.php @@ -297,7 +297,7 @@ if (empty($reshook) && $action == 'create_ticket' && GETPOST('save', 'alpha')) { if (is_array($object->array_options) && count($object->array_options) > 0) { foreach ($object->array_options as $key => $value) { $key = substr($key, 8); // remove "options_" - $message_admin .= '
  • '.$langs->trans($extrafields->attributes[$object->element]['label'][$key]).' : '.$extrafields->showOutputField($key, $value).'
  • '; + $message_admin .= '
  • '.$langs->trans($extrafields->attributes[$object->table_element]['label'][$key]).' : '.$extrafields->showOutputField($key, $value, '', $object->table_element).'
  • '; } } $message_admin .= ''; diff --git a/htdocs/public/ticket/list.php b/htdocs/public/ticket/list.php index db5f5d8d754..4fbfd29106a 100644 --- a/htdocs/public/ticket/list.php +++ b/htdocs/public/ticket/list.php @@ -651,7 +651,7 @@ if ($action == "view_ticketlist") { } print '>'; $tmpkey = 'options_'.$key; - print $extrafields->showOutputField($key, $obj->$tmpkey, '', 1); + print $extrafields->showOutputField($key, $obj->$tmpkey, '', $object->table_element); print '