lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix CSRF protection for all massactions

Browse Source
This commit is contained in:
Laurent Destailleur 2021-09-18 22:38:25 +02:00
parent bc63c624ef
commit 89e8f24e15
5 changed files with 14 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
htdocs/comm/propal/list.php
View File

@ -316,13 +316,14 @@ if ($action == 'validate' && $permissiontovalidate) {
if ($tmpproposal->fetch($checked)) { if ($tmpproposal->fetch($checked)) {
if ($tmpproposal->statut == 0) { if ($tmpproposal->statut == 0) {
if ($tmpproposal->valid($user)) { if ($tmpproposal->valid($user)) {
setEventMessage($tmpproposal->ref." ".$langs->trans('PassedInOpenStatus'), 'mesgs'); setEventMessage($langs->trans('hasBeenValidated', $tmpproposal->ref), 'mesgs');
} else { } else {
setEventMessage($langs->trans('CantBeValidated'), 'errors'); setEventMessage($langs->trans('CantBeValidated'), 'errors');
$error++; $error++;
} }
} else { } else {
setEventMessage($tmpproposal->ref." ".$langs->trans('IsNotADraft'), 'errors'); $langs->load("errors");
setEventMessage($langs->trans('ErrorIsNotADraft', $tmpproposal->ref), 'errors');
$error++; $error++;
} }
} else { } else {

12
htdocs/commande/list.php
View File

@ -309,13 +309,14 @@ if ($action == 'validate' && $permissiontoadd) {
$idwarehouse = 0; $idwarehouse = 0;
} }
if ($objecttmp->valid($user, $idwarehouse)) { if ($objecttmp->valid($user, $idwarehouse)) {
setEventMessage($objecttmp->ref." ".$langs->trans('PassedInOpenStatus'), 'mesgs'); setEventMessage($langs->trans('hasBeenValidated', $objecttmp->ref), 'mesgs');
} else { } else {
setEventMessage($langs->trans('CantBeValidated'), 'errors'); setEventMessage($langs->trans('CantBeValidated'), 'errors');
$error++; $error++;
} }
} else { } else {
setEventMessage($objecttmp->ref." ".$langs->trans('IsNotADraft'), 'errors'); $langs->load("errors");
setEventMessage($langs->trans('ErrorIsNotADraft', $objecttmp->ref), 'errors');
$error++; $error++;
} }
} else { } else {
@ -339,13 +340,14 @@ if ($action == 'shipped' && $permissiontoadd) {
if ($objecttmp->fetch($checked)) { if ($objecttmp->fetch($checked)) {
if ($objecttmp->statut == 1) { if ($objecttmp->statut == 1) {
if ($objecttmp->cloture($user)) { if ($objecttmp->cloture($user)) {
setEventMessage($objecttmp->ref." ".$langs->trans('PassedInOpenStatus'), 'mesgs'); setEventMessage($langs->trans('PassedInClosedStatus', $objecttmp->ref), 'mesgs');
} else { } else {
setEventMessage($langs->trans('CantBeValidated'), 'errors'); setEventMessage($langs->trans('CantBeClosed'), 'errors');
$error++; $error++;
} }
} else { } else {
setEventMessage($objecttmp->ref." ".$langs->trans('IsNotADraft'), 'errors'); $langs->load("errors");
setEventMessage($langs->trans('ErrorIsNotADraft', $objecttmp->ref), 'errors');
$error++; $error++;
} }
} else { } else {

1
htdocs/langs/en_US/errors.lang
View File

@ -270,6 +270,7 @@ ErrorActionCommBadType=Selected event type (id: %n, code: %s) do not exist in Ev
CheckVersionFail=Version check fail CheckVersionFail=Version check fail
ErrorWrongFileName=Name of the file cannot have __SOMETHING__ in it ErrorWrongFileName=Name of the file cannot have __SOMETHING__ in it
ErrorNotInDictionaryPaymentConditions=Not in Payment Terms Dictionary, please modify. ErrorNotInDictionaryPaymentConditions=Not in Payment Terms Dictionary, please modify.
ErrorIsNotADraft=%s is not a draft
# Warnings # Warnings
WarningParamUploadMaxFileSizeHigherThanPostMaxSize=Your PHP parameter upload_max_filesize (%s) is higher than PHP parameter post_max_size (%s). This is not a consistent setup. WarningParamUploadMaxFileSizeHigherThanPostMaxSize=Your PHP parameter upload_max_filesize (%s) is higher than PHP parameter post_max_size (%s). This is not a consistent setup.

1
htdocs/langs/en_US/main.lang
View File

@ -1155,3 +1155,4 @@ ConfirmMassLeaveApproval=Mass leave approval confirmation
RecordAproved=Record approved RecordAproved=Record approved
RecordsApproved=%s Record(s) approved RecordsApproved=%s Record(s) approved
Properties=Properties Properties=Properties
hasBeenValidated=%s has been validated

3
htdocs/main.inc.php
View File

@ -482,7 +482,8 @@ if ((!defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && !empty($conf->gl
if ( if (
$_SERVER['REQUEST_METHOD'] == 'POST' || $_SERVER['REQUEST_METHOD'] == 'POST' ||
$sensitiveget || $sensitiveget ||
((GETPOSTISSET('actionlogin') || GETPOSTISSET('action') || GETPOSTISSET('massaction')) && defined('CSRFCHECK_WITH_TOKEN')) GETPOSTISSET('massaction') ||
((GETPOSTISSET('actionlogin') || GETPOSTISSET('action')) && defined('CSRFCHECK_WITH_TOKEN'))
) { ) {
// If token is not provided or empty, error (we are in case it is mandatory) // If token is not provided or empty, error (we are in case it is mandatory)
if (!GETPOST('token', 'alpha') || GETPOST('token', 'alpha') == 'notrequired') { if (!GETPOST('token', 'alpha') || GETPOST('token', 'alpha') == 'notrequired') {