diff --git a/htdocs/public/test/test_arrays.php b/htdocs/public/test/test_arrays.php index b2a87a75480..05fc13c0dbc 100644 --- a/htdocs/public/test/test_arrays.php +++ b/htdocs/public/test/test_arrays.php @@ -22,19 +22,22 @@ if (!defined("NOLOGIN")) { define("NOLOGIN", '1'); // If this page is public (can be called outside logged session) } - require '../../main.inc.php'; +// Security if ($dolibarr_main_prod) { accessforbidden(); } -$usedolheader = 1; // 1 = Test inside a dolibarr page, 0 = Use hard coded header + + +/* + * View + */ $form = new Form($db); - - +$usedolheader = 1; // 1 = Test inside a dolibarr page, 0 = Use hard coded header // HEADER //-------- diff --git a/htdocs/public/test/test_csrf.php b/htdocs/public/test/test_csrf.php index 1c23dc7070a..94d76469f81 100644 --- a/htdocs/public/test/test_csrf.php +++ b/htdocs/public/test/test_csrf.php @@ -1,11 +1,44 @@ This is a form to test if a CSRF exists into a Dolibarr page.

-- Change url to send request to into this file (server B, hard coded page)
+- Change url to send request to into this file (URL to a hard coded page on a server B)
- Open this form into a virtual server A.
- Send the request to the virtual server B by clicking submit.
- Check that Anticsrf protection is triggered.
diff --git a/htdocs/public/test/test_exec.php b/htdocs/public/test/test_exec.php new file mode 100644 index 00000000000..a25e860021c --- /dev/null +++ b/htdocs/public/test/test_exec.php @@ -0,0 +1,87 @@ +\n"; +print 'PHP_SESSION_DISABLED='.PHP_SESSION_DISABLED."
\n"; +print 'PHP_SESSION_NONE='.PHP_SESSION_NONE."
\n"; +print 'PHP_SESSION_ACTIVE='.PHP_SESSION_ACTIVE."
\n"; +print '
'; + +print 'session_status='.session_status().' (before main.inc.php)'; +print '
'; + +require '../../main.inc.php'; + +// Security +if ($dolibarr_main_prod) { + accessforbidden(); +} + + +/* + * View + */ + +echo "Test
\n"; +$out=''; +$ret=0; + +$file = '/tmp/aaa'; +$f=fopen($file, 'r'); +if ($f) { + $s=fread($f, 4096); + print $s; + fclose($f); +} else { + print "Failed to open file ".$file."
\n"; +} + +exec('cat /aaa; ls /dev/std*; sleep 1;', $out, $ret); +print $ret."
\n"; +print_r($out); + +$ret = 0; +$out = null; +exec('/usr/bin/clamdscan --fdpass filethatdoesnotexists.php', $out, $ret); +print $ret."
\n"; +print_r($out); diff --git a/htdocs/public/test/test_forms.php b/htdocs/public/test/test_forms.php index d89e04e12a6..c025151bdb9 100644 --- a/htdocs/public/test/test_forms.php +++ b/htdocs/public/test/test_forms.php @@ -8,10 +8,16 @@ if (!defined('NOSESSION')) { require '../../main.inc.php'; include_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php'; +// Security if ($dolibarr_main_prod) { accessforbidden(); } + +/* + * View + */ + llxHeader(); ?> diff --git a/htdocs/public/test/test_sessionlock.php b/htdocs/public/test/test_sessionlock.php index 18a1ef73d08..8464ba2eb4f 100644 --- a/htdocs/public/test/test_sessionlock.php +++ b/htdocs/public/test/test_sessionlock.php @@ -52,11 +52,15 @@ print '
'; require '../../main.inc.php'; -/* No need for this. +// Security if ($dolibarr_main_prod) { accessforbidden(); } -*/ + + +/* + * View + */ print 'session_status='.session_status().' (after main.inc.php)'; print '
'; diff --git a/htdocs/public/ticket/create_ticket.php b/htdocs/public/ticket/create_ticket.php index e621feb6653..00eff71da78 100644 --- a/htdocs/public/ticket/create_ticket.php +++ b/htdocs/public/ticket/create_ticket.php @@ -4,7 +4,7 @@ * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or + * the Free Software Foundation; either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, diff --git a/htdocs/reception/card.php b/htdocs/reception/card.php index de6ccc2c7e7..f84b8bd4d6c 100644 --- a/htdocs/reception/card.php +++ b/htdocs/reception/card.php @@ -112,9 +112,6 @@ include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be includ // Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context $hookmanager->initHooks(array('receptioncard', 'globalcard')); -$permissiondellink = $user->rights->reception->creer; // Used by the include of actions_dellink.inc.php -//var_dump($object->lines[0]->detail_batch); - $date_delivery = dol_mktime(GETPOST('date_deliveryhour', 'int'), GETPOST('date_deliverymin', 'int'), 0, GETPOST('date_deliverymonth', 'int'), GETPOST('date_deliveryday', 'int'), GETPOST('date_deliveryyear', 'int')); if ($id > 0 || !empty($ref)) { @@ -142,9 +139,10 @@ if ($user->socid) { $socid = $user->socid; } -if ($origin == 'reception') { +if (!empty($conf->reception->enabled) || $origin == 'reception' || empty($origin)) { $result = restrictedArea($user, 'reception', $id); } else { + // We do not use the reception module, so we test permission on the supplier orders if ($origin == 'supplierorder' || $origin == 'order_supplier') { $result = restrictedArea($user, 'fournisseur', $origin_id, 'commande_fournisseur', 'commande'); } elseif (empty($user->rights->{$origin}->lire) && empty($user->rights->{$origin}->read)) { @@ -152,6 +150,20 @@ if ($origin == 'reception') { } } +if (!empty($conf->reception->enabled)) { + $permissiontoread = $user->rights->reception->lire; + $permissiontoadd = $user->rights->reception->creer; + $permissiondellink = $user->rights->reception->creer; // Used by the include of actions_dellink.inc.php + $permissiontovalidate = ((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->reception->creer)) || (!empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->reception->reception_advance->validate))); + $permissiontodelete = $user->rights->reception->supprimer; +} else { + $permissiontoread = $user->rights->fournisseur->commande->receptionner; + $permissiontoadd = $user->rights->fournisseur->commande->receptionner; + $permissiondellink = $user->rights->fournisseur->commande->receptionner; // Used by the include of actions_dellink.inc.php + $permissiontovalidate = ((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->fournisseur->commande->receptionner)) || (!empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->fournisseur->commande_advance->check))); + $permissiontodelete = $user->rights->fournisseur->commande->receptionner; +} + /* * Actions @@ -171,12 +183,12 @@ if (empty($reshook)) { include DOL_DOCUMENT_ROOT.'/core/actions_dellink.inc.php'; // Must be include, not include_once // Reopen - if ($action == 'reopen' && $user->rights->reception->creer) { + if ($action == 'reopen' && $permissiontoadd) { $result = $object->reOpen(); } // Confirm back to draft status - if ($action == 'modif' && $user->rights->reception->creer) { + if ($action == 'modif' && $permissiontoadd) { $result = $object->setDraft($user); if ($result >= 0) { // Define output language @@ -201,11 +213,11 @@ if (empty($reshook)) { } // Set incoterm - if ($action == 'set_incoterms' && !empty($conf->incoterm->enabled)) { + if ($action == 'set_incoterms' && !empty($conf->incoterm->enabled) && $permissiontoadd) { $result = $object->setIncoterms(GETPOST('incoterm_id', 'int'), GETPOST('location_incoterms', 'alpha')); } - if ($action == 'setref_supplier') { + if ($action == 'setref_supplier' && $permissiontoadd) { if ($result < 0) { setEventMessages($object->error, $object->errors, 'errors'); } @@ -220,7 +232,7 @@ if (empty($reshook)) { } } - if ($action == 'update_extras') { + if ($action == 'update_extras' && $permissiontoadd) { $object->oldcopy = dol_clone($object); // Fill array 'array_options' with data from update form @@ -244,7 +256,7 @@ if (empty($reshook)) { } // Create reception - if ($action == 'add' && $user->rights->reception->creer) { + if ($action == 'add' && $permissiontoadd) { $error = 0; $predef = ''; @@ -405,10 +417,7 @@ if (empty($reshook)) { $_GET["commande_id"] = GETPOST('commande_id', 'int'); $action = 'create'; } - } elseif ($action == 'confirm_valid' && $confirm == 'yes' && - ((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->reception->creer)) - || (!empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->reception->reception_advance->validate))) - ) { + } elseif ($action == 'confirm_valid' && $confirm == 'yes' && $permissiontovalidate) { $object->fetch_thirdparty(); $result = $object->valid($user); @@ -440,7 +449,7 @@ if (empty($reshook)) { } } } - } elseif ($action == 'confirm_delete' && $confirm == 'yes' && $user->rights->reception->supprimer) { + } elseif ($action == 'confirm_delete' && $confirm == 'yes' && $permissiontodelete) { $result = $object->delete($user); if ($result > 0) { header("Location: ".DOL_URL_ROOT.'/reception/index.php'); @@ -455,7 +464,7 @@ if (empty($reshook)) { if ($result < 0) { setEventMessages($object->error, $object->errors, 'errors'); }*/ - } elseif ($action == 'setdate_livraison' && $user->rights->reception->creer) { + } elseif ($action == 'setdate_livraison' && $permissiontoadd) { //print "x ".$_POST['liv_month'].", ".$_POST['liv_day'].", ".$_POST['liv_year']; $datedelivery = dol_mktime(GETPOST('liv_hour', 'int'), GETPOST('liv_min', 'int'), 0, GETPOST('liv_month', 'int'), GETPOST('liv_day', 'int'), GETPOST('liv_year', 'int')); @@ -506,7 +515,7 @@ if (empty($reshook)) { } $action = ""; - } elseif ($action == 'builddoc') { + } elseif ($action == 'builddoc' && $permissiontoread) { // Build document // En get ou en post // Save last template used to generate document @@ -532,7 +541,7 @@ if (empty($reshook)) { setEventMessages($object->error, $object->errors, 'errors'); $action = ''; } - } elseif ($action == 'remove_file') { + } elseif ($action == 'remove_file' && $permissiontoadd) { // Delete file in doc form require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php'; @@ -550,13 +559,13 @@ if (empty($reshook)) { header('Location: '.$_SERVER["PHP_SELF"].'?id='.$object->id); exit(); } - } elseif ($action == 'classifyclosed') { + } elseif ($action == 'classifyclosed' && $permissiontoread) { $result = $object->setClosed(); if ($result >= 0) { header('Location: '.$_SERVER["PHP_SELF"].'?id='.$object->id); exit(); } - } elseif ($action == 'deleteline' && !empty($line_id)) { + } elseif ($action == 'deleteline' && !empty($line_id) && $permissiontoread) { // delete a line $lines = $object->lines; $line = new CommandeFournisseurDispatch($db); @@ -579,7 +588,7 @@ if (empty($reshook)) { } else { setEventMessages($line->error, $line->errors, 'errors'); } - } elseif ($action == 'updateline' && $user->rights->reception->creer && GETPOST('save')) { + } elseif ($action == 'updateline' && GETPOST('save') && $permissiontoadd) { // Update a line // Clean parameters $qty = 0; @@ -666,11 +675,11 @@ if (empty($reshook)) { $object->generateDocument($object->model_pdf, $outputlangs, $hidedetails, $hidedesc, $hideref); } } else { - header('Location: '.$_SERVER['PHP_SELF'].'?id='.$object->id); // Pour reaffichage de la fiche en cours d'edition + header('Location: '.$_SERVER['PHP_SELF'].'?id='.$object->id); // To reshow the record we edit exit(); } - } elseif ($action == 'updateline' && $user->rights->reception->creer && GETPOST('cancel', 'alpha') == $langs->trans("Cancel")) { - header('Location: '.$_SERVER['PHP_SELF'].'?id='.$object->id); // Pour reaffichage de la fiche en cours d'edition + } elseif ($action == 'updateline' && $permissiontoadd && GETPOST('cancel', 'alpha') == $langs->trans("Cancel")) { + header('Location: '.$_SERVER['PHP_SELF'].'?id='.$object->id); // To reshow the record we edit exit(); } @@ -1567,9 +1576,8 @@ if ($action == 'create') { print '