From 9d29ae8f1046c14634f638817733d906c9830869 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20FRANCE?= Date: Wed, 3 May 2023 14:22:30 +0200 Subject: [PATCH] wip --- htdocs/core/modules/mailings/modules_mailings.php | 3 +-- htdocs/core/tpl/passwordreset.tpl.php | 6 +++--- htdocs/public/users/view.php | 4 ++-- 3 files changed, 6 insertions(+), 7 deletions(-) diff --git a/htdocs/core/modules/mailings/modules_mailings.php b/htdocs/core/modules/mailings/modules_mailings.php index 5a99a44dc0f..28c9e6cc034 100644 --- a/htdocs/core/modules/mailings/modules_mailings.php +++ b/htdocs/core/modules/mailings/modules_mailings.php @@ -180,7 +180,6 @@ class MailingTargets // This can't be abstract as it is used for some method public function addTargetsToDatabase($mailing_id, $cibles) { global $conf; - global $dolibarr_main_instance_unique_id; $this->db->begin(); @@ -203,7 +202,7 @@ class MailingTargets // This can't be abstract as it is used for some method $sql .= "'".$this->db->escape($targetarray['other'])."',"; $sql .= "'".$this->db->escape($targetarray['source_url'])."',"; $sql .= (empty($targetarray['source_id']) ? 'null' : "'".$this->db->escape($targetarray['source_id'])."'").","; - $sql .= "'".$this->db->escape(dol_hash($dolibarr_main_instance_unique_id.";".$targetarray['email'].";".$targetarray['lastname'].";".((int) $mailing_id).";".getDolGlobalString('MAILING_EMAIL_UNSUBSCRIBE_KEY'), 'md5'))."',"; + $sql .= "'".$this->db->escape(dol_hash($conf->file->instance_unique_id.";".$targetarray['email'].";".$targetarray['lastname'].";".((int) $mailing_id).";".getDolGlobalString('MAILING_EMAIL_UNSUBSCRIBE_KEY'), 'md5'))."',"; $sql .= "'".$this->db->escape($targetarray['source_type'])."')"; dol_syslog(__METHOD__, LOG_DEBUG); $result = $this->db->query($sql); diff --git a/htdocs/core/tpl/passwordreset.tpl.php b/htdocs/core/tpl/passwordreset.tpl.php index 96cde6cf032..901a085ee33 100644 --- a/htdocs/core/tpl/passwordreset.tpl.php +++ b/htdocs/core/tpl/passwordreset.tpl.php @@ -97,10 +97,10 @@ if ($setnewpassword && $username && $passworduidhash) { if ($result < 0) { $message = '
'.dol_escape_htmltag($langs->trans("ErrorTechnicalError")).'
'; } else { - global $dolibarr_main_instance_unique_id; + global $conf; - //print $edituser->pass_temp.'-'.$edituser->id.'-'.$dolibarr_main_instance_unique_id.' '.$passworduidhash; - if ($edituser->pass_temp && dol_verifyHash($edituser->pass_temp.'-'.$edituser->id.'-'.$dolibarr_main_instance_unique_id, $passworduidhash)) { + //print $edituser->pass_temp.'-'.$edituser->id.'-'.$conf->file->instance_unique_id.' '.$passworduidhash; + if ($edituser->pass_temp && dol_verifyHash($edituser->pass_temp.'-'.$edituser->id.'-'.$conf->file->instance_unique_id, $passworduidhash)) { // Clear session unset($_SESSION['dol_login']); diff --git a/htdocs/public/users/view.php b/htdocs/public/users/view.php index 4da6d3baad9..c28175b898d 100644 --- a/htdocs/public/users/view.php +++ b/htdocs/public/users/view.php @@ -62,8 +62,8 @@ $object->fetch($id, '', '', 1); $urlwithroot = DOL_MAIN_URL_ROOT; // This is to use same domain name than current. For Paypal payment, we can use internal URL like localhost. // Security check -global $dolibarr_main_instance_unique_id; -$encodedsecurekey = dol_hash($dolibarr_main_instance_unique_id.'uservirtualcard'.$object->id.'-'.$object->login, 'md5'); +global $conf; +$encodedsecurekey = dol_hash($conf->file->instance_unique_id.'uservirtualcard'.$object->id.'-'.$object->login, 'md5'); if ($encodedsecurekey != $securekey) { httponly_accessforbidden('Bad value for securitykey or public profile not enabled'); }