lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #14785 from aspangaro/10.0p53

Browse Source 
FIX Yogosha report 4456 (backport)
This commit is contained in:
Laurent Destailleur 2020-09-20 17:41:35 +02:00 committed by GitHub
commit a034ad76f8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 40 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
htdocs/conf/conf.php.example
View File

@ -217,10 +217,10 @@ $dolibarr_main_authentication='dolibarr';
// 1 = Force redirect to https, until SCRIPT_URI start with https into response // 1 = Force redirect to https, until SCRIPT_URI start with https into response
// 2 = Force redirect to https, until SERVER["HTTPS"] is 'on' into response // 2 = Force redirect to https, until SERVER["HTTPS"] is 'on' into response
// 'https://my.domain.com' = Force reditect to https using this domain name. // 'https://my.domain.com' = Force reditect to https using this domain name.
// Warning: If you enable this parameter, your web server must be configured to // Warning: If you enable this parameter, your web server must be configured to respond URL with https protocol.
// respond URL with https protocol. // According to your web server setup, some values may works and other not. Try different values (1,2 or 'https://my.domain.com') if you experience problems.
// According to your web server setup, some values may works and other not. Try // Even if a redirect to HTTPS is forced by the webserver, it is recommanded to set this value to another value than 0, so your session cookies will be
// different values (1,2 or 'https://my.domain.com') if you experience problems. // flagged as secured.
// Default value: 0 // Default value: 0
// Possible values: 0, 1, 2 or 'https://my.domain.com' // Possible values: 0, 1, 2 or 'https://my.domain.com'
// Examples: // Examples:
@ -231,12 +231,12 @@ $dolibarr_main_force_https='0';
// dolibarr_main_prod // dolibarr_main_prod
// When this parameter is defined, all errors messages are not reported. // When this parameter is defined, all errors messages are not reported.
// This feature exists for production usage to avoid to give any information to hackers. // This feature exists for production usage to avoid to give any information to hackers.
// Default value: 0 // Default value: 1
// Possible values: 0 or 1 // Possible values: 0 or 1
// Examples: // Examples:
// $dolibarr_main_prod='0'; // $dolibarr_main_prod='1';
// //
$dolibarr_main_prod='0'; $dolibarr_main_prod='1';
// $dolibarr_main_restrict_os_commands // $dolibarr_main_restrict_os_commands
// To restrict commands you can execute by the backup feature, enter allowed command here. // To restrict commands you can execute by the backup feature, enter allowed command here.
@ -258,8 +258,8 @@ $dolibarr_main_restrict_ip='';
// dolibarr_nocsrfcheck // dolibarr_nocsrfcheck
// This parameter can be used to disable CSRF protection. // This parameter can be used to disable CSRF protection.
// This might be required if you access Dolibarr behind a proxy that make // This might be required if you access Dolibarr behind a proxy that make bad URL rewriting, to avoid false alarms.
// URL rewriting, to avoid false alarms. // In most cases, you should always keep this to 0.
// Default value: 0 // Default value: 0
// Possible values: 0 or 1 // Possible values: 0 or 1
// Examples: // Examples:
@ -267,6 +267,12 @@ $dolibarr_main_restrict_ip='';
// //
$dolibarr_nocsrfcheck='0'; $dolibarr_nocsrfcheck='0';
// dolibarr_cron_allow_cli
// If set to 1, you will be able to define some command line in the internal Job scheduler (cronjob) module.
// Default value: '0'
// Examples: '1'
$dolibarr_cron_allow_cli='0';
// dolibarr_mailing_limit_sendbyweb // dolibarr_mailing_limit_sendbyweb
// Can set a limit for mailing send by web. This overwrite database value. Can be used to restrict on OS level. // Can set a limit for mailing send by web. This overwrite database value. Can be used to restrict on OS level.
// Default value: '25' // Default value: '25'

37
htdocs/cron/class/cronjob.class.php
View File

@ -1168,23 +1168,32 @@ class Cronjob extends CommonObject
// Run a command line // Run a command line
if ($this->jobtype=='command') if ($this->jobtype=='command')
{ {
$outputdir = $conf->cron->dir_temp; global $dolibarr_cron_allow_cli;
if (empty($outputdir)) $outputdir = $conf->cronjob->dir_temp;
if (! empty($outputdir)) if (empty($dolibarr_cron_allow_cli)) {
{ $langs->load("errors");
dol_mkdir($outputdir); $this->error = $langs->trans("FailedToExecutCommandJob");
$outputfile=$outputdir.'/cronjob.'.$userlogin.'.out'; // File used with popen method $this->lastoutput = '';
$this->lastresult = $langs->trans("ErrorParameterMustBeEnabledToAllwoThisFeature", 'dolibarr_cron_allow_cli');
} else {
$outputdir = $conf->cron->dir_temp;
if (empty($outputdir)) $outputdir = $conf->cronjob->dir_temp;
// Execute a CLI if (!empty($outputdir))
include_once DOL_DOCUMENT_ROOT.'/core/class/utils.class.php'; {
$utils = new Utils($this->db); dol_mkdir($outputdir);
$arrayresult = $utils->executeCLI($this->command, $outputfile); $outputfile = $outputdir.'/cronjob.'.$userlogin.'.out'; // File used with popen method
$retval = $arrayresult['result']; // Execute a CLI
$this->error = $arrayresult['error']; include_once DOL_DOCUMENT_ROOT.'/core/class/utils.class.php';
$this->lastoutput = $arrayresult['output']; $utils = new Utils($this->db);
$this->lastresult = $arrayresult['result']; $arrayresult = $utils->executeCLI($this->command, $outputfile);
$retval = $arrayresult['result'];
$this->error = $arrayresult['error'];
$this->lastoutput = $arrayresult['output'];
$this->lastresult = $arrayresult['result'];
}
} }
} }

1
htdocs/langs/en_US/errors.lang
View File

@ -218,6 +218,7 @@ ErrorVariableKeyForContentMustBeSet=Error, the constant with name %s (with text
ErrorURLMustStartWithHttp=URL %s must start with http:// or https:// ErrorURLMustStartWithHttp=URL %s must start with http:// or https://
ErrorNewRefIsAlreadyUsed=Error, the new reference is already used ErrorNewRefIsAlreadyUsed=Error, the new reference is already used
ErrorDeletePaymentLinkedToAClosedInvoiceNotPossible=Error, delete payment linked to a closed invoice is not possible. ErrorDeletePaymentLinkedToAClosedInvoiceNotPossible=Error, delete payment linked to a closed invoice is not possible.
ErrorParameterMustBeEnabledToAllwoThisFeature=Error, parameter <b>%s</b> must be enabled into <b>conf/conf.php<b> to allow use of Command Line Interface by the internal job scheduler
# Warnings # Warnings
WarningParamUploadMaxFileSizeHigherThanPostMaxSize=Your PHP parameter upload_max_filesize (%s) is higher than PHP parameter post_max_size (%s). This is not a consistent setup. WarningParamUploadMaxFileSizeHigherThanPostMaxSize=Your PHP parameter upload_max_filesize (%s) is higher than PHP parameter post_max_size (%s). This is not a consistent setup.
WarningPasswordSetWithNoAccount=A password was set for this member. However, no user account was created. So this password is stored but can't be used to login to Dolibarr. It may be used by an external module/interface but if you don't need to define any login nor password for a member, you can disable option "Manage a login for each member" from Member module setup. If you need to manage a login but don't need any password, you can keep this field empty to avoid this warning. Note: Email can also be used as a login if the member is linked to a user. WarningPasswordSetWithNoAccount=A password was set for this member. However, no user account was created. So this password is stored but can't be used to login to Dolibarr. It may be used by an external module/interface but if you don't need to define any login nor password for a member, you can disable option "Manage a login for each member" from Member module setup. If you need to manage a login but don't need any password, you can keep this field empty to avoid this warning. Note: Email can also be used as a login if the member is linked to a user.