lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix $dolibarr_main_restrict_os_commands applies also to antivir command

Browse Source
This commit is contained in:
Laurent Destailleur 2023-02-11 16:02:51 +01:00
parent 81ef87cf6d
commit 954906ec48
3 changed files with 32 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
htdocs/admin/security_file.php
View File

@ -32,10 +32,6 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
// Load translation files required by the page // Load translation files required by the page
$langs->loadLangs(array('users', 'admin', 'other')); $langs->loadLangs(array('users', 'admin', 'other'));
if (!$user->admin) {
accessforbidden();
}
$action = GETPOST('action', 'aZ09'); $action = GETPOST('action', 'aZ09');
$sortfield = GETPOST('sortfield', 'aZ09'); $sortfield = GETPOST('sortfield', 'aZ09');
$sortorder = GETPOST('sortorder', 'aZ09'); $sortorder = GETPOST('sortorder', 'aZ09');
@ -48,6 +44,12 @@ if (empty($sortorder)) {
$upload_dir = $conf->admin->dir_temp; $upload_dir = $conf->admin->dir_temp;
if (!$user->admin) {
accessforbidden();
}
$error = 0;
/* /*
* Actions * Actions
@ -65,12 +67,26 @@ if ($action == 'updateform') {
$antivircommand = dol_string_nospecial($antivircommand, '', array("|", ";", "<", ">", "&")); // Sanitize command $antivircommand = dol_string_nospecial($antivircommand, '', array("|", ";", "<", ">", "&")); // Sanitize command
$antivirparam = dol_string_nospecial($antivirparam, '', array("|", ";", "<", ">", "&")); // Sanitize params $antivirparam = dol_string_nospecial($antivirparam, '', array("|", ";", "<", ">", "&")); // Sanitize params
$res3 = dolibarr_set_const($db, 'MAIN_UPLOAD_DOC', GETPOST('MAIN_UPLOAD_DOC', 'alpha'), 'chaine', 0, '', $conf->entity); if (!empty($dolibarr_main_restrict_os_commands)) {
$res4 = dolibarr_set_const($db, "MAIN_UMASK", GETPOST('MAIN_UMASK', 'alpha'), 'chaine', 0, '', $conf->entity); $arrayofallowedcommand = explode(',', $dolibarr_main_restrict_os_commands);
$res5 = dolibarr_set_const($db, "MAIN_ANTIVIRUS_COMMAND", trim($antivircommand), 'chaine', 0, '', $conf->entity); $arrayofallowedcommand = array_map('trim', $arrayofallowedcommand);
$res6 = dolibarr_set_const($db, "MAIN_ANTIVIRUS_PARAM", trim($antivirparam), 'chaine', 0, '', $conf->entity); dol_syslog("Command are restricted to ".$dolibarr_main_restrict_os_commands.". We check that one of this command is inside ".$antivircommand);
if ($res3 && $res4 && $res5 && $res6) { $basenamecmddump = basename(str_replace('\\', '/', $antivircommand));
setEventMessages($langs->trans("RecordModifiedSuccessfully"), null, 'mesgs'); if (!in_array($basenamecmddump, $arrayofallowedcommand)) { // the provided command $cmddump must be an allowed command
$errormsg = $langs->trans('CommandIsNotInsideAllowedCommands');
setEventMessages($errormsg, null, 'errors');
$error++;
}
}
if (!$error) {
$res3 = dolibarr_set_const($db, 'MAIN_UPLOAD_DOC', GETPOST('MAIN_UPLOAD_DOC', 'alpha'), 'chaine', 0, '', $conf->entity);
$res4 = dolibarr_set_const($db, "MAIN_UMASK", GETPOST('MAIN_UMASK', 'alpha'), 'chaine', 0, '', $conf->entity);
$res5 = dolibarr_set_const($db, "MAIN_ANTIVIRUS_COMMAND", trim($antivircommand), 'chaine', 0, '', $conf->entity);
$res6 = dolibarr_set_const($db, "MAIN_ANTIVIRUS_PARAM", trim($antivirparam), 'chaine', 0, '', $conf->entity);
if ($res3 && $res4 && $res5 && $res6) {
setEventMessages($langs->trans("RecordModifiedSuccessfully"), null, 'mesgs');
}
} }
} elseif ($action == 'deletefile') { } elseif ($action == 'deletefile') {
// Delete file // Delete file
@ -160,7 +176,7 @@ if (ini_get('safe_mode') && !empty($conf->global->MAIN_ANTIVIRUS_COMMAND)) {
dol_syslog("safe_mode is on, basedir is ".$basedir.", safe_mode_exec_dir is ".ini_get('safe_mode_exec_dir'), LOG_WARNING); dol_syslog("safe_mode is on, basedir is ".$basedir.", safe_mode_exec_dir is ".ini_get('safe_mode_exec_dir'), LOG_WARNING);
} }
} }
print '<input type="text" '.((defined('MAIN_ANTIVIRUS_COMMAND') && !defined('MAIN_ANTIVIRUS_BYPASS_COMMAND_AND_PARAM')) ? 'disabled ' : '').'name="MAIN_ANTIVIRUS_COMMAND" class="minwidth500imp" value="'.(!empty($conf->global->MAIN_ANTIVIRUS_COMMAND) ?dol_escape_htmltag($conf->global->MAIN_ANTIVIRUS_COMMAND) : '').'">'; print '<input type="text" '.((defined('MAIN_ANTIVIRUS_COMMAND') && !defined('MAIN_ANTIVIRUS_BYPASS_COMMAND_AND_PARAM')) ? 'disabled ' : '').'name="MAIN_ANTIVIRUS_COMMAND" class="minwidth500imp" value="'.dol_escape_htmltag(GETPOSTISSET('MAIN_ANTIVIRUS_COMMAND') ? GETPOST('MAIN_ANTIVIRUS_COMMAND') : getDolGlobalString('MAIN_ANTIVIRUS_COMMAND')).'">';
if (defined('MAIN_ANTIVIRUS_COMMAND') && !defined('MAIN_ANTIVIRUS_BYPASS_COMMAND_AND_PARAM')) { if (defined('MAIN_ANTIVIRUS_COMMAND') && !defined('MAIN_ANTIVIRUS_BYPASS_COMMAND_AND_PARAM')) {
print '<br><span class="opacitymedium">'.$langs->trans("ValueIsForcedBySystem").'</span>'; print '<br><span class="opacitymedium">'.$langs->trans("ValueIsForcedBySystem").'</span>';
} }

6
htdocs/admin/tools/export.php
View File

@ -123,8 +123,9 @@ if ($what == 'mysql') {
if (!empty($dolibarr_main_restrict_os_commands)) { if (!empty($dolibarr_main_restrict_os_commands)) {
$arrayofallowedcommand = explode(',', $dolibarr_main_restrict_os_commands); $arrayofallowedcommand = explode(',', $dolibarr_main_restrict_os_commands);
$arrayofallowedcommand = array_map('trim', $arrayofallowedcommand);
dol_syslog("Command are restricted to ".$dolibarr_main_restrict_os_commands.". We check that one of this command is inside ".$cmddump); dol_syslog("Command are restricted to ".$dolibarr_main_restrict_os_commands.". We check that one of this command is inside ".$cmddump);
$basenamecmddump = basename($cmddump); $basenamecmddump = basename(str_replace('\\', '/', $cmddump));
if (!in_array($basenamecmddump, $arrayofallowedcommand)) { // the provided command $cmddump must be an allowed command if (!in_array($basenamecmddump, $arrayofallowedcommand)) { // the provided command $cmddump must be an allowed command
$errormsg = $langs->trans('CommandIsNotInsideAllowedCommands'); $errormsg = $langs->trans('CommandIsNotInsideAllowedCommands');
} }
@ -160,8 +161,9 @@ if ($what == 'postgresql') {
if (!empty($dolibarr_main_restrict_os_commands)) if (!empty($dolibarr_main_restrict_os_commands))
{ {
$arrayofallowedcommand=explode(',', $dolibarr_main_restrict_os_commands); $arrayofallowedcommand=explode(',', $dolibarr_main_restrict_os_commands);
$arrayofallowedcommand = array_map('trim', $arrayofallowedcommand);
dol_syslog("Command are restricted to ".$dolibarr_main_restrict_os_commands.". We check that one of this command is inside ".$cmddump); dol_syslog("Command are restricted to ".$dolibarr_main_restrict_os_commands.". We check that one of this command is inside ".$cmddump);
$basenamecmddump=basename($cmddump); $basenamecmddump = basename(str_replace('\\', '/', $cmddump));
if (! in_array($basenamecmddump, $arrayofallowedcommand)) // the provided command $cmddump must be an allowed command if (! in_array($basenamecmddump, $arrayofallowedcommand)) // the provided command $cmddump must be an allowed command
{ {
$errormsg=$langs->trans('CommandIsNotInsideAllowedCommands'); $errormsg=$langs->trans('CommandIsNotInsideAllowedCommands');

2
htdocs/install/step1.php
View File

@ -908,7 +908,7 @@ function write_conf_file($conffile)
fputs($fp, '$dolibarr_main_force_https=\''.$main_force_https.'\';'); fputs($fp, '$dolibarr_main_force_https=\''.$main_force_https.'\';');
fputs($fp, "\n"); fputs($fp, "\n");
fputs($fp, '$dolibarr_main_restrict_os_commands=\'mysqldump, mysql, pg_dump, pgrestore\';'); fputs($fp, '$dolibarr_main_restrict_os_commands=\'mysqldump, mysql, pg_dump, pgrestore, clamdscan, clamscan.exe\';');
fputs($fp, "\n"); fputs($fp, "\n");
fputs($fp, '$dolibarr_nocsrfcheck=\'0\';'); fputs($fp, '$dolibarr_nocsrfcheck=\'0\';');