lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

code syntax comm directory

Browse Source
This commit is contained in:
Frédéric FRANCE 2021-02-23 20:23:21 +01:00
parent 52ae7d79ae
commit 8fe1eac48b
No known key found for this signature in database
GPG Key ID: 06809324E4B2ABC1
1 changed files with 120 additions and 80 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

200
htdocs/viewimage.php
View File

@ -28,48 +28,84 @@
//if (! defined('NOREQUIREUSER')) define('NOREQUIREUSER','1'); // Not disabled cause need to load personalized language //if (! defined('NOREQUIREUSER')) define('NOREQUIREUSER','1'); // Not disabled cause need to load personalized language
//if (! defined('NOREQUIREDB')) define('NOREQUIREDB','1'); // Not disabled cause need to load personalized language //if (! defined('NOREQUIREDB')) define('NOREQUIREDB','1'); // Not disabled cause need to load personalized language
if (!defined('NOREQUIRESOC')) define('NOREQUIRESOC', '1'); if (!defined('NOREQUIRESOC')) {
if (!defined('NOREQUIRETRAN')) define('NOREQUIRETRAN', '1'); define('NOREQUIRESOC', '1');
if (!defined('NOCSRFCHECK')) define('NOCSRFCHECK', '1'); }
if (!defined('NOTOKENRENEWAL')) define('NOTOKENRENEWAL', '1'); if (!defined('NOREQUIRETRAN')) {
if (!defined('NOREQUIREMENU')) define('NOREQUIREMENU', '1'); define('NOREQUIRETRAN', '1');
if (!defined('NOREQUIREHTML')) define('NOREQUIREHTML', '1'); }
if (!defined('NOREQUIREAJAX')) define('NOREQUIREAJAX', '1'); if (!defined('NOCSRFCHECK')) {
define('NOCSRFCHECK', '1');
}
if (!defined('NOTOKENRENEWAL')) {
define('NOTOKENRENEWAL', '1');
}
if (!defined('NOREQUIREMENU')) {
define('NOREQUIREMENU', '1');
}
if (!defined('NOREQUIREHTML')) {
define('NOREQUIREHTML', '1');
}
if (!defined('NOREQUIREAJAX')) {
define('NOREQUIREAJAX', '1');
}
// Some value of modulepart can be used to get resources that are public so no login are required. // Some value of modulepart can be used to get resources that are public so no login are required.
// Note that only directory logo is free to access without login. // Note that only directory logo is free to access without login.
if (isset($_GET["modulepart"]) && $_GET["modulepart"] == 'mycompany' && preg_match('/^\/?logos\//', $_GET['file'])) if (isset($_GET["modulepart"]) && $_GET["modulepart"] == 'mycompany' && preg_match('/^\/?logos\//', $_GET['file'])) {
{ if (!defined("NOLOGIN")) {
if (!defined("NOLOGIN")) define("NOLOGIN", 1); define("NOLOGIN", 1);
if (!defined("NOCSRFCHECK")) define("NOCSRFCHECK", 1); // We accept to go on this page from external web site. }
if (!defined("NOIPCHECK")) define("NOIPCHECK", 1); // Do not check IP defined into conf $dolibarr_main_restrict_ip if (!defined("NOCSRFCHECK")) {
define("NOCSRFCHECK", 1); // We accept to go on this page from external web site.
}
if (!defined("NOIPCHECK")) {
define("NOIPCHECK", 1); // Do not check IP defined into conf $dolibarr_main_restrict_ip
}
} }
// For direct external download link, we don't need to load/check we are into a login session // For direct external download link, we don't need to load/check we are into a login session
if (isset($_GET["hashp"]) && !defined("NOLOGIN")) if (isset($_GET["hashp"]) && !defined("NOLOGIN")) {
{ if (!defined("NOLOGIN")) {
if (!defined("NOLOGIN")) define("NOLOGIN", 1); define("NOLOGIN", 1);
if (!defined("NOCSRFCHECK")) define("NOCSRFCHECK", 1); // We accept to go on this page from external web site. }
if (!defined("NOIPCHECK")) define("NOIPCHECK", 1); // Do not check IP defined into conf $dolibarr_main_restrict_ip if (!defined("NOCSRFCHECK")) {
define("NOCSRFCHECK", 1); // We accept to go on this page from external web site.
}
if (!defined("NOIPCHECK")) {
define("NOIPCHECK", 1); // Do not check IP defined into conf $dolibarr_main_restrict_ip
}
} }
// Some value of modulepart can be used to get resources that are public so no login are required. // Some value of modulepart can be used to get resources that are public so no login are required.
if (isset($_GET["modulepart"]) && $_GET["modulepart"] == 'medias') if (isset($_GET["modulepart"]) && $_GET["modulepart"] == 'medias') {
{ if (!defined("NOLOGIN")) {
if (!defined("NOLOGIN")) define("NOLOGIN", 1); define("NOLOGIN", 1);
if (!defined("NOCSRFCHECK")) define("NOCSRFCHECK", 1); // We accept to go on this page from external web site. }
if (!defined("NOIPCHECK")) define("NOIPCHECK", 1); // Do not check IP defined into conf $dolibarr_main_restrict_ip if (!defined("NOCSRFCHECK")) {
define("NOCSRFCHECK", 1); // We accept to go on this page from external web site.
}
if (!defined("NOIPCHECK")) {
define("NOIPCHECK", 1); // Do not check IP defined into conf $dolibarr_main_restrict_ip
}
} }
// Used by TakePOS Auto Order // Used by TakePOS Auto Order
if (isset($_GET["modulepart"]) && $_GET["modulepart"] == 'product' && isset($_GET["publictakepos"])) if (isset($_GET["modulepart"]) && $_GET["modulepart"] == 'product' && isset($_GET["publictakepos"])) {
{ if (!defined("NOLOGIN")) {
if (!defined("NOLOGIN")) define("NOLOGIN", 1); define("NOLOGIN", 1);
if (!defined("NOCSRFCHECK")) define("NOCSRFCHECK", 1); // We accept to go on this page from external web site. }
if (!defined("NOIPCHECK")) define("NOIPCHECK", 1); // Do not check IP defined into conf $dolibarr_main_restrict_ip if (!defined("NOCSRFCHECK")) {
define("NOCSRFCHECK", 1); // We accept to go on this page from external web site.
}
if (!defined("NOIPCHECK")) {
define("NOIPCHECK", 1); // Do not check IP defined into conf $dolibarr_main_restrict_ip
}
} }
// For multicompany // For multicompany
$entity = (!empty($_GET['entity']) ? (int) $_GET['entity'] : (!empty($_POST['entity']) ? (int) $_POST['entity'] : 1)); $entity = (!empty($_GET['entity']) ? (int) $_GET['entity'] : (!empty($_POST['entity']) ? (int) $_POST['entity'] : 1));
if (is_numeric($entity)) define("DOLENTITY", $entity); if (is_numeric($entity)) {
define("DOLENTITY", $entity);
}
/** /**
* Header empty * Header empty
@ -101,9 +137,15 @@ $urlsource = GETPOST('urlsource', 'alpha');
$entity = GETPOST('entity', 'int') ?GETPOST('entity', 'int') : $conf->entity; $entity = GETPOST('entity', 'int') ?GETPOST('entity', 'int') : $conf->entity;
// Security check // Security check
if (empty($modulepart) && empty($hashp)) accessforbidden('Bad link. Bad value for parameter modulepart', 0, 0, 1); if (empty($modulepart) && empty($hashp)) {
if (empty($original_file) && empty($hashp) && $modulepart != 'barcode') accessforbidden('Bad link. Missing identification to find file (param file or hashp)', 0, 0, 1); accessforbidden('Bad link. Bad value for parameter modulepart', 0, 0, 1);
if ($modulepart == 'fckeditor') $modulepart = 'medias'; // For backward compatibility }
if (empty($original_file) && empty($hashp) && $modulepart != 'barcode') {
accessforbidden('Bad link. Missing identification to find file (param file or hashp)', 0, 0, 1);
}
if ($modulepart == 'fckeditor') {
$modulepart = 'medias'; // For backward compatibility
}
@ -119,38 +161,33 @@ if ($modulepart == 'fckeditor') $modulepart = 'medias'; // For backward compatib
* View * View
*/ */
if (GETPOST("cache", 'alpha')) if (GETPOST("cache", 'alpha')) {
{
// Important: Following code is to avoid page request by browser and PHP CPU at // Important: Following code is to avoid page request by browser and PHP CPU at
// each Dolibarr page access. // each Dolibarr page access.
if (empty($dolibarr_nocache)) if (empty($dolibarr_nocache)) {
{
header('Cache-Control: max-age=3600, public, must-revalidate'); header('Cache-Control: max-age=3600, public, must-revalidate');
header('Pragma: cache'); // This is to avoid having Pragma: no-cache header('Pragma: cache'); // This is to avoid having Pragma: no-cache
} else header('Cache-Control: no-cache'); } else {
header('Cache-Control: no-cache');
}
//print $dolibarr_nocache; exit; //print $dolibarr_nocache; exit;
} }
// If we have a hash public (hashp), we guess the original_file. // If we have a hash public (hashp), we guess the original_file.
if (!empty($hashp)) if (!empty($hashp)) {
{
include_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmfiles.class.php'; include_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmfiles.class.php';
$ecmfile = new EcmFiles($db); $ecmfile = new EcmFiles($db);
$result = $ecmfile->fetch(0, '', '', '', $hashp); $result = $ecmfile->fetch(0, '', '', '', $hashp);
if ($result > 0) if ($result > 0) {
{
$tmp = explode('/', $ecmfile->filepath, 2); // $ecmfile->filepath is relative to document directory $tmp = explode('/', $ecmfile->filepath, 2); // $ecmfile->filepath is relative to document directory
// filepath can be 'users/X' or 'X/propale/PR11111' // filepath can be 'users/X' or 'X/propale/PR11111'
if (is_numeric($tmp[0])) // If first tmp is numeric, it is subdir of company for multicompany, we take next part. if (is_numeric($tmp[0])) { // If first tmp is numeric, it is subdir of company for multicompany, we take next part.
{
$tmp = explode('/', $tmp[1], 2); $tmp = explode('/', $tmp[1], 2);
} }
$moduleparttocheck = $tmp[0]; // moduleparttocheck is first part of path $moduleparttocheck = $tmp[0]; // moduleparttocheck is first part of path
if ($modulepart) // Not required, so often not defined, for link using public hashp parameter. if ($modulepart) { // Not required, so often not defined, for link using public hashp parameter.
{ if ($moduleparttocheck == $modulepart) {
if ($moduleparttocheck == $modulepart)
{
// We remove first level of directory // We remove first level of directory
$original_file = (($tmp[1] ? $tmp[1].'/' : '').$ecmfile->filename); // this is relative to module dir $original_file = (($tmp[1] ? $tmp[1].'/' : '').$ecmfile->filename); // this is relative to module dir
//var_dump($original_file); exit; //var_dump($original_file); exit;
@ -169,13 +206,20 @@ if (!empty($hashp))
// Define mime type // Define mime type
$type = 'application/octet-stream'; $type = 'application/octet-stream';
if (GETPOST('type', 'alpha')) $type = GETPOST('type', 'alpha'); if (GETPOST('type', 'alpha')) {
else $type = dol_mimetype($original_file); $type = GETPOST('type', 'alpha');
} else {
$type = dol_mimetype($original_file);
}
// Security: This wrapper is for images. We do not allow type/html // Security: This wrapper is for images. We do not allow type/html
if (preg_match('/html/i', $type)) accessforbidden('Error: Using the image wrapper to output a file with a mime type HTML is not possible.', 0, 0, 1); if (preg_match('/html/i', $type)) {
accessforbidden('Error: Using the image wrapper to output a file with a mime type HTML is not possible.', 0, 0, 1);
}
// Security: This wrapper is for images. We do not allow files ending with .noexe // Security: This wrapper is for images. We do not allow files ending with .noexe
if (preg_match('/\.noexe$/i', $original_file)) accessforbidden('Error: Using the image wrapper to output a file ending with .noexe is not allowed.', 0, 0, 1); if (preg_match('/\.noexe$/i', $original_file)) {
accessforbidden('Error: Using the image wrapper to output a file ending with .noexe is not allowed.', 0, 0, 1);
}
// Security: Delete string ../ into $original_file // Security: Delete string ../ into $original_file
$original_file = str_replace("../", "/", $original_file); $original_file = str_replace("../", "/", $original_file);
@ -184,7 +228,9 @@ $original_file = str_replace("../", "/", $original_file);
$refname = basename(dirname($original_file)."/"); $refname = basename(dirname($original_file)."/");
// Security check // Security check
if (empty($modulepart)) accessforbidden('Bad value for parameter modulepart', 0, 0, 1); if (empty($modulepart)) {
accessforbidden('Bad value for parameter modulepart', 0, 0, 1);
}
$check_access = dol_check_secure_access_document($modulepart, $original_file, $entity, $refname); $check_access = dol_check_secure_access_document($modulepart, $original_file, $entity, $refname);
$accessallowed = $check_access['accessallowed']; $accessallowed = $check_access['accessallowed'];
@ -200,20 +246,15 @@ if (!empty($hashp)) {
} }
} else { } else {
// Basic protection (against external users only) // Basic protection (against external users only)
if ($user->socid > 0) if ($user->socid > 0) {
{ if ($sqlprotectagainstexternals) {
if ($sqlprotectagainstexternals)
{
$resql = $db->query($sqlprotectagainstexternals); $resql = $db->query($sqlprotectagainstexternals);
if ($resql) if ($resql) {
{
$num = $db->num_rows($resql); $num = $db->num_rows($resql);
$i = 0; $i = 0;
while ($i < $num) while ($i < $num) {
{
$obj = $db->fetch_object($resql); $obj = $db->fetch_object($resql);
if ($user->socid != $obj->fk_soc) if ($user->socid != $obj->fk_soc) {
{
$accessallowed = 0; $accessallowed = 0;
break; break;
} }
@ -232,8 +273,7 @@ if (!$accessallowed) {
// Security: // Security:
// On interdit les remontees de repertoire ainsi que les pipe dans les noms de fichiers. // On interdit les remontees de repertoire ainsi que les pipe dans les noms de fichiers.
if (preg_match('/\.\./', $fullpath_original_file) || preg_match('/[<>|]/', $fullpath_original_file)) if (preg_match('/\.\./', $fullpath_original_file) || preg_match('/[<>|]/', $fullpath_original_file)) {
{
dol_syslog("Refused to deliver file ".$fullpath_original_file); dol_syslog("Refused to deliver file ".$fullpath_original_file);
print "ErrorFileNameInvalid: ".dol_escape_htmltag($original_file); print "ErrorFileNameInvalid: ".dol_escape_htmltag($original_file);
exit; exit;
@ -241,15 +281,13 @@ if (preg_match('/\.\./', $fullpath_original_file) || preg_match('/[<>|]/', $full
if ($modulepart == 'barcode') if ($modulepart == 'barcode') {
{
$generator = GETPOST("generator", "alpha"); $generator = GETPOST("generator", "alpha");
$code = GETPOST("code", 'none'); // This can be rich content (qrcode, datamatrix, ...) $code = GETPOST("code", 'none'); // This can be rich content (qrcode, datamatrix, ...)
$encoding = GETPOST("encoding", "alpha"); $encoding = GETPOST("encoding", "alpha");
$readable = GETPOST("readable", 'alpha') ?GETPOST("readable", "alpha") : "Y"; $readable = GETPOST("readable", 'alpha') ?GETPOST("readable", "alpha") : "Y";
if (empty($generator) || empty($encoding)) if (empty($generator) || empty($encoding)) {
{
print 'Error: Parameter "generator" or "encoding" not defined'; print 'Error: Parameter "generator" or "encoding" not defined';
exit; exit;
} }
@ -258,23 +296,25 @@ if ($modulepart == 'barcode')
$result = 0; $result = 0;
foreach ($dirbarcode as $reldir) foreach ($dirbarcode as $reldir) {
{
$dir = dol_buildpath($reldir, 0); $dir = dol_buildpath($reldir, 0);
$newdir = dol_osencode($dir); $newdir = dol_osencode($dir);
// Check if directory exists (we do not use dol_is_dir to avoid loading files.lib.php) // Check if directory exists (we do not use dol_is_dir to avoid loading files.lib.php)
if (!is_dir($newdir)) continue; if (!is_dir($newdir)) {
continue;
}
$result = @include_once $newdir.$generator.'.modules.php'; $result = @include_once $newdir.$generator.'.modules.php';
if ($result) break; if ($result) {
break;
}
} }
// Load barcode class // Load barcode class
$classname = "mod".ucfirst($generator); $classname = "mod".ucfirst($generator);
$module = new $classname($db); $module = new $classname($db);
if ($module->encodingIsSupported($encoding)) if ($module->encodingIsSupported($encoding)) {
{
$result = $module->buildBarCode($code, $encoding, $readable); $result = $module->buildBarCode($code, $encoding, $readable);
} }
} else { } else {
@ -287,17 +327,15 @@ if ($modulepart == 'barcode')
dol_syslog("viewimage.php return file $fullpath_original_file filename=$filename content-type=$type"); dol_syslog("viewimage.php return file $fullpath_original_file filename=$filename content-type=$type");
// This test is to avoid error images when image is not available (for example thumbs). // This test is to avoid error images when image is not available (for example thumbs).
if (!dol_is_file($fullpath_original_file) && empty($_GET["noalt"])) if (!dol_is_file($fullpath_original_file) && empty($_GET["noalt"])) {
{
$fullpath_original_file = DOL_DOCUMENT_ROOT.'/public/theme/common/nophoto.png'; $fullpath_original_file = DOL_DOCUMENT_ROOT.'/public/theme/common/nophoto.png';
/*$error='Error: File '.$_GET["file"].' does not exists or filesystems permissions are not allowed'; /*$error='Error: File '.$_GET["file"].' does not exists or filesystems permissions are not allowed';
print $error; print $error;
exit;*/ exit;*/
} }
// Permissions are ok and file found, so we return it // Permissions are ok and file found, so we return it
if ($type) if ($type) {
{
top_httphead($type); top_httphead($type);
header('Content-Disposition: inline; filename="'.basename($fullpath_original_file).'"'); header('Content-Disposition: inline; filename="'.basename($fullpath_original_file).'"');
} else { } else {
@ -311,4 +349,6 @@ if ($modulepart == 'barcode')
} }
if (is_object($db)) $db->close(); if (is_object($db)) {
$db->close();
}