lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch '12.0' of git@github.com:Dolibarr/dolibarr.git into develop

Browse Source 
Conflicts:
	htdocs/admin/tools/export_files.php
	test/phpunit/SecurityTest.php
This commit is contained in:
Laurent Destailleur 2020-12-11 15:56:19 +01:00
commit 1f6f434a9c
4 changed files with 31 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
htdocs/admin/tools/export_files.php
View File

@ -33,8 +33,8 @@ $langs->load("admin");
$action = GETPOST('action', 'aZ09');
$what = GETPOST('what', 'alpha');
$export_type = GETPOST('export_type', 'alpha');
$file = GETPOST('zipfilename_template', 'alpha');
$compression = GETPOST('compression');
$file = trim(GETPOST('zipfilename_template', 'alpha'));
$compression = GETPOST('compression', 'aZ09');
$file = dol_sanitizeFileName($file);
$file = preg_replace('/(\.zip|\.tar|\.tgz|\.gz|\.tar\.gz|\.bz2)$/i', '', $file);

4
htdocs/contrat/card.php
View File

@ -6,7 +6,7 @@
* Copyright (C) 2010-2017 Juanjo Menent <jmenent@2byte.es>
* Copyright (C) 2013 Christophe Battarel <christophe.battarel@altairis.fr>
* Copyright (C) 2013-2014 Florian Henry <florian.henry@open-concept.pro>
* Copyright (C) 2014-2018 Ferran Marcet <fmarcet@2byte.es>
* Copyright (C) 2014-2020 Ferran Marcet <fmarcet@2byte.es>
* Copyright (C) 2014-2016 Marcos García <marcosgdf@gmail.com>
* Copyright (C) 2015 Jean-François Ferry <jfefe@aternatik.fr>
* Copyright (C) 2018-2020 Frédéric France <frederic.france@netlogic.fr>
@ -2035,7 +2035,7 @@ if ($action == 'create')
// Send
if (empty($user->socid)) {
if ($object->statut == 1) {
if ((empty($conf->global->MAIN_USE_ADVANCED_PERMS) || $user->rights->commande->order_advance->send)) {
if ((empty($conf->global->MAIN_USE_ADVANCED_PERMS) || $user->rights->contrat->creer)) {
print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=presend&mode=init#formmailbeforetitle">'.$langs->trans('SendMail').'</a></div>';
} else print '<div class="inline-block divButAction"><a class="butActionRefused classfortooltip" href="#">'.$langs->trans('SendMail').'</a></div>';
}

5
htdocs/core/lib/functions.lib.php
View File

@ -931,8 +931,9 @@ function dol_sanitizeFileName($str, $newstr = '_', $unaccent = 1)
// List of special chars for filenames in windows are defined on page https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file
// Char '>' '<' '|' '$' and ';' are special chars for shells.
// Char '/' and '\' are file delimiters.
$filesystem_forbidden_chars = array('<', '>', '/', '\\', '?', '*', '|', '"', ':', '°', '$', ';');
return dol_string_nospecial($unaccent ?dol_string_unaccent($str) : $str, $newstr, $filesystem_forbidden_chars);
// -- car can be used into filename to inject special paramaters like --use-compress-program to make command with file as parameter making remote execution of command
$filesystem_forbidden_chars = array('<', '>', '/', '\\', '?', '*', '|', '"', ':', '°', '$', ';', '--');
return dol_string_nospecial($unaccent ? dol_string_unaccent($str) : $str, $newstr, $filesystem_forbidden_chars);
}
/**

25
test/phpunit/SecurityTest.php
View File

@ -376,7 +376,7 @@ class SecurityTest extends PHPUnit\Framework\TestCase
$login=checkLoginPassEntity('admin', 'admin', 1, array('dolibarr')); // Should works because admin/admin exists
print __METHOD__." login=".$login."\n";
$this->assertEquals($login, 'admin');
$this->assertEquals($login, 'admin', 'The test to check if pass of user "admin" is "admin" has failed');
$login=checkLoginPassEntity('admin', 'admin', 1, array('http','dolibarr')); // Should work because of second authetntication method
print __METHOD__." login=".$login."\n";
@ -553,4 +553,27 @@ class SecurityTest extends PHPUnit\Framework\TestCase
return 0;
}
/**
* testDolSanitizeFileName
*
* @return void
*/
public function testDolSanitizeFileName()
{
global $conf,$user,$langs,$db;
$conf=$this->savconf;
$user=$this->savuser;
$langs=$this->savlangs;
$db=$this->savdb;
//$dummyuser=new User($db);
//$result=restrictedArea($dummyuser,'societe');
$result=dol_sanitizeFileName('bad file | evilaction');
$this->assertEquals('bad file _ evilaction', $result);
$result=dol_sanitizeFileName('bad file --evilparam');
$this->assertEquals('bad file _evilparam', $result);
}
}