lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

every dol_encode for securekey replaced with dol_hash (dol_encode kept for encoding ids

Browse Source
This commit is contained in:
Dorian Vabre 2021-04-27 14:01:44 +02:00
parent d034446205
commit a508cdbf59
5 changed files with 21 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/eventorganization/class/conferenceorbooth.class.php
View File

@ -244,7 +244,7 @@ class ConferenceOrBooth extends ActionComm
$encodedid = dol_encode($id, $dolibarr_main_instance_unique_id); $encodedid = dol_encode($id, $dolibarr_main_instance_unique_id);
$link_subscription = $dolibarr_main_url_root.'/public/eventorganization/attendee_subscription.php?id='.$encodedid; $link_subscription = $dolibarr_main_url_root.'/public/eventorganization/attendee_subscription.php?id='.$encodedid;
$encodedsecurekey = dol_encode($conf->global->EVENTORGANIZATION_SECUREKEY.$encodedid, $dolibarr_main_instance_unique_id); $encodedsecurekey = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);
$link_subscription .= '&securekey='.urlencode($encodedsecurekey); $link_subscription .= '&securekey='.urlencode($encodedsecurekey);
$this->fields['pubregister'] = array('type'=>'url', 'label'=>$langs->trans("PublicAttendeeSubscriptionPage"), 'enabled'=>'1', 'position'=>72, 'notnull'=>0, 'visible'=>1); $this->fields['pubregister'] = array('type'=>'url', 'label'=>$langs->trans("PublicAttendeeSubscriptionPage"), 'enabled'=>'1', 'position'=>72, 'notnull'=>0, 'visible'=>1);

2
htdocs/eventorganization/conferenceorbooth_list.php
View File

@ -366,7 +366,7 @@ if ($projectid > 0) {
print '<tr><td>'.$langs->trans("RegisterPage").'</td><td>'; print '<tr><td>'.$langs->trans("RegisterPage").'</td><td>';
$encodedid = dol_encode($project->id, $dolibarr_main_instance_unique_id); $encodedid = dol_encode($project->id, $dolibarr_main_instance_unique_id);
$linkregister = $dolibarr_main_url_root.'/public/project/index.php?id='.$encodedid; $linkregister = $dolibarr_main_url_root.'/public/project/index.php?id='.$encodedid;
$encodedsecurekey = dol_encode($conf->global->EVENTORGANIZATION_SECUREKEY.$encodedid, $dolibarr_main_instance_unique_id); $encodedsecurekey = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$project->id, 2);
$linkregister .= '&securekey='.urlencode($encodedsecurekey); $linkregister .= '&securekey='.urlencode($encodedsecurekey);
print '<a target="_blank" href="'.$linkregister.'">'.$linkregister.'</a>'; print '<a target="_blank" href="'.$linkregister.'">'.$linkregister.'</a>';
print '</td></tr>'; print '</td></tr>';

4
htdocs/langs/en_US/eventorganization.lang
View File

@ -105,8 +105,8 @@ ViewAndVote = View and vote for suggested events
PublicAttendeeSubscriptionPage = Public link of registration to a conference PublicAttendeeSubscriptionPage = Public link of registration to a conference
MissingOrBadSecureKey = The security key is invalid or missing MissingOrBadSecureKey = The security key is invalid or missing
EvntOrgWelcomeMessage = This form allows you to register as a new participant to the conference EvntOrgWelcomeMessage = This form allows you to register as a new participant to the conference
EvntOrgDuration = This conference starts on %s and ends on %s EvntOrgDuration = This conference starts on %s and ends on %s.
ConferenceAttendeeFee = Conference attendee fee for the event : '%s' occurring from %s to %s ConferenceAttendeeFee = Conference attendee fee for the event : '%s' occurring from %s to %s.
# #
# SubscriptionOk page # SubscriptionOk page
# #

21
htdocs/public/eventorganization/attendee_subscription.php
View File

@ -101,16 +101,13 @@ if ($resultproject < 0) {
$errmsg .= $project->error; $errmsg .= $project->error;
} }
// Getting 'securekey'.'id' from Post and decoding it
$encodedsecurekeyandid = GETPOST('securekey', 'alpha');
$securekeyandid = dol_decode($encodedsecurekeyandid, $dolibarr_main_instance_unique_id);
// Securekey decomposition into pure securekey and id added at the end // Getting 'securekey'.'id' from Post and decoding it
$securekey = substr($securekeyandid, 0, strlen($securekeyandid)-strlen($encodedid)); $securekeyreceived = GETPOST('securekey', 'alpha');
$idgotfromsecurekey = dol_decode(substr($securekeyandid, -strlen($encodedid), strlen($encodedid)), $dolibarr_main_instance_unique_id); $securekeytocompare = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);
// We check if the securekey collected is OK and if the id collected is the same than the id in the securekey // We check if the securekey collected is OK and if the id collected is the same than the id in the securekey
if ($securekey != $conf->global->EVENTORGANIZATION_SECUREKEY || $idgotfromsecurekey != $id) { if ($securekeytocompare != $securekeyreceived) {
print $langs->trans('MissingOrBadSecureKey'); print $langs->trans('MissingOrBadSecureKey');
exit; exit;
} }
@ -251,7 +248,9 @@ if (empty($reshook) && $action == 'add') {
// If the attendee has already paid // If the attendee has already paid
if ($confattendee->status == 1) { if ($confattendee->status == 1) {
$redirection = $dolibarr_main_url_root.'/public/eventorganization/subscriptionok.php?securekey='.dol_encode($conf->global->EVENTORGANIZATION_SECUREKEY, $dolibarr_main_instance_unique_id); $encodedid = dol_encode($id, $dolibarr_main_instance_unique_id);
$securekeyurl = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);
$redirection = $dolibarr_main_url_root.'/public/eventorganization/subscriptionok.php?id='.$encodedid.'&securekey='.$securekeyurl;
Header("Location: ".$redirection); Header("Location: ".$redirection);
exit; exit;
} }
@ -435,7 +434,9 @@ if (empty($reshook) && $action == 'add') {
dol_syslog("Failed to send EMail to ".$sendto, LOG_ERR, 0, '_payment'); dol_syslog("Failed to send EMail to ".$sendto, LOG_ERR, 0, '_payment');
} }
$redirection = $dolibarr_main_url_root.'/public/eventorganization/subscriptionok.php?securekey='.dol_encode($conf->global->EVENTORGANIZATION_SECUREKEY, $dolibarr_main_instance_unique_id); $encodedid = dol_encode($id, $dolibarr_main_instance_unique_id);
$securekeyurl = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);
$redirection = $dolibarr_main_url_root.'/public/eventorganization/subscriptionok.php?id='.$encodedid.'&securekey='.$securekeyurl;
Header("Location: ".$redirection); Header("Location: ".$redirection);
exit; exit;
} }
@ -478,7 +479,7 @@ print '<input type="hidden" name="token" value="'.newToken().'" / >';
print '<input type="hidden" name="entity" value="'.$entity.'" />'; print '<input type="hidden" name="entity" value="'.$entity.'" />';
print '<input type="hidden" name="action" value="add" />'; print '<input type="hidden" name="action" value="add" />';
print '<input type="hidden" name="id" value="'.$encodedid.'" />'; print '<input type="hidden" name="id" value="'.$encodedid.'" />';
print '<input type="hidden" name="securekey" value="'.$encodedsecurekeyandid.'" />'; print '<input type="hidden" name="securekey" value="'.$securekeyreceived.'" />';
print '<br>'; print '<br>';

8
htdocs/public/eventorganization/subscriptionok.php
View File

@ -65,8 +65,12 @@ $object = new stdClass(); // For triggers
$error = 0; $error = 0;
// Security check // Security check
$securekey = dol_decode(GETPOST('securekey'), $dolibarr_main_instance_unique_id); $encodedid = GETPOST("id");
if ($securekey != $conf->global->EVENTORGANIZATION_SECUREKEY) { $id = dol_decode($encodedid, $dolibarr_main_instance_unique_id);
$securekeyreceived = GETPOST("securekey");
$securekeytocompare = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);
if ($securekeyreceived != $securekeytocompare) {
print $langs->trans('MissingOrBadSecureKey'); print $langs->trans('MissingOrBadSecureKey');
exit; exit;
} }