lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Sanitize $ and ; for filesystem path (like files).

Browse Source
This commit is contained in:
Laurent Destailleur 2021-08-23 12:18:04 +02:00
parent cced15e50a
commit 8c017b9406
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
htdocs/core/lib/functions.lib.php
View File

@ -1069,7 +1069,7 @@ function dol_sanitizeFileName($str, $newstr = '_', $unaccent = 1)
// List of special chars for filenames in windows are defined on page https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file // List of special chars for filenames in windows are defined on page https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file
// Char '>' '<' '|' '$' and ';' are special chars for shells. // Char '>' '<' '|' '$' and ';' are special chars for shells.
// Char '/' and '\' are file delimiters. // Char '/' and '\' are file delimiters.
// -- car can be used into filename to inject special paramaters like --use-compress-program to make command with file as parameter making remote execution of command // Chars '--' can be used into filename to inject special paramaters like --use-compress-program to make command with file as parameter making remote execution of command
$filesystem_forbidden_chars = array('<', '>', '/', '\\', '?', '*', '|', '"', ':', '°', '$', ';'); $filesystem_forbidden_chars = array('<', '>', '/', '\\', '?', '*', '|', '"', ':', '°', '$', ';');
$tmp = dol_string_nospecial($unaccent ? dol_string_unaccent($str) : $str, $newstr, $filesystem_forbidden_chars); $tmp = dol_string_nospecial($unaccent ? dol_string_unaccent($str) : $str, $newstr, $filesystem_forbidden_chars);
$tmp = preg_replace('/\-\-+/', '_', $tmp); $tmp = preg_replace('/\-\-+/', '_', $tmp);
@ -1090,7 +1090,10 @@ function dol_sanitizeFileName($str, $newstr = '_', $unaccent = 1)
*/ */
function dol_sanitizePathName($str, $newstr = '_', $unaccent = 1) function dol_sanitizePathName($str, $newstr = '_', $unaccent = 1)
{ {
$filesystem_forbidden_chars = array('<', '>', '?', '*', '|', '"', '°'); // List of special chars for filenames in windows are defined on page https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file
// Char '>' '<' '|' '$' and ';' are special chars for shells.
// Chars '--' can be used into filename to inject special paramaters like --use-compress-program to make command with file as parameter making remote execution of command
$filesystem_forbidden_chars = array('<', '>', '?', '*', '|', '"', '°', '$', ';');
$tmp = dol_string_nospecial($unaccent ? dol_string_unaccent($str) : $str, $newstr, $filesystem_forbidden_chars); $tmp = dol_string_nospecial($unaccent ? dol_string_unaccent($str) : $str, $newstr, $filesystem_forbidden_chars);
$tmp = preg_replace('/\-\-+/', '_', $tmp); $tmp = preg_replace('/\-\-+/', '_', $tmp);
$tmp = preg_replace('/\s+\-/', ' _', $tmp); $tmp = preg_replace('/\s+\-/', ' _', $tmp);