lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix phpunit

Browse Source
This commit is contained in:
Laurent Destailleur 2022-03-01 18:22:09 +01:00
parent 883f13b388
commit 3e1580475c
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/core/lib/functions.lib.php
View File

@ -8211,7 +8211,7 @@ function dol_eval($s, $returnvalue = 0, $hideerrors = 1, $onlysimplestring = '1'
// Test dangerous char (used for RCE), we allow only PHP variable testing. // Test dangerous char (used for RCE), we allow only PHP variable testing.
if ($onlysimplestring == '1') { if ($onlysimplestring == '1') {
//print preg_quote('$_->&|', '/'); //print preg_quote('$_->&|', '/');
if (preg_match('/[^a-z0-9\s'.preg_quote('$_->&|=', '/').']/i', $s)) { if (preg_match('/[^a-z0-9\s'.preg_quote('$_->&|=!?():"', '/').']/i', $s)) {
if ($returnvalue) { if ($returnvalue) {
return 'Bad string syntax to evaluate (found chars that are not chars for simplestring): '.$s; return 'Bad string syntax to evaluate (found chars that are not chars for simplestring): '.$s;
} else { } else {

4
test/phpunit/SecurityTest.php
View File

@ -910,12 +910,12 @@ class SecurityTest extends PHPUnit\Framework\TestCase
print "result = ".$result."\n"; print "result = ".$result."\n";
$this->assertContains('Bad string syntax to evaluate', $result); $this->assertContains('Bad string syntax to evaluate', $result);
$result=dol_eval("sprintf(\"%s%s\", \"ex\", \"ec\")('echo abc')", 1, 0, ''); $result=dol_eval("sprintf(\"%s%s\", \"ex\", \"ec\")('echo abc')", 1, 0);
print "result = ".$result."\n"; print "result = ".$result."\n";
$this->assertContains('Bad string syntax to evaluate', $result); $this->assertContains('Bad string syntax to evaluate', $result);
// Case with param onlysimplestring = 1 // Case with param onlysimplestring = 1
$result=dol_eval('1 && $conf->abc->doesnotexist1 && $conf->def->doesnotexist1', 1, 0); // Should return false and not a 'Bad string syntax to evaluate ...' $result=dol_eval('1 && getDolGlobalInt("doesnotexist1") && $conf->global->MAIN_FEATURES_LEVEL', 1, 0); // Should return false and not a 'Bad string syntax to evaluate ...'
print "result = ".$result."\n"; print "result = ".$result."\n";
$this->assertFalse($result); $this->assertFalse($result);