lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

added security check at beginning of /project/index page (according to the security I added in the previous commits)

Browse Source
This commit is contained in:
Dorian Vabre 2021-04-27 14:11:46 +02:00
parent 79dce3ad05
commit 7405725198
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/public/eventorganization/attendee_subscription.php
View File

@ -106,7 +106,7 @@ if ($resultproject < 0) {
$securekeyreceived = GETPOST('securekey', 'alpha');
$securekeytocompare = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);
// We check if the securekey collected is OK and if the id collected is the same than the id in the securekey
// We check if the securekey collected is OK
if ($securekeytocompare != $securekeyreceived) {
print $langs->trans('MissingOrBadSecureKey');
exit;

10
htdocs/public/project/index.php
View File

@ -78,7 +78,15 @@ $langs->loadLangs(array("main", "other", "dict", "bills", "companies", "errors",
// No check on module enabled. Done later according to $validpaymentmethod
$action = GETPOST('action', 'aZ09');
$id = dol_decode(GETPOST('id'), $dolibarr_main_instance_unique_id);
$encodedid = GETPOST('id');
$id = dol_decode($encodedid, $dolibarr_main_instance_unique_id);
$securekeyreceived = GETPOST("securekey");
$securekeytocompare = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);
if ($securekeytocompare != $securekeyreceived) {
print $langs->trans('MissingOrBadSecureKey');
exit;
}
// Define $urlwithroot
//$urlwithouturlroot=preg_replace('/'.preg_quote(DOL_URL_ROOT,'/').'$/i','',trim($dolibarr_main_url_root));