lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #22969 from Hystepik/develop#4

Browse Source 
Fix : Yogosha#12007 add protection in dol_add_file_process
This commit is contained in:
Laurent Destailleur 2022-11-25 22:00:13 +01:00 committed by GitHub
commit 1c53d32ba0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 21 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
htdocs/admin/security_other.php
View File

@ -62,7 +62,7 @@ if (preg_match('/set_([a-z0-9_\-]+)/i', $action, $reg)) {
dol_print_error($db); dol_print_error($db);
} }
} elseif ($action == 'updateform') { } elseif ($action == 'updateform') {
$res1 = 1; $res2 = 1; $res3 = 1; $res4 = 1; $res1 = 1; $res2 = 1; $res3 = 1; $res4 = 1; $res5 = 1;
if (GETPOSTISSET('MAIN_APPLICATION_TITLE')) { if (GETPOSTISSET('MAIN_APPLICATION_TITLE')) {
$res1 = dolibarr_set_const($db, "MAIN_APPLICATION_TITLE", GETPOST("MAIN_APPLICATION_TITLE", 'alphanohtml'), 'chaine', 0, '', $conf->entity); $res1 = dolibarr_set_const($db, "MAIN_APPLICATION_TITLE", GETPOST("MAIN_APPLICATION_TITLE", 'alphanohtml'), 'chaine', 0, '', $conf->entity);
} }
@ -75,7 +75,10 @@ if (preg_match('/set_([a-z0-9_\-]+)/i', $action, $reg)) {
if (GETPOSTISSET('MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS')) { if (GETPOSTISSET('MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS')) {
$res4 = dolibarr_set_const($db, "MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", GETPOST("MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", 'alphanohtml'), 'int', 0, '', $conf->entity); $res4 = dolibarr_set_const($db, "MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", GETPOST("MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", 'alphanohtml'), 'int', 0, '', $conf->entity);
} }
if ($res1 && $res2 && $res3 && $res4) { if (GETPOSTISSET('MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS')) {
$res5 = dolibarr_set_const($db, "MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS", GETPOST("MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS", 'alphanohtml'), 'int', 0, '', $conf->entity);
}
if ($res1 && $res2 && $res3 && $res4 && $res5) {
setEventMessages($langs->trans("RecordModifiedSuccessfully"), null, 'mesgs'); setEventMessages($langs->trans("RecordModifiedSuccessfully"), null, 'mesgs');
} }
} }
@ -197,6 +200,14 @@ print '<input class="flat right width50" name="MAIN_SECURITY_MAX_POST_ON_PUBLIC_
print '</td>'; print '</td>';
print '</tr>'; print '</tr>';
print '<tr class="oddeven">';
print '<td>'.$langs->trans("MaxNumberOfAttachementOnForms").'</td><td class="right">';
print '</td>';
print '<td class="nowrap">';
print '<input class="flat right width50" name="MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS" type="text" value="'.getDolGlobalInt("MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS", 10).'">';
print '</td>';
print '</tr>';
/* /*
if (empty($conf->global->MAIN_APPLICATION_TITLE)) { if (empty($conf->global->MAIN_APPLICATION_TITLE)) {
$conf->global->MAIN_APPLICATION_TITLE = ""; $conf->global->MAIN_APPLICATION_TITLE = "";

7
htdocs/core/lib/files.lib.php
View File

@ -1657,7 +1657,12 @@ function dol_add_file_process($upload_dir, $allowoverwrite = 0, $donotupdatesess
if (!empty($_FILES[$varfiles])) { // For view $_FILES[$varfiles]['error'] if (!empty($_FILES[$varfiles])) { // For view $_FILES[$varfiles]['error']
dol_syslog('dol_add_file_process upload_dir='.$upload_dir.' allowoverwrite='.$allowoverwrite.' donotupdatesession='.$donotupdatesession.' savingdocmask='.$savingdocmask, LOG_DEBUG); dol_syslog('dol_add_file_process upload_dir='.$upload_dir.' allowoverwrite='.$allowoverwrite.' donotupdatesession='.$donotupdatesession.' savingdocmask='.$savingdocmask, LOG_DEBUG);
$maxfilesinform = getDolGlobalInt("MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS", 10);
if (is_array($_FILES[$varfiles]["name"]) && count($_FILES[$varfiles]["name"]) > $maxfilesinform) {
$langs->load("errors"); // key must be loaded because we can't rely on loading during output, we need var substitution to be done now.
setEventMessages($langs->trans("ErrorTooMuchFileInForm", $maxfilesinform), null, "errors");
return -1;
}
$result = dol_mkdir($upload_dir); $result = dol_mkdir($upload_dir);
// var_dump($result);exit; // var_dump($result);exit;
if ($result >= 0) { if ($result >= 0) {

1
htdocs/langs/en_US/admin.lang
View File

@ -2343,3 +2343,4 @@ DesktopsAndSmartphones=Desktops et smartphones
AllowOnlineSign=Allow online signing AllowOnlineSign=Allow online signing
AllowExternalDownload=Allow external download (without login, using a shared link) AllowExternalDownload=Allow external download (without login, using a shared link)
DeadlineDayVATSubmission=Deadline day for vat submission on the next month DeadlineDayVATSubmission=Deadline day for vat submission on the next month
MaxNumberOfAttachementOnForm=Max number of joinded files in form

1
htdocs/langs/en_US/errors.lang
View File

@ -302,6 +302,7 @@ ErrorTableNotFound=Table <b>%s</b> not found
ErrorValueForTooLow=Value for <b>%s</b> is too low ErrorValueForTooLow=Value for <b>%s</b> is too low
ErrorValueCantBeNull=Value for <b>%s</b> can't be null ErrorValueCantBeNull=Value for <b>%s</b> can't be null
ErrorDateOfMovementLowerThanDateOfFileTransmission=The date of the bank transaction can't be lower than the date of the file transmission ErrorDateOfMovementLowerThanDateOfFileTransmission=The date of the bank transaction can't be lower than the date of the file transmission
ErrorTooMuchFileInForm=Too much files in form, the maximum number is %s file(s)
# Warnings # Warnings
WarningParamUploadMaxFileSizeHigherThanPostMaxSize=Your PHP parameter upload_max_filesize (%s) is higher than PHP parameter post_max_size (%s). This is not a consistent setup. WarningParamUploadMaxFileSizeHigherThanPostMaxSize=Your PHP parameter upload_max_filesize (%s) is higher than PHP parameter post_max_size (%s). This is not a consistent setup.