lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix #yogosha4463

Browse Source
This commit is contained in:
Laurent Destailleur 2020-09-26 05:20:33 +02:00
parent 68a6239322
commit 9d6e3be5d1
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
htdocs/main.inc.php
View File

@ -75,6 +75,7 @@ function testSqlAndScriptInject($val, $type)
$inj += preg_match('/into\s+(outfile|dumpfile)/i', $val);
$inj += preg_match('/user\s*\(/i', $val); // avoid to use function user() that return current database login
$inj += preg_match('/information_schema/i', $val); // avoid to use request that read information_schema database
$inj += preg_match('/<svg/i', $val); // <svg can be allowed in POST
}
if ($type == 3)
{
@ -174,7 +175,10 @@ if (!empty($_SERVER["PHP_SELF"]))
// Sanity check on GET parameters
if (!defined('NOSCANGETFORINJECTION') && !empty($_SERVER["QUERY_STRING"]))
{
$morevaltochecklikeget = array($_SERVER["QUERY_STRING"]);
// Note: QUERY_STRING is url encoded, but $_GET and $_POST are already decoded
// Because the analyseVarsForSqlAndScriptsInjection is designed for already url decoded value, we must decode QUERY_STRING
// Another solution is to provide $_GET as parameter
$morevaltochecklikeget = array(urldecode($_SERVER["QUERY_STRING"]));
analyseVarsForSqlAndScriptsInjection($morevaltochecklikeget, 1);
}
// Sanity check on POST

2
htdocs/public/payment/newpayment.php
View File

@ -1629,7 +1629,7 @@ if ($source == 'donation')
if (!$found && !$mesg) $mesg = $langs->trans("ErrorBadParameters");
if ($mesg) print '<tr><td align="center" colspan="2"><br><div class="warning">'.$mesg.'</div></td></tr>'."\n";
if ($mesg) print '<tr><td align="center" colspan="2"><br><div class="warning">'.dol_escape_htmltag($mesg).'</div></td></tr>'."\n";
print '</table>'."\n";
print "\n";