lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch '3.1' of ssh://git@github.com/Dolibarr/dolibarr.git into 3.1

Browse Source
This commit is contained in:
Laurent Destailleur 2011-11-09 11:54:27 +01:00
commit 966c82f96c
3 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
htdocs/compta/deplacement/index.php
View File

@ -65,6 +65,7 @@ llxHeader('',$langs->trans("ListOfFees"),$help_url);
$totalnb=0; $totalnb=0;
$sql = "SELECT count(d.rowid) as nb, sum(d.km) as km, d.type"; $sql = "SELECT count(d.rowid) as nb, sum(d.km) as km, d.type";
$sql.= " FROM ".MAIN_DB_PREFIX."deplacement as d"; $sql.= " FROM ".MAIN_DB_PREFIX."deplacement as d";
$sql.= " WHERE d.entity = ".$conf->entity;
$sql.= " GROUP BY d.type"; $sql.= " GROUP BY d.type";
$sql.= " ORDER BY d.type"; $sql.= " ORDER BY d.type";

2
htdocs/lib/security.lib.php
View File

@ -181,7 +181,7 @@ function dol_loginfunction($langs,$conf,$mysoc)
} }
// Login // Login
$login = (!empty($lastuser)?$lastuser:(GETPOST("username")?GETPOST("username"):$demologin)); $login = (!empty($lastuser)?$lastuser:(GETPOST("username","alpha",2)?GETPOST("username","alpha",2):$demologin));
$password = $demopassword; $password = $demopassword;
// Show logo (search in order: small company logo, large company logo, theme logo, common logo) // Show logo (search in order: small company logo, large company logo, theme logo, common logo)

13
htdocs/main.inc.php
View File

@ -76,6 +76,9 @@ function test_sql_and_script_inject($val,$get)
$sql_inj += preg_match('/(\.\.%2f)+/i', $val); $sql_inj += preg_match('/(\.\.%2f)+/i', $val);
// For XSS Injection done by adding javascript with script // For XSS Injection done by adding javascript with script
$sql_inj += preg_match('/<script/i', $val); $sql_inj += preg_match('/<script/i', $val);
$sql_inj += preg_match('/img[\s]+src/i', $val);
$sql_inj += preg_match('/base[\s]+href/i', $val);
$sql_inj += preg_match('/style([\s]+)?=/i', $val);
if ($get) $sql_inj += preg_match('/javascript:/i', $val); if ($get) $sql_inj += preg_match('/javascript:/i', $val);
// For XSS Injection done by adding javascript with onmousemove, etc... (closing a src or href tag with not cleaned param) // For XSS Injection done by adding javascript with onmousemove, etc... (closing a src or href tag with not cleaned param)
if ($get) $sql_inj += preg_match('/"/i', $val); // We refused " in GET parameters value if ($get) $sql_inj += preg_match('/"/i', $val); // We refused " in GET parameters value
@ -324,7 +327,7 @@ if (! defined('NOLOGIN'))
} }
// Verification security graphic code // Verification security graphic code
if (isset($_POST["username"]) && ! empty($conf->global->MAIN_SECURITY_ENABLECAPTCHA)) if (GETPOST("username","alpha",2) && ! empty($conf->global->MAIN_SECURITY_ENABLECAPTCHA))
{ {
require_once DOL_DOCUMENT_ROOT.'/includes/artichow/Artichow.cfg.php'; require_once DOL_DOCUMENT_ROOT.'/includes/artichow/Artichow.cfg.php';
require_once ARTICHOW."/AntiSpam.class.php"; require_once ARTICHOW."/AntiSpam.class.php";
@ -339,7 +342,7 @@ if (! defined('NOLOGIN'))
$langs->load('main'); $langs->load('main');
$langs->load('other'); $langs->load('other');
$user->trigger_mesg='ErrorBadValueForCode - login='.$_POST["username"]; $user->trigger_mesg='ErrorBadValueForCode - login='.GETPOST("username","alpha",2);
$_SESSION["dol_loginmesg"]=$langs->trans("ErrorBadValueForCode"); $_SESSION["dol_loginmesg"]=$langs->trans("ErrorBadValueForCode");
$test=false; $test=false;
@ -365,7 +368,7 @@ if (! defined('NOLOGIN'))
// If error, we will put error message in session under the name dol_loginmesg // If error, we will put error message in session under the name dol_loginmesg
$goontestloop=false; $goontestloop=false;
if (isset($_SERVER["REMOTE_USER"]) && in_array('http',$authmode)) $goontestloop=true; if (isset($_SERVER["REMOTE_USER"]) && in_array('http',$authmode)) $goontestloop=true;
if (isset($_POST["username"]) || GETPOST('openid_mode','alpha',1)) $goontestloop=true; if (GETPOST("username","alpha",2) || GETPOST('openid_mode','alpha',1)) $goontestloop=true;
if ($test && $goontestloop) if ($test && $goontestloop)
{ {
@ -378,7 +381,7 @@ if (! defined('NOLOGIN'))
if ($result) if ($result)
{ {
// Call function to check user/password // Call function to check user/password
$usertotest=$_POST["username"]; $usertotest=GETPOST("username","alpha",2);
$passwordtotest=$_POST["password"]; $passwordtotest=$_POST["password"];
$entitytotest=$_POST["entity"]; $entitytotest=$_POST["entity"];
$function='check_user_password_'.$mode; $function='check_user_password_'.$mode;
@ -411,7 +414,7 @@ if (! defined('NOLOGIN'))
$langs->load('other'); $langs->load('other');
// Bad password. No authmode has found a good password. // Bad password. No authmode has found a good password.
$user->trigger_mesg=$langs->trans("ErrorBadLoginPassword").' - login='.$_POST["username"]; $user->trigger_mesg=$langs->trans("ErrorBadLoginPassword").' - login='.GETPOST("username","alpha",2);
$_SESSION["dol_loginmesg"]=$langs->trans("ErrorBadLoginPassword"); $_SESSION["dol_loginmesg"]=$langs->trans("ErrorBadLoginPassword");
// Appel des triggers // Appel des triggers