From 3d97888bc57192e8ed2e1b1140e7700f79840921 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Fri, 14 Jan 2022 17:46:06 +0100 Subject: [PATCH 1/4] Comment --- htdocs/core/lib/functions.lib.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 5f945db12ff..e891904e39e 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -807,6 +807,8 @@ function checkVal($out = '', $check = 'alphanohtml', $filter = null, $options = // No need to use a loop here, this step is not to sanitize (this is done at next step, this is to try to save chars, even if they are // using a non coventionnel way to be encoded, to not have them sanitized just after) $out = preg_replace_callback('/&#(x?[0-9][0-9a-f]+;?)/i', 'realCharForNumericEntities', $out); + //$out = preg_replace_callback('/&#(x?[0-9][0-9a-f]+;?)/i', function ($m) { return realCharForNumericEntities($m); }, $out); + // Now we remove all remaining HTML entities starting with a number. We don't want such entities. $out = preg_replace('/&#x?[0-9]+/i', '', $out); // For example if we have javascript with an entities without the ; to hide the 'a' of 'javascript'. From 8e4c7efed512a23dad0f16611d4bcd6fe43624a0 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sat, 15 Jan 2022 20:53:16 +0100 Subject: [PATCH 2/4] Fix do not include file if url not correctly detected --- htdocs/main.inc.php | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php index 9753f4b3d83..f62d1d71585 100644 --- a/htdocs/main.inc.php +++ b/htdocs/main.inc.php @@ -1584,12 +1584,17 @@ function top_htmlhead($head, $title = '', $disablejs = 0, $disablehead = 0, $arr dol_syslog("Warning: module ".$modcss." declared a css path file into its descriptor that is empty.", LOG_WARNING); } // cssfile is a relative path - print ''."\n".''."\n"; + } else { + dol_syslog("Warning: module ".$modcss." declared a css path file for a file we can't find.", LOG_WARNING); } - print '">'."\n"; } } } @@ -1728,7 +1733,12 @@ function top_htmlhead($head, $title = '', $disablejs = 0, $disablehead = 0, $arr $filesjs = (array) $filesjs; // To be sure filejs is an array foreach ($filesjs as $jsfile) { // jsfile is a relative path - print ''."\n".''."\n"; + $urlforjs = dol_buildpath($jsfile, 1); + if ($urlforjs) { + print ''."\n".''."\n"; + } else { + dol_syslog("Warning: module ".$modjs." declared a js path file for a file we can't find.", LOG_WARNING); + } } } } From 22ab3c03a1589a91ee3e4873935891a47ad1f41a Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 17 Jan 2022 09:12:09 +0100 Subject: [PATCH 3/4] Fix another way to write the preg_replace_callback --- htdocs/core/lib/functions.lib.php | 5 +++-- htdocs/main.inc.php | 4 +++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 5004a42084c..126b69c233e 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -828,8 +828,9 @@ function checkVal($out = '', $check = 'alphanohtml', $filter = null, $options = // We replace chars from a/A to z/Z encoded with numeric HTML entities with the real char so we won't loose the chars at the next step (preg_replace). // No need to use a loop here, this step is not to sanitize (this is done at next step, this is to try to save chars, even if they are // using a non coventionnel way to be encoded, to not have them sanitized just after) - $out = preg_replace_callback('/&#(x?[0-9][0-9a-f]+;?)/i', 'realCharForNumericEntities', $out); - //$out = preg_replace_callback('/&#(x?[0-9][0-9a-f]+;?)/i', function ($m) { return realCharForNumericEntities($m); }, $out); + //$out = preg_replace_callback('/&#(x?[0-9][0-9a-f]+;?)/i', 'realCharForNumericEntities', $out); + $out = preg_replace_callback('/&#(x?[0-9][0-9a-f]+;?)/i', function ($m) { + return realCharForNumericEntities($m); }, $out); // Now we remove all remaining HTML entities starting with a number. We don't want such entities. diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php index 4280634c7dd..f54d4e0dbaa 100644 --- a/htdocs/main.inc.php +++ b/htdocs/main.inc.php @@ -94,7 +94,9 @@ function testSqlAndScriptInject($val, $type) do { $oldval = $val; $val = html_entity_decode($val, ENT_QUOTES | ENT_HTML5); - $val = preg_replace_callback('/&#(x?[0-9][0-9a-f]+)/i', 'realCharForNumericEntities', $val); // Sometimes we have entities without the ; at end so html_entity_decode does not work but entities is still interpreted by browser. + //$val = preg_replace_callback('/&#(x?[0-9][0-9a-f]+;?)/i', 'realCharForNumericEntities', $val); // Sometimes we have entities without the ; at end so html_entity_decode does not work but entities is still interpreted by browser. + $val = preg_replace_callback('/&#(x?[0-9][0-9a-f]+;?)/i', function ($m) { + return realCharForNumericEntities($m); }, $val); } while ($oldval != $val); //print "after decoding $val\n"; From 7034ddf0630cebc64af5b202a63d40457587de9d Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 17 Jan 2022 13:56:32 +0100 Subject: [PATCH 4/4] Freemono instead of freeserif --- htdocs/langs/ta_IN/main.lang | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/langs/ta_IN/main.lang b/htdocs/langs/ta_IN/main.lang index f95493447e9..b61756b95b0 100644 --- a/htdocs/langs/ta_IN/main.lang +++ b/htdocs/langs/ta_IN/main.lang @@ -4,7 +4,7 @@ DIRECTION=ltr # msungstdlight or cid0ct are for traditional Chinese (traditional does not render with Ubuntu pdf reader) # stsongstdlight or cid0cs are for simplified Chinese # To read Chinese pdf with Linux: sudo apt-get install poppler-data -FONTFORPDF=freeserif +FONTFORPDF=freemono FONTSIZEFORPDF=10 SeparatorDecimal=. SeparatorThousand=,