lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: A local file inclusion vulnerability can be exploited to include arbitrary files.

Browse Source
This commit is contained in:
Regis Houssin 2011-04-26 20:11:18 +00:00
parent 40881f4158
commit 14ac9e3f19
2 changed files with 16 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
htdocs/main.inc.php
View File

@ -74,6 +74,7 @@ function test_sql_and_script_inject($val,$get)
$sql_inj += preg_match('/insert[\s]+into/i', $val); $sql_inj += preg_match('/insert[\s]+into/i', $val);
$sql_inj += preg_match('/select.+from/i', $val); $sql_inj += preg_match('/select.+from/i', $val);
$sql_inj += preg_match('/union.+select/i', $val); $sql_inj += preg_match('/union.+select/i', $val);
$sql_inj += preg_match('/(\.\.%2f)+/i', $val);
// For XSS Injection done by adding javascript with script // For XSS Injection done by adding javascript with script
$sql_inj += preg_match('/<script/i', $val); $sql_inj += preg_match('/<script/i', $val);
// For XSS Injection done by adding javascript with onmousemove, etc... (closing a src or href tag with not cleaned param) // For XSS Injection done by adding javascript with onmousemove, etc... (closing a src or href tag with not cleaned param)
@ -696,9 +697,9 @@ if (! defined('NOREQUIRETRAN'))
} }
// Case forcing style from url // Case forcing style from url
if (! empty($_GET["theme"])) if (GETPOST('theme'))
{ {
$conf->theme=$_GET["theme"]; $conf->theme=GETPOST('theme');
$conf->css = "/theme/".$conf->theme."/style.css.php"; $conf->css = "/theme/".$conf->theme."/style.css.php";
} }

25
htdocs/user/passwordforgotten.php
View File

@ -42,12 +42,13 @@ if ($conf->global->MAIN_SECURITY_DISABLEFORGETPASSLINK)
exit; exit;
} }
$action=isset($_GET["action"])?$_GET["action"]:$_POST["action"]; $action=GETPOST('action');
$mode=$dolibarr_main_authentication; $mode=$dolibarr_main_authentication;
if (! $mode) $mode='http'; if (! $mode) $mode='http';
$login = isset($_POST["username"])?$_POST["username"]:''; $username = GETPOST('username');
$conf->entity = isset($_POST["entity"])?$_POST["entity"]:1; $passwordmd5 = GETPOST('passwordmd5');
$conf->entity = ( GETPOST('entity') ? GETPOST('entity') : 1 );
/** /**
@ -55,17 +56,17 @@ $conf->entity = isset($_POST["entity"])?$_POST["entity"]:1;
*/ */
// Action modif mot de passe // Action modif mot de passe
if ($_GET["action"] == 'validatenewpassword' && $_GET["username"] && $_GET["passwordmd5"]) if ($action == 'validatenewpassword' && $username && $passwordmd5)
{ {
$edituser = new User($db); $edituser = new User($db);
$result=$edituser->fetch('',$_GET["username"]); $result=$edituser->fetch('',$_GET["username"]);
if ($result < 0) if ($result < 0)
{ {
$message = '<div class="error">'.$langs->trans("ErrorLoginDoesNotExists",$_GET["username"]).'</div>'; $message = '<div class="error">'.$langs->trans("ErrorLoginDoesNotExists",$username).'</div>';
} }
else else
{ {
if (md5($edituser->pass_temp) == $_GET["passwordmd5"]) if (md5($edituser->pass_temp) == $passwordmd5)
{ {
$newpassword=$edituser->setPassword($user,$edituser->pass_temp,0); $newpassword=$edituser->setPassword($user,$edituser->pass_temp,0);
dol_syslog("passwordforgotten.php new password for user->id=".$edituser->id." validated in database"); dol_syslog("passwordforgotten.php new password for user->id=".$edituser->id." validated in database");
@ -81,7 +82,7 @@ if ($_GET["action"] == 'validatenewpassword' && $_GET["username"] && $_GET["pass
} }
} }
// Action modif mot de passe // Action modif mot de passe
if ($_POST["action"] == 'buildnewpassword' && $_POST["username"]) if ($action == 'buildnewpassword' && $username)
{ {
require_once DOL_DOCUMENT_ROOT.'/includes/artichow/Artichow.cfg.php'; require_once DOL_DOCUMENT_ROOT.'/includes/artichow/Artichow.cfg.php';
require_once ARTICHOW."/AntiSpam.class.php"; require_once ARTICHOW."/AntiSpam.class.php";
@ -97,11 +98,11 @@ if ($_POST["action"] == 'buildnewpassword' && $_POST["username"])
else else
{ {
$edituser = new User($db); $edituser = new User($db);
$result=$edituser->fetch('',$_POST["username"],'',1); $result=$edituser->fetch('',$username,'',1);
if ($result <= 0 && $edituser->error == 'USERNOTFOUND') if ($result <= 0 && $edituser->error == 'USERNOTFOUND')
{ {
$message = '<div class="error">'.$langs->trans("ErrorLoginDoesNotExists",$_POST["username"]).'</div>'; $message = '<div class="error">'.$langs->trans("ErrorLoginDoesNotExists",$username).'</div>';
$_POST["username"]=''; $username='';
} }
else else
{ {
@ -124,7 +125,7 @@ if ($_POST["action"] == 'buildnewpassword' && $_POST["username"])
{ {
$message = '<div class="ok">'.$langs->trans("PasswordChangeRequestSent",$edituser->login,$edituser->email).'</div>'; $message = '<div class="ok">'.$langs->trans("PasswordChangeRequestSent",$edituser->login,$edituser->email).'</div>';
//$message.=$newpassword; //$message.=$newpassword;
$_POST["username"]=''; $username='';
} }
else else
{ {
@ -179,7 +180,7 @@ else
$login_background = DOL_URL_ROOT.'/theme/login_background.png'; $login_background = DOL_URL_ROOT.'/theme/login_background.png';
} }
if (! $_REQUEST["username"]) $focus_element = 'username'; if (! $username) $focus_element = 'username';
else $focus_element = 'password'; else $focus_element = 'password';
// Send password button enabled ? // Send password button enabled ?