lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #17510 from Hystepik/develo#2

Browse Source 
Fix #17501 : Undownloable attached file
This commit is contained in:
Laurent Destailleur 2021-05-06 16:00:20 +02:00 committed by GitHub
commit a0f85044fc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
htdocs/core/actions_linkedfiles.inc.php
View File

@ -44,6 +44,10 @@ if (GETPOST('sendit', 'alpha') && !empty($conf->global->MAIN_UPLOAD_DOC)) {
setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("File")), null, 'errors'); setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("File")), null, 'errors');
} }
} }
if (preg_match('/__.*__/', $_FILES['userfile']['name'][$key])) {
$error++;
setEventMessages($langs->trans('ErrorWrongFileName'), null, 'errors');
}
} }
if (!$error) { if (!$error) {
@ -172,8 +176,11 @@ if ($action == 'confirm_deletefile' && $confirm == 'yes') {
// We apply dol_string_nohtmltag also to clean file names (this remove duplicate spaces) because // We apply dol_string_nohtmltag also to clean file names (this remove duplicate spaces) because
// this function is also applied when we upload and when we make try to download file (by the GETPOST(filename, 'alphanohtml') call). // this function is also applied when we upload and when we make try to download file (by the GETPOST(filename, 'alphanohtml') call).
$filenameto = dol_string_nohtmltag($filenameto); $filenameto = dol_string_nohtmltag($filenameto);
if (preg_match('/__.*__/', $filenameto)) {
if ($filenamefrom != $filenameto) { $error++;
setEventMessages($langs->trans('ErrorWrongFileName'), null, 'errors');
}
if (!$error && $filenamefrom != $filenameto) {
// Security: // Security:
// Disallow file with some extensions. We rename them. // Disallow file with some extensions. We rename them.
// Because if we put the documents directory into a directory inside web root (very bad), this allows to execute on demand arbitrary code. // Because if we put the documents directory into a directory inside web root (very bad), this allows to execute on demand arbitrary code.

1
htdocs/langs/en_US/errors.lang
View File

@ -299,3 +299,4 @@ WarningModuleXDisabledSoYouMayMissEventHere=Module %s has not been enabled. So y
ErrorActionCommPropertyUserowneridNotDefined=User's owner is required ErrorActionCommPropertyUserowneridNotDefined=User's owner is required
ErrorActionCommBadType=Selected event type (id: %n, code: %s) do not exist in Event Type dictionary ErrorActionCommBadType=Selected event type (id: %n, code: %s) do not exist in Event Type dictionary
CheckVersionFail=Version check fail CheckVersionFail=Version check fail
ErrorWrongFileName=Name of the file cannot have __SOMETHING__ in it