lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX XSS security using the onerror and missing escapement on type of

Browse Source 
member page.
This commit is contained in:
Laurent Destailleur 2015-06-28 23:32:38 +02:00
parent 9d7806f1f4
commit 9c99cae911
3 changed files with 29 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
htdocs/adherents/type.php
View File

@ -51,6 +51,12 @@ $pagenext = $page + 1;
if (! $sortorder) { $sortorder="DESC"; } if (! $sortorder) { $sortorder="DESC"; }
if (! $sortfield) { $sortfield="d.lastname"; } if (! $sortfield) { $sortfield="d.lastname"; }
$label=GETPOST("libelle","alpha");
$cotisation=GETPOST("cotisation","int");
$vote=GETPOST("vote","int");
$comment=GETPOST("comment");
$mail_valid=GETPOST("mail_valid");
// Security check // Security check
$result=restrictedArea($user,'adherent',$rowid,'adherent_type'); $result=restrictedArea($user,'adherent',$rowid,'adherent_type');
@ -81,11 +87,11 @@ if ($action == 'add' && $user->rights->adherent->configurer)
{ {
$adht = new AdherentType($db); $adht = new AdherentType($db);
$adht->libelle = trim($_POST["libelle"]); $adht->libelle = trim($label);
$adht->cotisation = trim($_POST["cotisation"]); $adht->cotisation = trim($cotisation);
$adht->note = trim($_POST["comment"]); $adht->note = trim($comment);
$adht->mail_valid = trim($_POST["mail_valid"]); $adht->mail_valid = trim($mail_valid);
$adht->vote = trim($_POST["vote"]); $adht->vote = trim($vote);
// Fill array 'array_options' with data from add form // Fill array 'array_options' with data from add form
$ret = $extrafields->setOptionalsFromPost($extralabels,$adht); $ret = $extrafields->setOptionalsFromPost($extralabels,$adht);
@ -118,12 +124,12 @@ if ($action == 'update' && $user->rights->adherent->configurer)
if ($_POST["button"] != $langs->trans("Cancel")) if ($_POST["button"] != $langs->trans("Cancel"))
{ {
$adht = new AdherentType($db); $adht = new AdherentType($db);
$adht->id = $_POST["rowid"]; $adht->id = $rowid;
$adht->libelle = trim($_POST["libelle"]); $adht->libelle = trim($label);
$adht->cotisation = trim($_POST["cotisation"]); $adht->cotisation = trim($cotisation);
$adht->note = trim($_POST["comment"]); $adht->note = trim($comment);
$adht->mail_valid = trim($_POST["mail_valid"]); $adht->mail_valid = trim($mail_valid);
$adht->vote = trim($_POST["vote"]); $adht->vote = trim($vote);
// Fill array 'array_options' with data from add form // Fill array 'array_options' with data from add form
$ret = $extrafields->setOptionalsFromPost($extralabels,$adht); $ret = $extrafields->setOptionalsFromPost($extralabels,$adht);
@ -196,7 +202,7 @@ if (! $rowid && $action != 'create' && $action != 'edit')
$var=!$var; $var=!$var;
print "<tr ".$bc[$var].">"; print "<tr ".$bc[$var].">";
print '<td><a href="'.$_SERVER["PHP_SELF"].'?rowid='.$objp->rowid.'">'.img_object($langs->trans("ShowType"),'group').' '.$objp->rowid.'</a></td>'; print '<td><a href="'.$_SERVER["PHP_SELF"].'?rowid='.$objp->rowid.'">'.img_object($langs->trans("ShowType"),'group').' '.$objp->rowid.'</a></td>';
print '<td>'.$objp->libelle.'</td>'; print '<td>'.dol_escape_htmltag($objp->libelle).'</td>';
print '<td align="center">'.yn($objp->cotisation).'</td>'; print '<td align="center">'.yn($objp->cotisation).'</td>';
print '<td align="center">'.yn($objp->vote).'</td>'; print '<td align="center">'.yn($objp->vote).'</td>';
print '<td align="right"><a href="'.$_SERVER["PHP_SELF"].'?action=edit&rowid='.$objp->rowid.'">'.img_edit().'</a></td>'; print '<td align="right"><a href="'.$_SERVER["PHP_SELF"].'?action=edit&rowid='.$objp->rowid.'">'.img_edit().'</a></td>';
@ -314,7 +320,7 @@ if ($rowid > 0)
print '</td></tr>'; print '</td></tr>';
// Label // Label
print '<tr><td width="15%">'.$langs->trans("Label").'</td><td>'.$adht->libelle.'</td></tr>'; print '<tr><td width="15%">'.$langs->trans("Label").'</td><td>'.dol_escape_htmltag($adht->libelle).'</td></tr>';
print '<tr><td>'.$langs->trans("SubscriptionRequired").'</td><td>'; print '<tr><td>'.$langs->trans("SubscriptionRequired").'</td><td>';
print yn($adht->cotisation); print yn($adht->cotisation);
@ -491,15 +497,15 @@ if ($rowid > 0)
print '<tr class="liste_titre">'; print '<tr class="liste_titre">';
print '<td class="liste_titre" align="left">'; print '<td class="liste_titre" align="left">';
print '<input class="flat" type="text" name="search_lastname" value="'.$search_lastname.'" size="12"></td>'; print '<input class="flat" type="text" name="search_lastname" value="'.dol_escape_htmltag($search_lastname).'" size="12"></td>';
print '<td class="liste_titre" align="left">'; print '<td class="liste_titre" align="left">';
print '<input class="flat" type="text" name="search_login" value="'.$search_login.'" size="7"></td>'; print '<input class="flat" type="text" name="search_login" value="'.dol_escape_htmltag($search_login).'" size="7"></td>';
print '<td class="liste_titre">&nbsp;</td>'; print '<td class="liste_titre">&nbsp;</td>';
print '<td class="liste_titre" align="left">'; print '<td class="liste_titre" align="left">';
print '<input class="flat" type="text" name="search_email" value="'.$search_email.'" size="12"></td>'; print '<input class="flat" type="text" name="search_email" value="'.dol_escape_htmltag($search_email).'" size="12"></td>';
print '<td class="liste_titre">&nbsp;</td>'; print '<td class="liste_titre">&nbsp;</td>';
@ -561,7 +567,7 @@ if ($rowid > 0)
if ($datefin) if ($datefin)
{ {
print '<td align="center" class="nowrap">'; print '<td align="center" class="nowrap">';
if ($datefin < time() && $objp->statut > 0) if ($datefin < dol_now() && $objp->statut > 0)
{ {
print dol_print_date($datefin,'day')." ".img_warning($langs->trans("SubscriptionLate")); print dol_print_date($datefin,'day')." ".img_warning($langs->trans("SubscriptionLate"));
} }
@ -641,7 +647,7 @@ if ($rowid > 0)
print '<tr><td width="15%">'.$langs->trans("Ref").'</td><td>'.$adht->id.'</td></tr>'; print '<tr><td width="15%">'.$langs->trans("Ref").'</td><td>'.$adht->id.'</td></tr>';
print '<tr><td>'.$langs->trans("Label").'</td><td><input type="text" name="libelle" size="40" value="'.$adht->libelle.'"></td></tr>'; print '<tr><td>'.$langs->trans("Label").'</td><td><input type="text" name="libelle" size="40" value="'.dol_escape_htmltag($adht->libelle).'"></td></tr>';
print '<tr><td>'.$langs->trans("SubscriptionRequired").'</td><td>'; print '<tr><td>'.$langs->trans("SubscriptionRequired").'</td><td>';
print $form->selectyesno("cotisation",$adht->cotisation,1); print $form->selectyesno("cotisation",$adht->cotisation,1);
@ -687,6 +693,7 @@ if ($rowid > 0)
} }
} }
$db->close();
llxFooter(); llxFooter();
$db->close();

4
htdocs/core/lib/functions.lib.php
View File

@ -189,7 +189,7 @@ function dol_shutdown()
* Return value of a param into GET or POST supervariable * Return value of a param into GET or POST supervariable
* *
* @param string $paramname Name of parameter to found * @param string $paramname Name of parameter to found
* @param string $check Type of check (''=no check, 'int'=check it's numeric, 'alpha'=check it's text and sign, 'aZ'=check it's a-z only, 'array'=check it's array, 'san_alpha'= Use filter_var with FILTER_SANITIZE_STRING (do not use this for free text string), 'custom'= custom filter specify $filter and $options) * @param string $check Type of check (''=no check, 'int'=check it's numeric, 'alpha'=check it's text and sign, 'aZ'=check it's a-z only, 'array'=check it's array, 'san_alpha'=Use filter_var with FILTER_SANITIZE_STRING (do not use this for free text string), 'custom'= custom filter specify $filter and $options)
* @param int $method Type of method (0 = get then post, 1 = only get, 2 = only post, 3 = post then get, 4 = post then get then cookie) * @param int $method Type of method (0 = get then post, 1 = only get, 2 = only post, 3 = post then get, 4 = post then get then cookie)
* @param int $filter Filter to apply when $check is set to custom. (See http://php.net/manual/en/filter.filters.php for détails) * @param int $filter Filter to apply when $check is set to custom. (See http://php.net/manual/en/filter.filters.php for détails)
* @param mixed $options Options to pass to filter_var when $check is set to custom * @param mixed $options Options to pass to filter_var when $check is set to custom
@ -507,7 +507,7 @@ function dol_escape_js($stringtoescape, $mode=0, $noescapebackslashn=0)
/** /**
* Returns text escaped for inclusion in HTML alt or title tags, or into values of HTMPL input fields * Returns text escaped for inclusion in HTML alt or title tags, or into values of HTML input fields.
* *
* @param string $stringtoescape String to escape * @param string $stringtoescape String to escape
* @param int $keepb Do not clean b tags * @param int $keepb Do not clean b tags

1
htdocs/main.inc.php
View File

@ -89,6 +89,7 @@ function test_sql_and_script_inject($val, $type)
$sql_inj += preg_match('/union.+select/i', $val); $sql_inj += preg_match('/union.+select/i', $val);
$sql_inj += preg_match('/into\s+(outfile|dumpfile)/i', $val); $sql_inj += preg_match('/into\s+(outfile|dumpfile)/i', $val);
$sql_inj += preg_match('/(\.\.%2f)+/i', $val); $sql_inj += preg_match('/(\.\.%2f)+/i', $val);
$sql_inj += preg_match('/onerror=/i', $val);
} }
// For XSS Injection done by adding javascript with script // For XSS Injection done by adding javascript with script
// This is all cases a browser consider text is javascript: // This is all cases a browser consider text is javascript: