lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add another security sanitizing option

Browse Source
This commit is contained in:
Laurent Destailleur 2017-05-09 19:26:28 +02:00
parent d7d212bbe1
commit 667e3c2876
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
htdocs/core/lib/functions.lib.php
View File

@ -308,9 +308,17 @@ function GETPOST($paramname,$check='',$method=0,$filter=NULL,$options=NULL)
if (! is_array($out) || empty($out)) $out=array();
break;
case 'nohtml':
$out=dol_string_nohtmltag($out);
$out=dol_string_nohtmltag($out);
break;
case 'custom':
case 'alphanohtml': // Recommended for search params
$out=trim($out);
// '"' is dangerous because param in url can close the href= or src= and add javascript functions.
// '../' is dangerous because it allows dir transversals
if (preg_match('/"/',$out)) $out='';
else if (preg_match('/\.\.\//',$out)) $out='';
$out=dol_string_nohtmltag($out);
break;
case 'custom':
if (empty($filter)) return 'BadFourthParameterForGETPOST';
$out=filter_var($out, $filter, $options);
break;