lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX CVE-2017-7886

Browse Source
This commit is contained in:
Laurent Destailleur 2017-06-10 21:37:27 +02:00
parent d037515e37
commit 9c482b9f2a
11 changed files with 99 additions and 99 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/core/datepicker.php
View File

@ -39,7 +39,7 @@ if (! defined('NOREQUIREHTML')) define('NOREQUIREHTML',1);
require_once '../main.inc.php'; require_once '../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang')); // If language was forced on URL by the main.inc.php if (GETPOST('lang', 'aZ09')) $langs->setDefaultLang(GETPOST('lang', 'aZ09')); // If language was forced on URL by the main.inc.php
$langs->load("main"); $langs->load("main");
$langs->load("agenda"); $langs->load("agenda");
$right=($langs->trans("DIRECTION")=='rtl'?'left':'right'); $right=($langs->trans("DIRECTION")=='rtl'?'left':'right');

2
htdocs/core/get_menudiv.php
View File

@ -35,7 +35,7 @@ if (! defined('NOREQUIREHTML')) define('NOREQUIREHTML',1);
require_once '../main.inc.php'; require_once '../main.inc.php';
if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang')); // If language was forced on URL by the main.inc.php if (GETPOST('lang', 'aZ09')) $langs->setDefaultLang(GETPOST('lang', 'aZ09')); // If language was forced on URL by the main.inc.php
$langs->load("main"); $langs->load("main");
$right=($langs->trans("DIRECTION")=='rtl'?'left':'right'); $right=($langs->trans("DIRECTION")=='rtl'?'left':'right');
$left=($langs->trans("DIRECTION")=='rtl'?'right':'left'); $left=($langs->trans("DIRECTION")=='rtl'?'right':'left');

2
htdocs/core/lib/functions.lib.php
View File

@ -269,7 +269,7 @@ function GETPOST($paramname,$check='',$method=0,$filter=NULL,$options=NULL)
break; break;
case 'aZ09': case 'aZ09':
$out=trim($out); $out=trim($out);
if (preg_match('/[^a-z0-9]+/i',$out)) $out=''; if (preg_match('/[^a-z0-9_\-]+/i',$out)) $out='';
break; break;
case 'array': case 'array':
if (! is_array($out) || empty($out)) $out=array(); if (! is_array($out) || empty($out)) $out=array();

2
htdocs/core/search_page.php
View File

@ -35,7 +35,7 @@ if (! defined('NOREQUIREMENU')) define('NOREQUIREMENU',1);
require_once '../main.inc.php'; require_once '../main.inc.php';
if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang')); // If language was forced on URL by the main.inc.php if (GETPOST('lang', 'aZ09')) $langs->setDefaultLang(GETPOST('lang', 'aZ09')); // If language was forced on URL by the main.inc.php
$langs->load("main"); $langs->load("main");
$right=($langs->trans("DIRECTION")=='rtl'?'left':'right'); $right=($langs->trans("DIRECTION")=='rtl'?'left':'right');
$left=($langs->trans("DIRECTION")=='rtl'?'right':'left'); $left=($langs->trans("DIRECTION")=='rtl'?'right':'left');

2
htdocs/externalsite/frames.php
View File

@ -38,7 +38,7 @@ $mainmenu=GETPOST('mainmenu', 'alpha');
$leftmenu=GETPOST('leftmenu', 'alpha'); $leftmenu=GETPOST('leftmenu', 'alpha');
$idmenu=GETPOST('idmenu', 'int'); $idmenu=GETPOST('idmenu', 'int');
$theme=GETPOST('theme', 'alpha'); $theme=GETPOST('theme', 'alpha');
$codelang=GETPOST('lang', 'alpha'); $codelang=GETPOST('lang', 'aZ09');
print " print "
<html> <html>

2
htdocs/install/inc.php
View File

@ -258,7 +258,7 @@ if (function_exists('get_magic_quotes_gpc')) // magic_quotes_* removed in PHP 5.
// Defini objet langs // Defini objet langs
$langs = new Translate('..',$conf); $langs = new Translate('..',$conf);
if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang')); if (GETPOST('lang', 'aZ09')) $langs->setDefaultLang(GETPOST('lang', 'aZ09'));
else $langs->setDefaultLang('auto'); else $langs->setDefaultLang('auto');
$bc[false]=' class="bg1"'; $bc[false]=' class="bg1"';

4
htdocs/main.inc.php
View File

@ -567,7 +567,7 @@ if (! defined('NOLOGIN'))
$paramsurl=array(); $paramsurl=array();
if (GETPOST('textbrowser')) $paramsurl[]='textbrowser='.GETPOST('textbrowser','int'); if (GETPOST('textbrowser')) $paramsurl[]='textbrowser='.GETPOST('textbrowser','int');
if (GETPOST('nojs')) $paramsurl[]='nojs='.GETPOST('nojs','int'); if (GETPOST('nojs')) $paramsurl[]='nojs='.GETPOST('nojs','int');
if (GETPOST('lang')) $paramsurl[]='lang='.GETPOST('lang','alpha'); if (GETPOST('lang')) $paramsurl[]='lang='.GETPOST('lang', 'aZ09');
header('Location: '.DOL_URL_ROOT.'/index.php'.(count($paramsurl)?'?'.implode('&',$paramsurl):'')); header('Location: '.DOL_URL_ROOT.'/index.php'.(count($paramsurl)?'?'.implode('&',$paramsurl):''));
exit; exit;
} }
@ -626,7 +626,7 @@ if (! defined('NOLOGIN'))
$paramsurl=array(); $paramsurl=array();
if (GETPOST('textbrowser')) $paramsurl[]='textbrowser='.GETPOST('textbrowser','int'); if (GETPOST('textbrowser')) $paramsurl[]='textbrowser='.GETPOST('textbrowser','int');
if (GETPOST('nojs')) $paramsurl[]='nojs='.GETPOST('nojs','int'); if (GETPOST('nojs')) $paramsurl[]='nojs='.GETPOST('nojs','int');
if (GETPOST('lang')) $paramsurl[]='lang='.GETPOST('lang','alpha'); if (GETPOST('lang')) $paramsurl[]='lang='.GETPOST('lang', 'aZ09');
header('Location: '.DOL_URL_ROOT.'/index.php'.(count($paramsurl)?'?'.implode('&',$paramsurl):'')); header('Location: '.DOL_URL_ROOT.'/index.php'.(count($paramsurl)?'?'.implode('&',$paramsurl):''));
exit; exit;
} }

2
htdocs/master.inc.php
View File

@ -246,7 +246,7 @@ if (! defined('NOREQUIREDB') && ! defined('NOREQUIRESOC'))
// Set default language (must be after the setValues setting global $conf->global->MAIN_LANG_DEFAULT. Page main.inc.php will overwrite langs->defaultlang with user value later) // Set default language (must be after the setValues setting global $conf->global->MAIN_LANG_DEFAULT. Page main.inc.php will overwrite langs->defaultlang with user value later)
if (! defined('NOREQUIRETRAN')) if (! defined('NOREQUIRETRAN'))
{ {
$langcode=(GETPOST('lang')?GETPOST('lang','alpha',1):(empty($conf->global->MAIN_LANG_DEFAULT)?'auto':$conf->global->MAIN_LANG_DEFAULT)); $langcode=(GETPOST('lang', 'aZ09')?GETPOST('lang', 'aZ09', 1):(empty($conf->global->MAIN_LANG_DEFAULT)?'auto':$conf->global->MAIN_LANG_DEFAULT));
$langs->setDefaultLang($langcode); $langs->setDefaultLang($langcode);
} }

2
htdocs/support/inc.php
View File

@ -142,7 +142,7 @@ if (empty($conf->db->user)) $conf->db->user='';
// Defini objet langs // Defini objet langs
$langs = new Translate('..',$conf); $langs = new Translate('..',$conf);
if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang')); if (GETPOST('lang', 'aZ09')) $langs->setDefaultLang(GETPOST('lang', 'aZ09'));
else $langs->setDefaultLang('auto'); else $langs->setDefaultLang('auto');
$bc[false]=' class="bg1"'; $bc[false]=' class="bg1"';

2
htdocs/theme/eldy/style.css.php
View File

@ -53,7 +53,7 @@ else header('Cache-Control: no-cache');
// On the fly GZIP compression for all pages (if browser support it). Must set the bit 3 of constant to 1. // On the fly GZIP compression for all pages (if browser support it). Must set the bit 3 of constant to 1.
if (isset($conf->global->MAIN_OPTIMIZE_SPEED) && ($conf->global->MAIN_OPTIMIZE_SPEED & 0x04)) { ob_start("ob_gzhandler"); } if (isset($conf->global->MAIN_OPTIMIZE_SPEED) && ($conf->global->MAIN_OPTIMIZE_SPEED & 0x04)) { ob_start("ob_gzhandler"); }
if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang', 'alpha')); // If language was forced on URL if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang', 'aZ09')); // If language was forced on URL
if (GETPOST('theme')) $conf->theme=GETPOST('theme', 'alpha'); // If theme was forced on URL if (GETPOST('theme')) $conf->theme=GETPOST('theme', 'alpha'); // If theme was forced on URL
$langs->load("main",0,1); $langs->load("main",0,1);
$right=($langs->trans("DIRECTION")=='rtl'?'left':'right'); $right=($langs->trans("DIRECTION")=='rtl'?'left':'right');

2
htdocs/theme/md/style.css.php
View File

@ -54,7 +54,7 @@ else header('Cache-Control: no-cache');
// On the fly GZIP compression for all pages (if browser support it). Must set the bit 3 of constant to 1. // On the fly GZIP compression for all pages (if browser support it). Must set the bit 3 of constant to 1.
if (isset($conf->global->MAIN_OPTIMIZE_SPEED) && ($conf->global->MAIN_OPTIMIZE_SPEED & 0x04)) { ob_start("ob_gzhandler"); } if (isset($conf->global->MAIN_OPTIMIZE_SPEED) && ($conf->global->MAIN_OPTIMIZE_SPEED & 0x04)) { ob_start("ob_gzhandler"); }
if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang')); // If language was forced on URL if (GETPOST('lang')) $langs->setDefaultLang(GETPOST('lang', 'aZ09')); // If language was forced on URL
if (GETPOST('theme')) $conf->theme=GETPOST('theme'); // If theme was forced on URL if (GETPOST('theme')) $conf->theme=GETPOST('theme'); // If theme was forced on URL
$langs->load("main",0,1); $langs->load("main",0,1);
$right=($langs->trans("DIRECTION")=='rtl'?'left':'right'); $right=($langs->trans("DIRECTION")=='rtl'?'left':'right');