From a0d56b6db764736c1e6b1bc0cc2b799f1ffc7654 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sun, 14 Aug 2022 19:14:20 +0200 Subject: [PATCH] FIX the online signature feature --- htdocs/core/lib/signature.lib.php | 2 +- htdocs/public/onlinesign/newonlinesign.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/core/lib/signature.lib.php b/htdocs/core/lib/signature.lib.php index 6a8d824872d..33b0a1e8e5e 100644 --- a/htdocs/core/lib/signature.lib.php +++ b/htdocs/core/lib/signature.lib.php @@ -91,7 +91,7 @@ function getOnlineSignatureUrl($mode, $type, $ref = '', $localorexternal = 1) if ($mode == 1) { $out .= "hash('".$securekeyseed."' + '".$type."' + proposal_ref)"; } else { - $out .= '&securekey='.dol_hash($securekeyseed.$type.$ref.$object->entity, '0'); + $out .= '&securekey='.dol_hash($securekeyseed.$type.$ref, '0'); } /* if ($mode == 1) { diff --git a/htdocs/public/onlinesign/newonlinesign.php b/htdocs/public/onlinesign/newonlinesign.php index 9ebea80aeb3..87aef8163e1 100644 --- a/htdocs/public/onlinesign/newonlinesign.php +++ b/htdocs/public/onlinesign/newonlinesign.php @@ -139,7 +139,7 @@ if ($source == 'proposal') { $securekeyseed = $conf->global->PROPOSAL_ONLINE_SIGNATURE_SECURITY_TOKEN; } -if (!dol_verifyHash($securekeyseed.$type.$ref.$object->entity, $SECUREKEY, '0')) { +if (!dol_verifyHash($securekeyseed.$type.$ref, $SECUREKEY, '0')) { http_response_code(403); print 'Bad value for securitykey. Value provided '.dol_escape_htmltag($SECUREKEY).' does not match expected value for ref='.dol_escape_htmltag($ref); exit(-1);