lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #22655 from hregis/fix_avoid_access_forbidden_with_numeric_ref

Browse Source 
FIX avoid access forbidden with numeric ref
This commit is contained in:
Laurent Destailleur 2022-10-24 17:21:57 +02:00 committed by GitHub
commit 937840dbfe
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
htdocs/core/lib/security.lib.php
View File

@ -289,6 +289,11 @@ function restrictedArea($user, $features, $objectid = 0, $tableandshare = '', $f
return 1;
}
// To avoid access forbidden with numeric ref
if ($dbt_select != 'rowid' && $dbt_select != 'id') {
$objectid = "'".$objectid."'";
}
// Features/modules to check
$featuresarray = array($features);
if (preg_match('/&/', $features)) {