lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security fix, id was encoded where it should not be encoded

Browse Source
This commit is contained in:
Dorian Vabre 2021-05-07 14:49:00 +02:00
parent 2169a106fa
commit 6111f43946
3 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
htdocs/langs/en_US/eventorganization.lang
View File

@ -98,6 +98,7 @@ EvntOrgCancelled = Cancelled
# #
SuggestForm = Suggestion page SuggestForm = Suggestion page
RegisterPage = Page for conferences or booth RegisterPage = Page for conferences or booth
EvntOrgRegistrationHelpMessage = Here, you can vote for an event, or suggest a new conference or booth for the project
EvntOrgRegistrationConfHelpMessage = Here, you can suggest a new conference for the project EvntOrgRegistrationConfHelpMessage = Here, you can suggest a new conference for the project
EvntOrgRegistrationBoothHelpMessage = Here, you can suggest a new booth for the project EvntOrgRegistrationBoothHelpMessage = Here, you can suggest a new booth for the project
ListOfSuggestedConferences = List of suggested conferences ListOfSuggestedConferences = List of suggested conferences

3
htdocs/public/project/suggestbooth.php
View File

@ -496,9 +496,8 @@ if (empty($reshook) && $action == 'add') {
} }
if (!$error) { if (!$error) {
$db->commit(); $db->commit();
$encodedid = dol_encode($id, $dolibarr_main_instance_unique_id);
$securekeyurl = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2); $securekeyurl = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);
$redirection = $dolibarr_main_url_root.'/public/eventorganization/subscriptionok.php?id='.$encodedid.'&securekey='.$securekeyurl; $redirection = $dolibarr_main_url_root.'/public/eventorganization/subscriptionok.php?id='.$id.'&securekey='.$securekeyurl;
Header("Location: ".$redirection); Header("Location: ".$redirection);
exit; exit;
} else { } else {

3
htdocs/public/project/suggestconference.php
View File

@ -430,9 +430,8 @@ if (empty($reshook) && $action == 'add') {
} }
if (!$error) { if (!$error) {
$db->commit(); $db->commit();
$encodedid = dol_encode($id, $dolibarr_main_instance_unique_id);
$securekeyurl = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2); $securekeyurl = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);
$redirection = $dolibarr_main_url_root.'/public/eventorganization/subscriptionok.php?id='.$encodedid.'&securekey='.$securekeyurl; $redirection = $dolibarr_main_url_root.'/public/eventorganization/subscriptionok.php?id='.$id.'&securekey='.$securekeyurl;
Header("Location: ".$redirection); Header("Location: ".$redirection);
exit; exit;
} else { } else {