lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

New: Add option 'aZ' into GETPOST function to check parameters

Browse Source 
contains only a to z or A to Z characters.
This commit is contained in:
Laurent Destailleur 2014-01-08 00:10:39 +01:00
parent 9a33d67527
commit 6ff337ccad
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -17,8 +17,8 @@ For developers:
- New: Add path file of trigger into admin trigger list page. - New: Add path file of trigger into admin trigger list page.
- New: More phpunit tests. - New: More phpunit tests.
- New: Payments and supplier payment pages tabs can now be extended from modules. - New: Payments and supplier payment pages tabs can now be extended from modules.
- New: Add option 'az' into GETPOST function to check parameters conatins - New: Add option 'aZ' into GETPOST function to check parameters contains
only a to z characters. only a to z or A to Z characters.
***** ChangeLog for 3.5 compared to 3.4.* ***** ***** ChangeLog for 3.5 compared to 3.4.* *****

4
htdocs/core/lib/functions.lib.php
View File

@ -198,12 +198,12 @@ function GETPOST($paramname,$check='',$method=0)
if (preg_match('/"/',$out)) $out=''; if (preg_match('/"/',$out)) $out='';
else if (preg_match('/\.\.\//',$out)) $out=''; else if (preg_match('/\.\.\//',$out)) $out='';
} }
elseif ($check == 'az') elseif ($check == 'aZ')
{ {
$out=trim($out); $out=trim($out);
// '"' is dangerous because param in url can close the href= or src= and add javascript functions. // '"' is dangerous because param in url can close the href= or src= and add javascript functions.
// '../' is dangerous because it allows dir transversals // '../' is dangerous because it allows dir transversals
if (preg_match('/[^a-z]+/',$out)) $out=''; if (preg_match('/[^a-z]+/i',$out)) $out='';
} }
elseif ($check == 'array') elseif ($check == 'array')
{ {