lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX delete ECM directory

Browse Source
This commit is contained in:
Laurent Destailleur 2022-10-14 15:57:58 +02:00
parent 5190bc0d04
commit 746a00047b
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/core/lib/files.lib.php
View File

@ -1372,7 +1372,7 @@ function dol_delete_dir($dir, $nophperrors = 0)
// Security: // Security:
// We refuse transversal using .. and pipes into filenames. // We refuse transversal using .. and pipes into filenames.
if (preg_match('/\.\./', $dir) || preg_match('/[<>|]/', $dir)) { if (preg_match('/\.\./', $dir) || preg_match('/[<>|]/', $dir)) {
dol_syslog("Refused to delete dir ".$dir, LOG_WARNING); dol_syslog("Refused to delete dir ".$dir.' (contains invalid char sequence)', LOG_WARNING);
return false; return false;
} }

5
htdocs/ecm/dir_card.php
View File

@ -469,13 +469,14 @@ if ($action != 'edit' && $action != 'delete' && $action != 'deletefile') {
print '</div>'; print '</div>';
} }
// Confirm remove file // Confirm remove file
if ($action == 'deletefile') { if ($action == 'deletefile') {
print $form->formconfirm($_SERVER["PHP_SELF"].'?section='.urlencode(GETPOST("section", 'alpha')).'&urlfile='.urlencode(GETPOST("urlfile")).($backtopage ? '&backtopage='.urlencode($backtopage) : ''), $langs->trans('DeleteFile'), $langs->trans('ConfirmDeleteFile'), 'confirm_deletefile'); print $form->formconfirm($_SERVER["PHP_SELF"].'?section='.urlencode(GETPOST("section", 'alpha')).'&urlfile='.urlencode(GETPOST("urlfile")).($backtopage ? '&backtopage='.urlencode($backtopage) : ''), $langs->trans('DeleteFile'), $langs->trans('ConfirmDeleteFile'), 'confirm_deletefile');
} }
// Confirm remove file // Confirm remove dir
if ($action == 'delete_dir') { if ($action == 'delete' || $action == 'delete_dir') {
$relativepathwithoutslash = preg_replace('/[\/]$/', '', $relativepath); $relativepathwithoutslash = preg_replace('/[\/]$/', '', $relativepath);
//Form to close proposal (signed or not) //Form to close proposal (signed or not)