lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix check when uploading a non image as user photo

Browse Source
This commit is contained in:
Laurent Destailleur 2019-05-10 20:09:41 +02:00
parent cc64e3e5c0
commit a664cd6461
4 changed files with 21 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
htdocs/admin/company.php
View File

@ -271,7 +271,7 @@ if ($action == 'addthumb') // Regenerate thumbs
$error++; $error++;
$langs->load("errors"); $langs->load("errors");
setEventMessages($langs->trans("ErrorBadImageFormat"), null, 'errors'); setEventMessages($langs->trans("ErrorBadImageFormat"), null, 'errors');
dol_syslog($langs->transnoentities("ErrorBadImageFormat"), LOG_WARNING); dol_syslog($langs->transnoentities("ErrorBadImageFormat"), LOG_INFO);
} }
} }
else else
@ -412,9 +412,9 @@ if ($action == 'edit' || $action == 'updateedit')
} }
// Logo // Logo
print '<tr class="oddeven hideonsmartphone"><td><label for="logo">'.$langs->trans("Logo").' (png,jpg)</label></td><td>'; print '<tr class="oddeven"><td><label for="logo">'.$langs->trans("Logo").' (png,jpg)</label></td><td>';
print '<table width="100%" class="nobordernopadding"><tr class="nocellnopadd"><td valign="middle" class="nocellnopadd">'; print '<table width="100%" class="nobordernopadding"><tr class="nocellnopadd"><td valign="middle" class="nocellnopadd">';
print '<input type="file" class="flat class=minwidth200" name="logo" id="logo">'; print '<input type="file" class="flat class=minwidth200" name="logo" id="logo" accept="image/*">';
print '</td><td class="nocellnopadd right" valign="middle">'; print '</td><td class="nocellnopadd right" valign="middle">';
if (! empty($mysoc->logo_mini)) { if (! empty($mysoc->logo_mini)) {
print '<a href="'.$_SERVER["PHP_SELF"].'?action=removelogo">'.img_delete($langs->trans("Delete")).'</a>'; print '<a href="'.$_SERVER["PHP_SELF"].'?action=removelogo">'.img_delete($langs->trans("Delete")).'</a>';
@ -798,9 +798,9 @@ else
print '</td></tr>'; print '</td></tr>';
// Barcode // Barcode
if (! empty($conf->barcode->enabled)) if (! empty($conf->barcode->enabled))
{ {
print '<tr class="oddeven"><td>'.$langs->trans("Gencod").'</td><td>' . $conf->global->MAIN_INFO_SOCIETE_GENCOD . '</td></tr>'; print '<tr class="oddeven"><td>'.$langs->trans("Gencod").'</td><td>' . $conf->global->MAIN_INFO_SOCIETE_GENCOD . '</td></tr>';
} }

4
htdocs/core/class/html.form.class.php
View File

@ -1901,7 +1901,7 @@ class Form
// check parameters // check parameters
$price_level = (! empty($price_level) ? $price_level : 0); $price_level = (! empty($price_level) ? $price_level : 0);
if (is_null($ajaxoptions)) $ajaxoptions=array(); if (is_null($ajaxoptions)) $ajaxoptions=array();
if (! empty($conf->use_javascript_ajax) && ! empty($conf->global->PRODUIT_USE_SEARCH_TO_SELECT)) if (! empty($conf->use_javascript_ajax) && ! empty($conf->global->PRODUIT_USE_SEARCH_TO_SELECT))
{ {
$placeholder=''; $placeholder='';
@ -7204,7 +7204,7 @@ class Form
if ($object->photo) $ret.="<br>\n"; if ($object->photo) $ret.="<br>\n";
$ret.='<table class="nobordernopadding centpercent">'; $ret.='<table class="nobordernopadding centpercent">';
if ($object->photo) $ret.='<tr><td><input type="checkbox" class="flat photodelete" name="deletephoto" id="photodelete"> '.$langs->trans("Delete").'<br><br></td></tr>'; if ($object->photo) $ret.='<tr><td><input type="checkbox" class="flat photodelete" name="deletephoto" id="photodelete"> '.$langs->trans("Delete").'<br><br></td></tr>';
$ret.='<tr><td class="tdoverflow"><input type="file" class="flat maxwidth200onsmartphone" name="photo" id="photoinput"'.($capture?' capture="'.$capture.'"':'').'></td></tr>'; $ret.='<tr><td class="tdoverflow"><input type="file" class="flat maxwidth200onsmartphone" name="photo" id="photoinput" accept="image/*"'.($capture?' capture="'.$capture.'"':'').'></td></tr>';
$ret.='</table>'; $ret.='</table>';
} }
} }

2
htdocs/langs/en_US/admin.lang
View File

@ -1079,7 +1079,7 @@ SystemInfoDesc=System information is miscellaneous technical information you get
SystemAreaForAdminOnly=This area is available to administrator users only. Dolibarr user permissions cannot change this restriction. SystemAreaForAdminOnly=This area is available to administrator users only. Dolibarr user permissions cannot change this restriction.
CompanyFundationDesc=Edit the information of the company/entity. Click on "%s" or "%s" button at the bottom of the page. CompanyFundationDesc=Edit the information of the company/entity. Click on "%s" or "%s" button at the bottom of the page.
AccountantDesc=Edit the details of your accountant/bookkeeper AccountantDesc=Edit the details of your accountant/bookkeeper
AccountantFileNumber=File number AccountantFileNumber=Accountant code
DisplayDesc=Parameters affecting the look and behaviour of Dolibarr can be modified here. DisplayDesc=Parameters affecting the look and behaviour of Dolibarr can be modified here.
AvailableModules=Available app/modules AvailableModules=Available app/modules
ToActivateModule=To activate modules, go on setup Area (Home->Setup->Modules). ToActivateModule=To activate modules, go on setup Area (Home->Setup->Modules).

16
htdocs/user/card.php
View File

@ -423,8 +423,20 @@ if (empty($reshook)) {
if (GETPOST('deletephoto')) { if (GETPOST('deletephoto')) {
$object->photo = ''; $object->photo = '';
} }
if (!empty($_FILES['photo']['name'])) { if (!empty($_FILES['photo']['name']))
$object->photo = dol_sanitizeFileName($_FILES['photo']['name']); {
$isimage=image_format_supported($_FILES['photo']['name']);
if ($isimage > 0)
{
$object->photo = dol_sanitizeFileName($_FILES['photo']['name']);
}
else
{
$error++;
$langs->load("errors");
setEventMessages($langs->trans("ErrorBadImageFormat"), null, 'errors');
dol_syslog($langs->transnoentities("ErrorBadImageFormat"), LOG_INFO);
}
} }
if (!$error) { if (!$error) {