From 45c9e6064eb5ec0e818180f58a19adaa10082748 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 12 Sep 2022 12:22:00 +0200 Subject: [PATCH] FIX #yogosha12439 Remove define('NOCSRFCHECK', '1') --- htdocs/asterisk/wrapper.php | 4 -- htdocs/core/ajax/ajaxcompanies.php | 1 - htdocs/core/ajax/check_notifications.php | 3 - htdocs/core/ajax/fetchKnowledgeRecord.php | 3 - htdocs/core/ajax/fileupload.php | 3 - htdocs/core/ajax/locationincoterms.php | 3 - htdocs/core/ajax/onlineSign.php | 3 - htdocs/core/ajax/selectobject.php | 3 - htdocs/core/ajax/ziptown.php | 3 - .../conferenceorboothattendee_note.php | 1 - htdocs/hrm/position.php | 1 - .../modulebuilder/template/ajax/myobject.php | 68 +++++++++++++++++++ .../template/myobject_agenda.php | 1 - .../modulebuilder/template/myobject_card.php | 1 - .../template/myobject_document.php | 1 - .../modulebuilder/template/myobject_list.php | 1 - .../modulebuilder/template/myobject_note.php | 1 - .../template/scripts/mymodule.php | 1 - htdocs/projet/ajax/projects.php | 5 +- htdocs/public/demo/index.php | 3 - htdocs/public/donations/donateurs_code.php | 3 - htdocs/public/test/test_arrays.php | 6 -- htdocs/public/test/test_csrf.php | 6 -- htdocs/public/test/test_exec.php | 6 -- htdocs/public/test/test_sessionlock.php | 6 -- htdocs/public/ticket/ajax/ajax.php | 3 - htdocs/takepos/admin/orderprinters.php | 3 + htdocs/takepos/admin/other.php | 1 - htdocs/takepos/floors.php | 5 +- htdocs/takepos/freezone.php | 2 +- htdocs/takepos/index.php | 33 ++++----- htdocs/takepos/invoice.php | 6 +- htdocs/takepos/pay.php | 22 +++--- htdocs/takepos/phone.php | 20 +++--- htdocs/takepos/printbox.php | 2 +- htdocs/takepos/reduction.php | 4 +- htdocs/takepos/send.php | 2 +- htdocs/takepos/split.php | 2 +- htdocs/theme/eldy/manifest.json.php | 3 - htdocs/theme/md/manifest.json.php | 3 - 40 files changed, 121 insertions(+), 127 deletions(-) create mode 100644 htdocs/modulebuilder/template/ajax/myobject.php diff --git a/htdocs/asterisk/wrapper.php b/htdocs/asterisk/wrapper.php index 7313fdfd2d5..2f5096f6436 100644 --- a/htdocs/asterisk/wrapper.php +++ b/htdocs/asterisk/wrapper.php @@ -34,9 +34,6 @@ if (!defined('NOREQUIRESOC')) { if (!defined('NOREQUIRETRAN')) { define('NOREQUIRETRAN', '1'); } -if (!defined('NOCSRFCHECK')) { - define('NOCSRFCHECK', '1'); -} if (!defined('NOTOKENRENEWAL')) { define('NOTOKENRENEWAL', '1'); } @@ -75,7 +72,6 @@ function llxFooter() print "\n".''."\n"; } - require_once '../main.inc.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/functions.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php'; diff --git a/htdocs/core/ajax/ajaxcompanies.php b/htdocs/core/ajax/ajaxcompanies.php index 9f135d8cb42..ef0d7303715 100644 --- a/htdocs/core/ajax/ajaxcompanies.php +++ b/htdocs/core/ajax/ajaxcompanies.php @@ -28,7 +28,6 @@ if (!defined('NOREQUIREMENU')) define('NOREQUIREMENU', '1'); if (!defined('NOREQUIREHTML')) define('NOREQUIREHTML', '1'); if (!defined('NOREQUIREAJAX')) define('NOREQUIREAJAX', '1'); if (!defined('NOREQUIRESOC')) define('NOREQUIRESOC', '1'); -if (!defined('NOCSRFCHECK')) define('NOCSRFCHECK', '1'); // Load Dolibarr environment require '../../main.inc.php'; diff --git a/htdocs/core/ajax/check_notifications.php b/htdocs/core/ajax/check_notifications.php index df2db07d0ab..f48cb9bffe5 100644 --- a/htdocs/core/ajax/check_notifications.php +++ b/htdocs/core/ajax/check_notifications.php @@ -17,9 +17,6 @@ * along with this program. If not, see . */ -if (!defined('NOCSRFCHECK')) { - define('NOCSRFCHECK', '1'); -} if (!defined('NOTOKENRENEWAL')) { define('NOTOKENRENEWAL', '1'); // Do not roll the Anti CSRF token (used if MAIN_SECURITY_CSRF_WITH_TOKEN is on) } diff --git a/htdocs/core/ajax/fetchKnowledgeRecord.php b/htdocs/core/ajax/fetchKnowledgeRecord.php index 179d8169465..1816217cdef 100644 --- a/htdocs/core/ajax/fetchKnowledgeRecord.php +++ b/htdocs/core/ajax/fetchKnowledgeRecord.php @@ -31,9 +31,6 @@ if (!defined('NOREQUIREAJAX')) { if (!defined('NOREQUIRESOC')) { define('NOREQUIRESOC', '1'); } -if (!defined('NOCSRFCHECK')) { - define('NOCSRFCHECK', '1'); -} // Do not check anti CSRF attack test if (!defined('NOREQUIREMENU')) { define('NOREQUIREMENU', '1'); diff --git a/htdocs/core/ajax/fileupload.php b/htdocs/core/ajax/fileupload.php index 0f6fac32338..67f95700976 100644 --- a/htdocs/core/ajax/fileupload.php +++ b/htdocs/core/ajax/fileupload.php @@ -21,9 +21,6 @@ * \brief File to return Ajax response on file upload */ -if (!defined('NOCSRFCHECK')) { - define('NOCSRFCHECK', '1'); -} if (!defined('NOTOKENRENEWAL')) { define('NOTOKENRENEWAL', '1'); } diff --git a/htdocs/core/ajax/locationincoterms.php b/htdocs/core/ajax/locationincoterms.php index 34a7459c972..057322ec5fb 100644 --- a/htdocs/core/ajax/locationincoterms.php +++ b/htdocs/core/ajax/locationincoterms.php @@ -38,9 +38,6 @@ if (!defined('NOREQUIREAJAX')) { if (!defined('NOREQUIRESOC')) { define('NOREQUIRESOC', '1'); } -if (!defined('NOCSRFCHECK')) { - define('NOCSRFCHECK', '1'); -} // Load Dolibarr environment require '../../main.inc.php'; diff --git a/htdocs/core/ajax/onlineSign.php b/htdocs/core/ajax/onlineSign.php index f3a82783a2b..53eaf69aea1 100644 --- a/htdocs/core/ajax/onlineSign.php +++ b/htdocs/core/ajax/onlineSign.php @@ -31,9 +31,6 @@ if (!defined('NOREQUIREAJAX')) { if (!defined('NOREQUIRESOC')) { define('NOREQUIRESOC', '1'); } -if (!defined('NOCSRFCHECK')) { - define('NOCSRFCHECK', '1'); -} // Do not check anti CSRF attack test if (!defined('NOREQUIREMENU')) { define('NOREQUIREMENU', '1'); diff --git a/htdocs/core/ajax/selectobject.php b/htdocs/core/ajax/selectobject.php index 1028ad69db4..31bc791dc10 100644 --- a/htdocs/core/ajax/selectobject.php +++ b/htdocs/core/ajax/selectobject.php @@ -35,9 +35,6 @@ if (!defined('NOREQUIREAJAX')) { if (!defined('NOREQUIRESOC')) { define('NOREQUIRESOC', '1'); } -if (!defined('NOCSRFCHECK')) { - define('NOCSRFCHECK', '1'); -} // Load Dolibarr environment require '../../main.inc.php'; diff --git a/htdocs/core/ajax/ziptown.php b/htdocs/core/ajax/ziptown.php index 6452bcec884..f6869e9ffcf 100644 --- a/htdocs/core/ajax/ziptown.php +++ b/htdocs/core/ajax/ziptown.php @@ -37,9 +37,6 @@ if (!defined('NOREQUIREAJAX')) { if (!defined('NOREQUIRESOC')) { define('NOREQUIRESOC', '1'); } -if (!defined('NOCSRFCHECK')) { - define('NOCSRFCHECK', '1'); -} // Load Dolibarr environment require '../../main.inc.php'; diff --git a/htdocs/eventorganization/conferenceorboothattendee_note.php b/htdocs/eventorganization/conferenceorboothattendee_note.php index adc4a1683b8..ea186041602 100644 --- a/htdocs/eventorganization/conferenceorboothattendee_note.php +++ b/htdocs/eventorganization/conferenceorboothattendee_note.php @@ -28,7 +28,6 @@ //if (! defined('NOREQUIRETRAN')) define('NOREQUIRETRAN', '1'); // Do not load object $langs //if (! defined('NOSCANGETFORINJECTION')) define('NOSCANGETFORINJECTION', '1'); // Do not check injection attack on GET parameters //if (! defined('NOSCANPOSTFORINJECTION')) define('NOSCANPOSTFORINJECTION', '1'); // Do not check injection attack on POST parameters -//if (! defined('NOCSRFCHECK')) define('NOCSRFCHECK', '1'); // Do not check CSRF attack (test on referer + on token if option MAIN_SECURITY_CSRF_WITH_TOKEN is on). //if (! defined('NOTOKENRENEWAL')) define('NOTOKENRENEWAL', '1'); // Do not roll the Anti CSRF token (used if MAIN_SECURITY_CSRF_WITH_TOKEN is on) //if (! defined('NOSTYLECHECK')) define('NOSTYLECHECK', '1'); // Do not check style html tag into posted data //if (! defined('NOREQUIREMENU')) define('NOREQUIREMENU', '1'); // If there is no need to load and show top and left menu diff --git a/htdocs/hrm/position.php b/htdocs/hrm/position.php index 24ce9ec3b51..7a1114ac4a0 100644 --- a/htdocs/hrm/position.php +++ b/htdocs/hrm/position.php @@ -31,7 +31,6 @@ //if (! defined('NOREQUIRETRAN')) define('NOREQUIRETRAN', '1'); // Do not load object $langs //if (! defined('NOSCANGETFORINJECTION')) define('NOSCANGETFORINJECTION', '1'); // Do not check injection attack on GET parameters //if (! defined('NOSCANPOSTFORINJECTION')) define('NOSCANPOSTFORINJECTION', '1'); // Do not check injection attack on POST parameters -//if (! defined('NOCSRFCHECK')) define('NOCSRFCHECK', '1'); // Do not check CSRF attack (test on referer + on token if option MAIN_SECURITY_CSRF_WITH_TOKEN is on). //if (! defined('NOTOKENRENEWAL')) define('NOTOKENRENEWAL', '1'); // Do not roll the Anti CSRF token (used if MAIN_SECURITY_CSRF_WITH_TOKEN is on) //if (! defined('NOSTYLECHECK')) define('NOSTYLECHECK', '1'); // Do not check style html tag into posted data //if (! defined('NOREQUIREMENU')) define('NOREQUIREMENU', '1'); // If there is no need to load and show top and left menu diff --git a/htdocs/modulebuilder/template/ajax/myobject.php b/htdocs/modulebuilder/template/ajax/myobject.php new file mode 100644 index 00000000000..3e22eb25f22 --- /dev/null +++ b/htdocs/modulebuilder/template/ajax/myobject.php @@ -0,0 +1,68 @@ + + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ + +/** + * \file htdocs/mymodule/ajax/myobject.php + * \brief File to return Ajax response on product list request + */ + +if (!defined('NOTOKENRENEWAL')) { + define('NOTOKENRENEWAL', 1); // Disables token renewal +} +if (!defined('NOREQUIREMENU')) { + define('NOREQUIREMENU', '1'); +} +if (!defined('NOREQUIREHTML')) { + define('NOREQUIREHTML', '1'); +} +if (!defined('NOREQUIREAJAX')) { + define('NOREQUIREAJAX', '1'); +} +if (!defined('NOREQUIRESOC')) { + define('NOREQUIRESOC', '1'); +} +if (!defined('NOCSRFCHECK')) { + define('NOCSRFCHECK', '1'); +} +if (!defined('NOREQUIREHTML')) { + define('NOREQUIREHTML', '1'); +} + +// Load Dolibarr environment +require '../../main.inc.php'; + +$mode = GETPOST('mode', 'aZ09'); + +// Security check +restrictedArea($user, 'mymodule', 0, 'myobject'); + + +/* + * View + */ + +dol_syslog("Call ajax mymodule/ajax/myobject.php"); + +top_httphead('application/json'); + +$arrayresult = array(); + +// .... + +$db->close(); + +print json_encode($arrayresult); diff --git a/htdocs/modulebuilder/template/myobject_agenda.php b/htdocs/modulebuilder/template/myobject_agenda.php index 0a397dceaa6..f0d7ffa1439 100644 --- a/htdocs/modulebuilder/template/myobject_agenda.php +++ b/htdocs/modulebuilder/template/myobject_agenda.php @@ -28,7 +28,6 @@ //if (! defined('NOREQUIRETRAN')) define('NOREQUIRETRAN', '1'); // Do not load object $langs //if (! defined('NOSCANGETFORINJECTION')) define('NOSCANGETFORINJECTION', '1'); // Do not check injection attack on GET parameters //if (! defined('NOSCANPOSTFORINJECTION')) define('NOSCANPOSTFORINJECTION', '1'); // Do not check injection attack on POST parameters -//if (! defined('NOCSRFCHECK')) define('NOCSRFCHECK', '1'); // Do not check CSRF attack (test on referer + on token if option MAIN_SECURITY_CSRF_WITH_TOKEN is on). //if (! defined('NOTOKENRENEWAL')) define('NOTOKENRENEWAL', '1'); // Do not roll the Anti CSRF token (used if MAIN_SECURITY_CSRF_WITH_TOKEN is on) //if (! defined('NOSTYLECHECK')) define('NOSTYLECHECK', '1'); // Do not check style html tag into posted data //if (! defined('NOREQUIREMENU')) define('NOREQUIREMENU', '1'); // If there is no need to load and show top and left menu diff --git a/htdocs/modulebuilder/template/myobject_card.php b/htdocs/modulebuilder/template/myobject_card.php index aa2680ea568..4bc0b797b47 100644 --- a/htdocs/modulebuilder/template/myobject_card.php +++ b/htdocs/modulebuilder/template/myobject_card.php @@ -28,7 +28,6 @@ //if (! defined('NOREQUIRETRAN')) define('NOREQUIRETRAN', '1'); // Do not load object $langs //if (! defined('NOSCANGETFORINJECTION')) define('NOSCANGETFORINJECTION', '1'); // Do not check injection attack on GET parameters //if (! defined('NOSCANPOSTFORINJECTION')) define('NOSCANPOSTFORINJECTION', '1'); // Do not check injection attack on POST parameters -//if (! defined('NOCSRFCHECK')) define('NOCSRFCHECK', '1'); // Do not check CSRF attack (test on referer + on token). //if (! defined('NOTOKENRENEWAL')) define('NOTOKENRENEWAL', '1'); // Do not roll the Anti CSRF token (used if MAIN_SECURITY_CSRF_WITH_TOKEN is on) //if (! defined('NOSTYLECHECK')) define('NOSTYLECHECK', '1'); // Do not check style html tag into posted data //if (! defined('NOREQUIREMENU')) define('NOREQUIREMENU', '1'); // If there is no need to load and show top and left menu diff --git a/htdocs/modulebuilder/template/myobject_document.php b/htdocs/modulebuilder/template/myobject_document.php index 4a4b68391bc..6aed7382b7d 100644 --- a/htdocs/modulebuilder/template/myobject_document.php +++ b/htdocs/modulebuilder/template/myobject_document.php @@ -28,7 +28,6 @@ //if (! defined('NOREQUIRETRAN')) define('NOREQUIRETRAN', '1'); // Do not load object $langs //if (! defined('NOSCANGETFORINJECTION')) define('NOSCANGETFORINJECTION', '1'); // Do not check injection attack on GET parameters //if (! defined('NOSCANPOSTFORINJECTION')) define('NOSCANPOSTFORINJECTION', '1'); // Do not check injection attack on POST parameters -//if (! defined('NOCSRFCHECK')) define('NOCSRFCHECK', '1'); // Do not check CSRF attack (test on referer + on token if option MAIN_SECURITY_CSRF_WITH_TOKEN is on). //if (! defined('NOTOKENRENEWAL')) define('NOTOKENRENEWAL', '1'); // Do not roll the Anti CSRF token (used if MAIN_SECURITY_CSRF_WITH_TOKEN is on) //if (! defined('NOSTYLECHECK')) define('NOSTYLECHECK', '1'); // Do not check style html tag into posted data //if (! defined('NOREQUIREMENU')) define('NOREQUIREMENU', '1'); // If there is no need to load and show top and left menu diff --git a/htdocs/modulebuilder/template/myobject_list.php b/htdocs/modulebuilder/template/myobject_list.php index 789a5d2312d..276e709019d 100644 --- a/htdocs/modulebuilder/template/myobject_list.php +++ b/htdocs/modulebuilder/template/myobject_list.php @@ -28,7 +28,6 @@ //if (! defined('NOREQUIRETRAN')) define('NOREQUIRETRAN', '1'); // Do not load object $langs //if (! defined('NOSCANGETFORINJECTION')) define('NOSCANGETFORINJECTION', '1'); // Do not check injection attack on GET parameters //if (! defined('NOSCANPOSTFORINJECTION')) define('NOSCANPOSTFORINJECTION', '1'); // Do not check injection attack on POST parameters -//if (! defined('NOCSRFCHECK')) define('NOCSRFCHECK', '1'); // Do not check CSRF attack (test on referer + on token if option MAIN_SECURITY_CSRF_WITH_TOKEN is on). //if (! defined('NOTOKENRENEWAL')) define('NOTOKENRENEWAL', '1'); // Do not roll the Anti CSRF token (used if MAIN_SECURITY_CSRF_WITH_TOKEN is on) //if (! defined('NOSTYLECHECK')) define('NOSTYLECHECK', '1'); // Do not check style html tag into posted data //if (! defined('NOREQUIREMENU')) define('NOREQUIREMENU', '1'); // If there is no need to load and show top and left menu diff --git a/htdocs/modulebuilder/template/myobject_note.php b/htdocs/modulebuilder/template/myobject_note.php index e97d131551a..f7859cfb217 100644 --- a/htdocs/modulebuilder/template/myobject_note.php +++ b/htdocs/modulebuilder/template/myobject_note.php @@ -28,7 +28,6 @@ //if (! defined('NOREQUIRETRAN')) define('NOREQUIRETRAN', '1'); // Do not load object $langs //if (! defined('NOSCANGETFORINJECTION')) define('NOSCANGETFORINJECTION', '1'); // Do not check injection attack on GET parameters //if (! defined('NOSCANPOSTFORINJECTION')) define('NOSCANPOSTFORINJECTION', '1'); // Do not check injection attack on POST parameters -//if (! defined('NOCSRFCHECK')) define('NOCSRFCHECK', '1'); // Do not check CSRF attack (test on referer + on token if option MAIN_SECURITY_CSRF_WITH_TOKEN is on). //if (! defined('NOTOKENRENEWAL')) define('NOTOKENRENEWAL', '1'); // Do not roll the Anti CSRF token (used if MAIN_SECURITY_CSRF_WITH_TOKEN is on) //if (! defined('NOSTYLECHECK')) define('NOSTYLECHECK', '1'); // Do not check style html tag into posted data //if (! defined('NOREQUIREMENU')) define('NOREQUIREMENU', '1'); // If there is no need to load and show top and left menu diff --git a/htdocs/modulebuilder/template/scripts/mymodule.php b/htdocs/modulebuilder/template/scripts/mymodule.php index 2d9b3aac79c..e335eb0ea46 100644 --- a/htdocs/modulebuilder/template/scripts/mymodule.php +++ b/htdocs/modulebuilder/template/scripts/mymodule.php @@ -29,7 +29,6 @@ //if (! defined('NOREQUIRETRAN')) define('NOREQUIRETRAN', '1'); // Do not load object $langs //if (! defined('NOSCANGETFORINJECTION')) define('NOSCANGETFORINJECTION', '1'); // Do not check injection attack on GET parameters //if (! defined('NOSCANPOSTFORINJECTION')) define('NOSCANPOSTFORINJECTION', '1'); // Do not check injection attack on POST parameters -//if (! defined('NOCSRFCHECK')) define('NOCSRFCHECK', '1'); // Do not check CSRF attack (test on referer + on token if option MAIN_SECURITY_CSRF_WITH_TOKEN is on). //if (! defined('NOTOKENRENEWAL')) define('NOTOKENRENEWAL', '1'); // Do not roll the Anti CSRF token (used if MAIN_SECURITY_CSRF_WITH_TOKEN is on) //if (! defined('NOSTYLECHECK')) define('NOSTYLECHECK', '1'); // Do not check style html tag into posted data //if (! defined('NOREQUIREMENU')) define('NOREQUIREMENU', '1'); // If there is no need to load and show top and left menu diff --git a/htdocs/projet/ajax/projects.php b/htdocs/projet/ajax/projects.php index e9e8f85ddf3..03d118dc9b9 100644 --- a/htdocs/projet/ajax/projects.php +++ b/htdocs/projet/ajax/projects.php @@ -38,9 +38,6 @@ if (!defined('NOREQUIREAJAX')) { if (!defined('NOREQUIRESOC')) { define('NOREQUIRESOC', '1'); } -if (!defined('NOCSRFCHECK')) { - define('NOCSRFCHECK', '1'); -} if (!defined('NOREQUIREHTML')) { define('NOREQUIREHTML', '1'); } @@ -65,7 +62,7 @@ dol_syslog("Call ajax projet/ajax/projects.php"); require_once DOL_DOCUMENT_ROOT.'/core/class/html.formprojet.class.php'; -top_httphead(); +top_httphead('application/json'); if (empty($htmlname) && !GETPOST('mode', 'aZ09')) { return; diff --git a/htdocs/public/demo/index.php b/htdocs/public/demo/index.php index 2762a57eced..f7274d5b06b 100644 --- a/htdocs/public/demo/index.php +++ b/htdocs/public/demo/index.php @@ -27,9 +27,6 @@ if (!defined('NOLOGIN')) { define('NOLOGIN', '1'); } -if (!defined('NOCSRFCHECK')) { - define('NOCSRFCHECK', '1'); -} if (!defined('NOBROWSERNOTIF')) { define('NOBROWSERNOTIF', 1); } diff --git a/htdocs/public/donations/donateurs_code.php b/htdocs/public/donations/donateurs_code.php index 5fb3798f428..4acbaa5a256 100644 --- a/htdocs/public/donations/donateurs_code.php +++ b/htdocs/public/donations/donateurs_code.php @@ -25,9 +25,6 @@ if (!defined('NOLOGIN')) { define('NOLOGIN', '1'); } -if (!defined('NOCSRFCHECK')) { - define('NOCSRFCHECK', '1'); -} if (!defined('NOBROWSERNOTIF')) { define('NOBROWSERNOTIF', '1'); } diff --git a/htdocs/public/test/test_arrays.php b/htdocs/public/test/test_arrays.php index 15f54b646a5..693b7eed59d 100644 --- a/htdocs/public/test/test_arrays.php +++ b/htdocs/public/test/test_arrays.php @@ -9,12 +9,6 @@ if (!defined('NOREQUIRESOC')) { if (!defined('NOSTYLECHECK')) { define('NOSTYLECHECK', '1'); // Do not check style html tag into posted data } -if (!defined('NOCSRFCHECK')) { - define('NOCSRFCHECK', '1'); // Do not check anti CSRF attack test -} -if (!defined('NOTOKENRENEWAL')) { - define('NOTOKENRENEWAL', '1'); // Do not check anti POST attack test -} //if (!defined('NOREQUIREMENU')) define('NOREQUIREMENU', '1'); // If there is no need to load and show top and left menu //if (!defined('NOREQUIREHTML')) define('NOREQUIREHTML', '1'); // If we don't need to load the html.form.class.php //if (!defined('NOREQUIREAJAX')) define('NOREQUIREAJAX', '1'); // Do not load ajax.lib.php library diff --git a/htdocs/public/test/test_csrf.php b/htdocs/public/test/test_csrf.php index eb2527bb62d..6bb9679d404 100644 --- a/htdocs/public/test/test_csrf.php +++ b/htdocs/public/test/test_csrf.php @@ -9,12 +9,6 @@ if (!defined('NOREQUIRESOC')) { if (!defined('NOSTYLECHECK')) { define('NOSTYLECHECK', '1'); // Do not check style html tag into posted data } -if (!defined('NOCSRFCHECK')) { - define('NOCSRFCHECK', '1'); // Do not check anti CSRF attack test -} -if (!defined('NOTOKENRENEWAL')) { - define('NOTOKENRENEWAL', '1'); // Do not check anti POST attack test -} //if (!defined('NOREQUIREMENU')) define('NOREQUIREMENU', '1'); // If there is no need to load and show top and left menu //if (!defined('NOREQUIREHTML')) define('NOREQUIREHTML', '1'); // If we don't need to load the html.form.class.php //if (!defined('NOREQUIREAJAX')) define('NOREQUIREAJAX', '1'); // Do not load ajax.lib.php library diff --git a/htdocs/public/test/test_exec.php b/htdocs/public/test/test_exec.php index 59259d0ac49..1c477c31295 100644 --- a/htdocs/public/test/test_exec.php +++ b/htdocs/public/test/test_exec.php @@ -14,12 +14,6 @@ if (!defined('NOREQUIRETRAN')) { if (!defined('NOSTYLECHECK')) { define('NOSTYLECHECK', '1'); // Do not check style html tag into posted data } -if (!defined('NOCSRFCHECK')) { - define('NOCSRFCHECK', '1'); // Do not check anti CSRF attack test -} -if (!defined('NOTOKENRENEWAL')) { - define('NOTOKENRENEWAL', '1'); // Do not check anti POST attack test -} if (!defined('NOREQUIREMENU')) { define('NOREQUIREMENU', '1'); // If there is no need to load and show top and left menu } diff --git a/htdocs/public/test/test_sessionlock.php b/htdocs/public/test/test_sessionlock.php index ce764d5daed..6e022358ba2 100644 --- a/htdocs/public/test/test_sessionlock.php +++ b/htdocs/public/test/test_sessionlock.php @@ -14,12 +14,6 @@ if (!defined('NOREQUIRETRAN')) { if (!defined('NOSTYLECHECK')) { define('NOSTYLECHECK', '1'); // Do not check style html tag into posted data } -if (!defined('NOCSRFCHECK')) { - define('NOCSRFCHECK', '1'); // Do not check anti CSRF attack test -} -if (!defined('NOTOKENRENEWAL')) { - define('NOTOKENRENEWAL', '1'); // Do not check anti POST attack test -} if (!defined('NOREQUIREMENU')) { define('NOREQUIREMENU', '1'); // If there is no need to load and show top and left menu } diff --git a/htdocs/public/ticket/ajax/ajax.php b/htdocs/public/ticket/ajax/ajax.php index a75c796539c..2b637ce3647 100644 --- a/htdocs/public/ticket/ajax/ajax.php +++ b/htdocs/public/ticket/ajax/ajax.php @@ -33,9 +33,6 @@ if (!defined('NOREQUIREAJAX')) { if (!defined('NOREQUIRESOC')) { define('NOREQUIRESOC', '1'); } -if (!defined('NOCSRFCHECK')) { - define('NOCSRFCHECK', '1'); -} // Do not check anti CSRF attack test if (!defined('NOREQUIREMENU')) { define('NOREQUIREMENU', '1'); diff --git a/htdocs/takepos/admin/orderprinters.php b/htdocs/takepos/admin/orderprinters.php index f01f3d4de66..2b4ac9e594c 100644 --- a/htdocs/takepos/admin/orderprinters.php +++ b/htdocs/takepos/admin/orderprinters.php @@ -175,6 +175,7 @@ print ''.$langs->trans("Printer").' 1< print ''; $nbofentries = (count($data) - 1); print '
'; +print ''; if ($nbofentries > 0) { print ''; print ''; @@ -208,6 +209,7 @@ print ''.$langs->trans("Printer").' 2< print ''; $nbofentries = (count($data) - 1); print ''; +print ''; if ($nbofentries > 0) { print ''; print ''; @@ -241,6 +243,7 @@ print ''.$langs->trans("Printer").' 3< print ''; $nbofentries = (count($data) - 1); print ''; +print ''; if ($nbofentries > 0) { print ''; print ''; diff --git a/htdocs/takepos/admin/other.php b/htdocs/takepos/admin/other.php index 6200fce8768..7f07b214085 100644 --- a/htdocs/takepos/admin/other.php +++ b/htdocs/takepos/admin/other.php @@ -82,7 +82,6 @@ print ''; print ''; print ''; - print '
'; // Marketplace diff --git a/htdocs/takepos/floors.php b/htdocs/takepos/floors.php index 01f022a94cd..85aab47528f 100644 --- a/htdocs/takepos/floors.php +++ b/htdocs/takepos/floors.php @@ -25,9 +25,6 @@ //if (! defined('NOREQUIREDB')) define('NOREQUIREDB','1'); // Not disabled cause need to load personalized language //if (! defined('NOREQUIRESOC')) define('NOREQUIRESOC','1'); //if (! defined('NOREQUIRETRAN')) define('NOREQUIRETRAN','1'); -if (!defined('NOTOKENRENEWAL')) { - define('NOTOKENRENEWAL', '1'); -} if (!defined('NOREQUIREMENU')) { define('NOREQUIREMENU', '1'); } @@ -182,7 +179,7 @@ function LoadPlace(place){ $( document ).ready(function() { - $.getJSON('./floors.php?action=getTables&floor=', function(data) { + $.getJSON('./floors.php?action=getTables&token=&floor=', function(data) { $.each(data, function(key, val) { $('body').append('
'+val.label+'
'); diff --git a/htdocs/takepos/freezone.php b/htdocs/takepos/freezone.php index 2402c24acca..e1b24ec286d 100644 --- a/htdocs/takepos/freezone.php +++ b/htdocs/takepos/freezone.php @@ -109,7 +109,7 @@ top_htmlhead($head, '', 0, 0, $arrayofjs, $arrayofcss); */ function Save() { console.log("We click so we call page invoice.php with place= tva_tx="+vatRate); - parent.$("#poslines").load("invoice.php?action=freezone&place=&number="+$('#number').val()+"&tva_tx="+vatRate, {desc:$('#desc').val()}); + parent.$("#poslines").load("invoice.php?action=freezone&token=&place=&number="+$('#number').val()+"&tva_tx="+vatRate, {desc:$('#desc').val()}); parent.$.colorbox.close(); } diff --git a/htdocs/takepos/index.php b/htdocs/takepos/index.php index e612d4cd8ee..5e1bd1350fb 100644 --- a/htdocs/takepos/index.php +++ b/htdocs/takepos/index.php @@ -28,9 +28,6 @@ // if (! defined('NOREQUIRESOC')) define('NOREQUIRESOC','1'); // if (! defined('NOREQUIRETRAN')) define('NOREQUIRETRAN','1'); -if (!defined('NOTOKENRENEWAL')) { - define('NOTOKENRENEWAL', '1'); -} if (!defined('NOREQUIREMENU')) { define('NOREQUIREMENU', '1'); } @@ -325,7 +322,7 @@ function LoadProducts(position, issubcat) { }); idata=0; //product data counter - $.getJSON('/takepos/ajax/ajax.php?action=getProducts&category='+currentcat, function(data) { + $.getJSON('/takepos/ajax/ajax.php?action=getProducts&token=&category='+currentcat, function(data) { console.log("Call ajax.php (in LoadProducts) to get Products of category "+currentcat+" then loop on result to fill image thumbs"); console.log(data); while (ishow < maxproduct) { @@ -415,7 +412,7 @@ function MoreProducts(moreorless) { if (pageproducts==0) return; //Return if no less pages pageproducts=pageproducts-1; } - $.getJSON('/takepos/ajax/ajax.php?action=getProducts&category='+currentcat, function(data) { + $.getJSON('/takepos/ajax/ajax.php?action=getProducts&token=&category='+currentcat, function(data) { console.log("Call ajax.php (in MoreProducts) to get Products of category "+currentcat); if (typeof (data[(maxproduct * pageproducts)]) == "undefined" && moreorless=="more"){ // Return if no more pages @@ -490,7 +487,7 @@ function ClickProduct(position, qty = 1) { function ChangeThirdparty(idcustomer) { console.log("ChangeThirdparty"); // Call page list.php to change customer - $("#poslines").load("../societe/list.php?action=change&type=t&contextpage=poslist&idcustomer="+idcustomer+"&place="+place+"", function() { + $("#poslines").load("../societe/list.php?action=change&token=&type=t&contextpage=poslist&idcustomer="+idcustomer+"&place="+place+"", function() { }); ClearSearch(); @@ -540,7 +537,7 @@ function Floors() { function FreeZone() { console.log("Open box to enter a free product"); - $.colorbox({href:"freezone.php?action=freezone&place="+place, width:"80%", height:"200px", transition:"none", iframe:"true", title:"trans("FreeZone"); ?>"}); + $.colorbox({href:"freezone.php?action=freezone&token=&place="+place, width:"80%", height:"200px", transition:"none", iframe:"true", title:"trans("FreeZone"); ?>"}); } function TakeposOrderNotes() { @@ -562,7 +559,7 @@ function New() { console.log("New with place = , js place="+place+", invoiceid="+invoiceid); - $.getJSON('/takepos/ajax/ajax.php?action=getInvoice&id='+invoiceid, function(data) { + $.getJSON('/takepos/ajax/ajax.php?action=getInvoice&token=&id='+invoiceid, function(data) { var r; if (parseInt(data['paye']) === 1) { @@ -628,7 +625,7 @@ function Search2(keyCodeForEnter, moreorless) { pageproducts = 0; jQuery(".wrapper2 .catwatermark").hide(); var nbsearchresults = 0; - $.getJSON('/takepos/ajax/ajax.php?action=search&term=' + search_term + '&search_start=' + search_start + '&search_limit=' + search_limit, function (data) { + $.getJSON('/takepos/ajax/ajax.php?action=search&token=&term=' + search_term + '&search_start=' + search_start + '&search_limit=' + search_limit, function (data) { for (i = 0; i < ; i++) { if (typeof (data[i]) == "undefined") { $("#prowatermark" + i).html(""); @@ -746,7 +743,7 @@ function Edit(number) { return; } else if (number=='qty') { if (editaction=='qty' && editnumber != '') { - $("#poslines").load("invoice.php?action=updateqty&place="+place+"&idline="+selectedline+"&number="+editnumber, function() { + $("#poslines").load("invoice.php?action=updateqty&token=&place="+place+"&idline="+selectedline+"&number="+editnumber, function() { editnumber=""; //$('#poslines').scrollTop($('#poslines')[0].scrollHeight); $("#qty").html("trans("Qty"); ?>").removeClass('clicked'); @@ -760,7 +757,7 @@ function Edit(number) { } } else if (number=='p') { if (editaction=='p' && editnumber!="") { - $("#poslines").load("invoice.php?action=updateprice&place="+place+"&idline="+selectedline+"&number="+editnumber, function() { + $("#poslines").load("invoice.php?action=updateprice&token=&place="+place+"&idline="+selectedline+"&number="+editnumber, function() { editnumber=""; //$('#poslines').scrollTop($('#poslines')[0].scrollHeight); $("#price").html("trans("Price"); ?>").removeClass('clicked'); @@ -774,7 +771,7 @@ function Edit(number) { } } else if (number=='r') { if (editaction=='r' && editnumber!="") { - $("#poslines").load("invoice.php?action=updatereduction&place="+place+"&idline="+selectedline+"&number="+editnumber, function() { + $("#poslines").load("invoice.php?action=updatereduction&token=&place="+place+"&idline="+selectedline+"&number="+editnumber, function() { editnumber=""; //$('#poslines').scrollTop($('#poslines')[0].scrollHeight); $("#reduction").html("trans("ReductionShort"); ?>").removeClass('clicked'); @@ -814,14 +811,14 @@ function Edit(number) { function TakeposPrintingOrder(){ console.log("TakeposPrintingOrder"); - $("#poslines").load("invoice.php?action=order&place="+place, function() { + $("#poslines").load("invoice.php?action=order&token=&place="+place, function() { //$('#poslines').scrollTop($('#poslines')[0].scrollHeight); }); } function TakeposPrintingTemp(){ console.log("TakeposPrintingTemp"); - $("#poslines").load("invoice.php?action=temp&place="+place, function() { + $("#poslines").load("invoice.php?action=temp&token=&place="+place, function() { //$('#poslines').scrollTop($('#poslines')[0].scrollHeight); }); } @@ -843,11 +840,11 @@ function OpenDrawer(){ } function DolibarrOpenDrawer() { - console.log("DolibarrOpenDrawer call ajax url /takepos/ajax/ajax.php?action=opendrawer&term="); + console.log("DolibarrOpenDrawer call ajax url /takepos/ajax/ajax.php?action=opendrawer&token=&term="); $.ajax({ type: "GET", data: { token: '' }, - url: "", + url: "", }); } @@ -892,7 +889,7 @@ function ModalBox(ModalID) function DirectPayment(){ console.log("DirectPayment"); - $("#poslines").load("invoice.php?place="+place+"&action=valid&pay=LIQ", function() { + $("#poslines").load("invoice.php?place="+place+"&action=valid&token=&pay=LIQ", function() { }); } @@ -908,7 +905,7 @@ function WeighingScale(){ url: '/scale/index.php', }) .done(function( editnumber ) { - $("#poslines").load("invoice.php?action=updateqty&place="+place+"&idline="+selectedline+"&number="+editnumber, function() { + $("#poslines").load("invoice.php?&token=&place="+place+"&idline="+selectedline+"&number="+editnumber, function() { editnumber=""; }); }); diff --git a/htdocs/takepos/invoice.php b/htdocs/takepos/invoice.php index 6ec6f11ffc7..523a6ad2986 100644 --- a/htdocs/takepos/invoice.php +++ b/htdocs/takepos/invoice.php @@ -1083,7 +1083,7 @@ function SendTicket(id) function PrintBox(id, action) { console.log("Open box before printing"); - $.colorbox({href:"printbox.php?facid="+id+"&action="+action, width:"80%", height:"200px", transition:"none", iframe:"true", title:"trans("PrintWithoutDetails"); ?>"}); + $.colorbox({href:"printbox.php?facid="+id+"&action="+action+"&token=", width:"80%", height:"200px", transition:"none", iframe:"true", title:"trans("PrintWithoutDetails"); ?>"}); } function Print(id, gift){ @@ -1106,7 +1106,7 @@ function TakeposPrinting(id){ function TakeposConnector(id){ console.log("TakeposConnector" + id); - $.get("/takepos/ajax/ajax.php?action=printinvoiceticket&term=&id="+id+"&token=", function(data, status) { + $.get("/takepos/ajax/ajax.php?action=printinvoiceticket&token=&term=&id="+id+"&token=", function(data, status) { $.ajax({ type: "POST", url: '/printer/index.php', @@ -1120,7 +1120,7 @@ function DolibarrTakeposPrinting(id) { $.ajax({ type: "GET", data: { token: '' }, - url: "" + id, + url: "" + id, }); } diff --git a/htdocs/takepos/pay.php b/htdocs/takepos/pay.php index e9188aabfdc..1222ccd1786 100644 --- a/htdocs/takepos/pay.php +++ b/htdocs/takepos/pay.php @@ -110,9 +110,13 @@ function unexpectedDisconnect() { } function fetchConnectionToken() { global->STRIPE_LOCATION)) $urlconnexiontoken .= '&location='.$conf->global->STRIPE_LOCATION; - if (!empty($stripeacc)) $urlconnexiontoken .= '&stripeacc='.$stripeacc; + $urlconnexiontoken = DOL_URL_ROOT.'/stripe/ajax/ajax.php?action=getConnexionToken&token='.newToken().'&servicestatus='.urlencode($servicestatus); + if (!empty($conf->global->STRIPE_LOCATION)) { + $urlconnexiontoken .= '&location='.urlencode($conf->global->STRIPE_LOCATION); + } + if (!empty($stripeacc)) { + $urlconnexiontoken .= '&stripeacc='.urlencode($stripeacc); + } ?> // Do not cache or hardcode the ConnectionToken. The SDK manages the ConnectionToken's lifecycle. return fetch('', { method: "POST" }) @@ -318,7 +322,7 @@ if ($conf->global->TAKEPOS_NUMPAD == 0) { amountpayed = total_ttc; ?>; } console.log("We click on the payment mode to pay amount = "+amountpayed); - parent.$("#poslines").load("invoice.php?place=&action=valid&pay="+payment+"&amount="+amountpayed+"&excess="+excess+"&invoiceid="+invoiceid+"&accountid="+accountid, function() { + parent.$("#poslines").load("invoice.php?place=&action=valid&token=&pay="+payment+"&amount="+amountpayed+"&excess="+excess+"&invoiceid="+invoiceid+"&accountid="+accountid, function() { if (amountpayed > || amountpayed == || amountpayed==0 ) { console.log("Close popup"); parent.$.colorbox.close(); @@ -355,8 +359,10 @@ if ($conf->global->TAKEPOS_NUMPAD == 0) { function capturePaymentIntent(paymentIntentId) { const bodyContent = JSON.stringify({"id": paymentIntentId}) return fetch('', { method: "POST", @@ -416,7 +422,7 @@ if ($conf->global->TAKEPOS_NUMPAD == 0) { } else { document.getElementById("card-present-alert").innerHTML = '
trans('PaymentValidated'); ?>
'; console.log("Capture paymentIntent successfull "+paymentIntentId); - parent.$("#poslines").load("invoice.php?place=&action=valid&pay=CB&amount="+amountpayed+"&excess="+excess+"&invoiceid="+invoiceid+"&accountid="+accountid, function() { + parent.$("#poslines").load("invoice.php?place=&action=valid&token=&pay=CB&amount="+amountpayed+"&excess="+excess+"&invoiceid="+invoiceid+"&accountid="+accountid, function() { if (amountpayed > || amountpayed == || amountpayed==0 ) { console.log("Close popup"); parent.$.colorbox.close(); @@ -455,7 +461,7 @@ if ($conf->global->TAKEPOS_NUMPAD == 0) { url: '/takepos/smpcb.php?status' }).done(function (data) { console.log(data); if (data === "SUCCESS") { - parent.$("#poslines").load("invoice.php?place=&action=valid&pay=CB&amount=" + amountpayed + "&invoiceid=" + invoiceid, function () { + parent.$("#poslines").load("invoice.php?place=&action=valid&token=&pay=CB&amount=" + amountpayed + "&invoiceid=" + invoiceid, function () { //parent.$("#poslines").scrollTop(parent.$("#poslines")[0].scrollHeight); parent.$.colorbox.close(); //parent.setFocusOnSearchField(); // This does not have effect diff --git a/htdocs/takepos/phone.php b/htdocs/takepos/phone.php index 4d89ce23f66..f1e633d994d 100644 --- a/htdocs/takepos/phone.php +++ b/htdocs/takepos/phone.php @@ -225,7 +225,7 @@ function AddProduct(placeid, productid){ // If is a public terminal first show product information if (defined('INCLUDE_PHONEPAGE_FROM_PUBLIC_PAGE')) { print 'place=placeid; - $("#phonediv1").load("auto_order.php?action=productinfo&place="+place+"&idproduct="+productid, function() { + $("#phonediv1").load("auto_order.php?action=productinfo&token='.newToken().'&place="+place+"&idproduct="+productid, function() { });'; } else { print 'AddProductConfirm(placeid, productid);'; @@ -234,7 +234,7 @@ function AddProduct(placeid, productid){ } function PublicPreOrder(){ - $("#phonediv1").load("auto_order.php?action=publicpreorder&place="+place, function() { + $("#phonediv1").load("auto_order.php?action=publicpreorder&token=&place="+place, function() { }); } @@ -260,7 +260,7 @@ function SetQty(place, selectedline, qty){ }); } else{ - $("#phonediv2").load("auto_order.php?mobilepage=invoice&action=updateqty&place="+place+"&idline="+selectedline+"&number="+qty, function() { + $("#phonediv2").load("auto_order.php?mobilepage=invoice&action=updateqty&token=&place="+place+"&idline="+selectedline+"&number="+qty, function() { }); } &place="+place+"&idline="+selectedline+"&number="+qty, function() { }); } trans('Note'); ?>", ""); - $("#phonediv2").load("auto_order.php?mobilepage=invoice&action=updateqty&place="+place+"&idline="+selectedline+"&number="+qty, function() { + $("#phonediv2").load("auto_order.php?mobilepage=invoice&action=updateqty&token=&place="+place+"&idline="+selectedline+"&number="+qty, function() { }); LoadCats(); } @@ -321,12 +321,12 @@ function TakeposPrintingOrder(){ console.log("TakeposPrintingOrder"); @@ -338,12 +338,12 @@ function Exit(){ function CheckPlease(payment){ if (payment==undefined){ - $("#phonediv1").load("auto_order.php?action=checkplease&place="+place, function() { + $("#phonediv1").load("auto_order.php?action=checkplease&token=&place="+place, function() { }); } else{ console.log("Request the check to the waiter"); - $("#phonediv1").load("auto_order.php?action=checkplease&place=&payment="+payment, function() { + $("#phonediv1").load("auto_order.php?action=checkplease&token=&place=&payment="+payment, function() { }); } } diff --git a/htdocs/takepos/printbox.php b/htdocs/takepos/printbox.php index dfceab9bbc4..53c07bcf1d7 100644 --- a/htdocs/takepos/printbox.php +++ b/htdocs/takepos/printbox.php @@ -75,7 +75,7 @@ top_htmlhead($head, '', 0, 0, $arrayofjs, $arrayofcss); function Save() { console.log("We click so we call page receipt.php with facid="); parent.$.colorbox.close(); - $.colorbox({href:"receipt.php?facid=&action=&label="+$('#label').val()+"&qty="+$('#qty').val(), width:"40%", height:"90%", transition:"none", iframe:"true", title:'trans("PrintTicket")); ?>'}); + $.colorbox({ href:"receipt.php?facid=&action=&token=&label="+$('#label').val()+"&qty="+$('#qty').val(), width:"40%", height:"90%", transition:"none", iframe:"true", title:'trans("PrintTicket")); ?>'}); } jQuery(document).ready(function(){ diff --git a/htdocs/takepos/reduction.php b/htdocs/takepos/reduction.php index 67829003954..5d80acb0f81 100644 --- a/htdocs/takepos/reduction.php +++ b/htdocs/takepos/reduction.php @@ -185,13 +185,13 @@ if (!isset($conf->global->TAKEPOS_NUMPAD_USE_PAYMENT_ICON) || !empty($conf->glob if (reductionType === 'percent') { var invoiceid = 0 ? $invoiceid : 0); ?>; - parent.$("#poslines").load("invoice.php?action=update_reduction_global&place=&number="+reductionNumber+"&invoiceid="+invoiceid, function() { + parent.$("#poslines").load("invoice.php?action=update_reduction_global&token=&place=&number="+reductionNumber+"&invoiceid="+invoiceid, function() { Reset(); parent.$.colorbox.close(); }); } else if (reductionType === 'amount') { var desc = "transnoentities('Reduction')); ?>"; - parent.$("#poslines").load("invoice.php?action=freezone&place=&number=-"+reductionNumber+"&desc="+desc, function() { + parent.$("#poslines").load("invoice.php?action=freezone&token=&place=&number=-"+reductionNumber+"&desc="+desc, function() { Reset(); parent.$.colorbox.close(); }); diff --git a/htdocs/takepos/send.php b/htdocs/takepos/send.php index 31929a9c732..21252da1d26 100644 --- a/htdocs/takepos/send.php +++ b/htdocs/takepos/send.php @@ -107,7 +107,7 @@ function SendMail() { $.ajax({ type: "GET", data: { token: '' }, - url: "" + $("#email"). val(), + url: "" + $("#email"). val(), }); parent.$.colorbox.close(); } diff --git a/htdocs/takepos/split.php b/htdocs/takepos/split.php index b39f9d1d215..0391e911ba5 100644 --- a/htdocs/takepos/split.php +++ b/htdocs/takepos/split.php @@ -164,7 +164,7 @@ $arrayOfValidBankAccount = array();