From e427496ddfb74cac094d828e53da808a61d0f774 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 9 Jul 2018 14:13:01 +0200 Subject: [PATCH 1/5] FIX Injection --- htdocs/core/class/html.form.class.php | 7 +++- htdocs/core/lib/functions.lib.php | 46 ++++++++++++++++++++++++++- 2 files changed, 51 insertions(+), 2 deletions(-) diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php index 03751120c7b..792ed58ab2b 100644 --- a/htdocs/core/class/html.form.class.php +++ b/htdocs/core/class/html.form.class.php @@ -190,7 +190,12 @@ class Form $morealt=' style="width: '.$cols.'"'; $cols=''; } - $ret.=''; + + $valuetoshow = ($editvalue?$editvalue:$value); + + $ret.=''; } else if ($typeofdata == 'day' || $typeofdata == 'datepicker') { diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index e6e3a240878..92ee1e11122 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -5014,7 +5014,7 @@ function picto_required() * @param string $pagecodeto Encoding of input/output string * @return string String cleaned * - * @see dol_escape_htmltag strip_tags + * @see dol_escape_htmltag strip_tags dol_string_onlythesehtmltags dol_string_neverthesehtmltags */ function dol_string_nohtmltag($stringtoclean,$removelinefeed=1,$pagecodeto='UTF-8') { @@ -5041,6 +5041,50 @@ function dol_string_nohtmltag($stringtoclean,$removelinefeed=1,$pagecodeto='UTF- return trim($temp); } +/** + * Clean a string to keep only desirable HTML tags. + * + * @param string $stringtoclean String to clean + * @return string String cleaned + * + * @see dol_escape_htmltag strip_tags dol_string_nohtmltag dol_string_neverthesehtmltags + */ +function dol_string_onlythesehtmltags($stringtoclean) +{ + $allowed_tags = array( + "html", "head", "meta", "body", "b", "br", "div", "em", "font", "img", "hr", "i", "li", "link", + "ol", "p", "s", "section", "span", "strong", "title", + "table", "tr", "th", "td", "u", "ul" + ); + + $allowed_tags_string = join("><", $allowed_tags); + $allowed_tags_string = preg_replace('/^>/','',$allowed_tags_string); + $allowed_tags_string = preg_replace('/<$/','',$allowed_tags_string); + + $temp = strip_tags($stringtoclean, $allowed_tags_string); + + return $temp; +} + +/** + * Clean a string from some undesirable HTML tags. + * + * @param string $stringtoclean String to clean + * @return string String cleaned + * + * @see dol_escape_htmltag strip_tags dol_string_nohtmltag dol_string_onlythesehtmltags + */ +function dol_string_neverthesehtmltags($stringtoclean, $disallowed_tags=array('textarea')) +{ + $temp = $stringtoclean; + foreach($disallowed_tags as $tagtoremove) + { + $temp = preg_replace('/<\/?'.$tagtoremove.'>/', '', $temp); + $temp = preg_replace('/<\/?'.$tagtoremove.'\s+[^>]*>/', '', $temp); + } + return $temp; +} + /** * Return first line of text. Cut will depends if content is HTML or not. From c33aaa076dd226701b5fc7f95c082c48b2b9e103 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 9 Jul 2018 14:35:22 +0200 Subject: [PATCH 2/5] FIX #8984 button create expense report --- htdocs/expensereport/list.php | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/htdocs/expensereport/list.php b/htdocs/expensereport/list.php index 053d293db83..5b633552380 100644 --- a/htdocs/expensereport/list.php +++ b/htdocs/expensereport/list.php @@ -310,8 +310,7 @@ if ($search_status != '' && $search_status >= 0) $sql.=" AND d.fk_statut IN (".$ if (empty($user->rights->expensereport->readall) && empty($user->rights->expensereport->lire_tous) && (empty($conf->global->MAIN_USE_ADVANCED_PERMS) || empty($user->rights->expensereport->writeall_advance))) { - $childids = $user->getAllChildIds(); - $childids[]=$user->id; + $childids = $user->getAllChildIds(1); $sql.= " AND d.fk_user_author IN (".join(',',$childids).")\n"; } // Add where from extra fields @@ -442,12 +441,15 @@ if ($resql) print ''.$langs->trans("Modify").''; } - $canedit=(($user->id == $user_id && $user->rights->expensereport->creer) || ($user->id != $user_id)); + $childids = $user->getAllChildIds(1); + + $canedit=((in_array($user_id, $childids) && $user->rights->expensereport->creer) + || ($conf->global->MAIN_USE_ADVANCED_PERMS && $user->rights->expensereport->writeall_advance)); // Boutons d'actions if ($canedit) { - print ''.$langs->trans("AddTrip").''; + print ''.$langs->trans("AddTrip").''; } print ''; From 8184eff66cf2de5d2d2eacb6e494b37de5406111 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 9 Jul 2018 15:25:14 +0200 Subject: [PATCH 3/5] Fix for #9079 --- htdocs/admin/const.php | 6 +++--- htdocs/admin/defaultvalues.php | 2 +- htdocs/admin/menus/edit.php | 2 +- htdocs/admin/system/dolibarr.php | 2 +- htdocs/admin/translation.php | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/htdocs/admin/const.php b/htdocs/admin/const.php index 7d7b8a8510c..c91caea435c 100644 --- a/htdocs/admin/const.php +++ b/htdocs/admin/const.php @@ -36,11 +36,11 @@ $rowid=GETPOST('rowid','int'); $entity=GETPOST('entity','int'); $action=GETPOST('action','alpha'); $update=GETPOST('update','alpha'); -$delete=GETPOST('delete'); // Do not use alpha here +$delete=GETPOST('delete','none'); // Do not use alpha here $debug=GETPOST('debug','int'); $consts=GETPOST('const','array'); $constname=GETPOST('constname','alpha'); -$constvalue=GETPOST('constvalue'); +$constvalue=GETPOST('constvalue','none'); // We shoul dbe able to send everything here $constnote=GETPOST('constnote','alpha'); @@ -247,7 +247,7 @@ if ($result) while ($i < $num) { $obj = $db->fetch_object($result); - + print "\n"; diff --git a/htdocs/admin/defaultvalues.php b/htdocs/admin/defaultvalues.php index 790445f7032..03c31180af3 100644 --- a/htdocs/admin/defaultvalues.php +++ b/htdocs/admin/defaultvalues.php @@ -38,7 +38,7 @@ if (!$user->admin) accessforbidden(); $id=GETPOST('rowid','int'); $action=GETPOST('action','alpha'); -$mode = GETPOST('mode')?GETPOST('mode'):'createform'; // 'createform', 'filters', 'sortorder', 'focus' +$mode = GETPOST('mode','aZ09')?GETPOST('mode','aZ09'):'createform'; // 'createform', 'filters', 'sortorder', 'focus' $limit = GETPOST('limit','int')?GETPOST('limit','int'):$conf->liste_limit; $sortfield = GETPOST("sortfield",'alpha'); diff --git a/htdocs/admin/menus/edit.php b/htdocs/admin/menus/edit.php index cd236d85122..191db98a402 100644 --- a/htdocs/admin/menus/edit.php +++ b/htdocs/admin/menus/edit.php @@ -89,7 +89,7 @@ if ($action == 'update') if ($result > 0) { $menu->titre=GETPOST('titre', 'alpha'); - $menu->leftmenu=GETPOST('leftmenu', 'alpha'); + $menu->leftmenu=GETPOST('leftmenu', 'aZ09'); $menu->url=GETPOST('url','alpha'); $menu->langs=GETPOST('langs','alpha'); $menu->position=GETPOST('position','int'); diff --git a/htdocs/admin/system/dolibarr.php b/htdocs/admin/system/dolibarr.php index c36db521f70..347ac3c0145 100644 --- a/htdocs/admin/system/dolibarr.php +++ b/htdocs/admin/system/dolibarr.php @@ -157,7 +157,7 @@ $i=0; foreach($_SESSION as $key => $val) { if ($i > 0) print ', '; - print $key.' => '.$val; + print $key.' => '.dol_escape_htmltag($val); $i++; } print ''."\n"; diff --git a/htdocs/admin/translation.php b/htdocs/admin/translation.php index 1999aab006c..4faf0cebe8a 100644 --- a/htdocs/admin/translation.php +++ b/htdocs/admin/translation.php @@ -39,7 +39,7 @@ $transkey=GETPOST('transkey','alpha'); $transvalue=GETPOST('transvalue','alpha'); -$mode = GETPOST('mode')?GETPOST('mode'):'overwrite'; +$mode = GETPOST('mode','aZ09')?GETPOST('mode','aZ09'):'overwrite'; $limit = GETPOST('limit','int')?GETPOST('limit','int'):$conf->liste_limit; $sortfield = GETPOST("sortfield",'alpha'); From 8e0a663b7c9611753f0ec7a2e4ee2fea3e0f17ae Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 10 Jul 2018 10:53:59 +0200 Subject: [PATCH 4/5] Code comment --- htdocs/core/lib/functions.lib.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 92ee1e11122..2cd5ab607ce 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -4090,7 +4090,7 @@ function price($amount, $form=0, $outlangs='', $trunc=1, $rounding=-1, $forcerou * 'MT'=Round to Max for totals with Tax (MAIN_MAX_DECIMALS_TOT) * 'MS'=Round to Max for stock quantity (MAIN_MAX_DECIMALS_STOCK) * @param int $alreadysqlnb Put 1 if you know that content is already universal format number - * @return string Amount with universal numeric format (Example: '99.99999') or unchanged text if conversion fails. + * @return string Amount with universal numeric format (Example: '99.99999') or unchanged text if conversion fails. If amount is null or '', it returns ''. * * @see price Opposite function of price2num */ From aeb5f5e4f3cfdef8f357eb6a87e08205e2fc108b Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 10 Jul 2018 13:56:03 +0200 Subject: [PATCH 5/5] Fix phpcs --- htdocs/core/lib/functions.lib.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 2cd5ab607ce..f5cef250060 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -276,7 +276,7 @@ function GETPOSTISSET($paramname) * @param string $noreplace Force disable of replacement of __xxx__ strings. * @return string|string[] Value found (string or array), or '' if check fails */ -function GETPOST($paramname, $check='none', $method=0, $filter=NULL, $options=NULL, $noreplace=0) +function GETPOST($paramname, $check='none', $method=0, $filter=null, $options=null, $noreplace=0) { global $mysoc,$user,$conf; @@ -5070,6 +5070,7 @@ function dol_string_onlythesehtmltags($stringtoclean) * Clean a string from some undesirable HTML tags. * * @param string $stringtoclean String to clean + * @param array $disallowed_tags Array of tags not allowed * @return string String cleaned * * @see dol_escape_htmltag strip_tags dol_string_nohtmltag dol_string_onlythesehtmltags @@ -6147,7 +6148,7 @@ function dol_sort_array(&$array, $index, $order='asc', $natsort=0, $case_sensiti else { ($case_sensitive) ? natsort($temp) : natcasesort($temp); - if($order!='asc') $temp=array_reverse($temp,TRUE); + if($order!='asc') $temp=array_reverse($temp,true); } $sorted = array();