lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX #yogosha13890

Browse Source
This commit is contained in:
Laurent Destailleur 2022-12-13 18:40:30 +01:00
parent bbeddae5f5
commit b4433ebdf9
3 changed files with 30 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
htdocs/core/ajax/ajaxdirpreview.php
View File

@ -133,14 +133,19 @@ if (preg_match('/\.\./', $upload_dir) || preg_match('/[<>|]/', $upload_dir)) {
exit; exit;
} }
if (empty($modulepart)) {
$modulepart = $module;
}
// Check permissions // Check permissions
if ($modulepart == 'ecm') { if ($modulepart == 'ecm') {
if (!$user->rights->ecm->read) { if (!$user->hasRight('ecm', 'read')) {
accessforbidden(); accessforbidden();
} }
} } elseif ($modulepart == 'medias' || $modulepart == 'website') {
if ($modulepart == 'medias') {
// Always allowed // Always allowed
} else {
accessforbidden();
} }
@ -174,7 +179,7 @@ if (!dol_is_dir($upload_dir)) {
exit;*/ exit;*/
} }
print '<!-- ajaxdirpreview type='.$type.' -->'."\n"; print '<!-- ajaxdirpreview type='.$type.' module='.$module.' modulepart='.$modulepart.'-->'."\n";
//print '<!-- Page called with mode='.dol_escape_htmltag(isset($mode)?$mode:'').' type='.dol_escape_htmltag($type).' module='.dol_escape_htmltag($module).' url='.dol_escape_htmltag($url).' '.dol_escape_htmltag($_SERVER["PHP_SELF"]).'?'.dol_escape_htmltag($_SERVER["QUERY_STRING"]).' -->'."\n"; //print '<!-- Page called with mode='.dol_escape_htmltag(isset($mode)?$mode:'').' type='.dol_escape_htmltag($type).' module='.dol_escape_htmltag($module).' url='.dol_escape_htmltag($url).' '.dol_escape_htmltag($_SERVER["PHP_SELF"]).'?'.dol_escape_htmltag($_SERVER["QUERY_STRING"]).' -->'."\n";
$param = ($sortfield ? '&sortfield='.urlencode($sortfield) : '').($sortorder ? '&sortorder='.urlencode($sortorder) : ''); $param = ($sortfield ? '&sortfield='.urlencode($sortfield) : '').($sortorder ? '&sortorder='.urlencode($sortorder) : '');

18
htdocs/core/ajax/ajaxdirtree.php
View File

@ -84,7 +84,7 @@ $fullpathselecteddir = '<none>';
if ($modulepart == 'ecm') { if ($modulepart == 'ecm') {
$fullpathselecteddir = $conf->ecm->dir_output.'/'.($selecteddir != '/' ? $selecteddir : ''); $fullpathselecteddir = $conf->ecm->dir_output.'/'.($selecteddir != '/' ? $selecteddir : '');
$fullpathpreopened = $conf->ecm->dir_output.'/'.($preopened != '/' ? $preopened : ''); $fullpathpreopened = $conf->ecm->dir_output.'/'.($preopened != '/' ? $preopened : '');
} elseif ($modulepart == 'medias') { } elseif ($modulepart == 'medias' || $modulepart == 'website') {
$fullpathselecteddir = $dolibarr_main_data_root.'/medias/'.($selecteddir != '/' ? $selecteddir : ''); $fullpathselecteddir = $dolibarr_main_data_root.'/medias/'.($selecteddir != '/' ? $selecteddir : '');
$fullpathpreopened = $dolibarr_main_data_root.'/medias/'.($preopened != '/' ? $preopened : ''); $fullpathpreopened = $dolibarr_main_data_root.'/medias/'.($preopened != '/' ? $preopened : '');
} }
@ -99,15 +99,27 @@ if (preg_match('/\.\./', $fullpathselecteddir) || preg_match('/[<>|]/', $fullpat
exit; exit;
} }
if (empty($modulepart)) {
$modulepart = $module;
}
// Check permissions // Check permissions
if ($modulepart == 'ecm') { if ($modulepart == 'ecm') {
if (!$user->rights->ecm->read) { if (!$user->hasRight('ecm', 'read')) {
accessforbidden(); accessforbidden();
} }
} elseif ($modulepart == 'medias') { } elseif ($modulepart == 'medias' || $modulepart == 'website') {
// Always allowed // Always allowed
} else {
accessforbidden();
} }
/*
* Actions
*/
// None
/* /*
* View * View

9
htdocs/main.inc.php
View File

@ -270,7 +270,6 @@ if (!empty($_SERVER['DOCUMENT_ROOT']) && substr($_SERVER['DOCUMENT_ROOT'], -6) !
set_include_path($_SERVER['DOCUMENT_ROOT'].'/htdocs'); set_include_path($_SERVER['DOCUMENT_ROOT'].'/htdocs');
} }
// Include the conf.php and functions.lib.php and security.lib.php. This defined the constants like DOL_DOCUMENT_ROOT, DOL_DATA_ROOT, DOL_URL_ROOT... // Include the conf.php and functions.lib.php and security.lib.php. This defined the constants like DOL_DOCUMENT_ROOT, DOL_DATA_ROOT, DOL_URL_ROOT...
require_once 'filefunc.inc.php'; require_once 'filefunc.inc.php';
@ -640,11 +639,15 @@ $modulepart = explode("/", $_SERVER["PHP_SELF"]);
if (is_array($modulepart) && count($modulepart) > 0) { if (is_array($modulepart) && count($modulepart) > 0) {
foreach ($conf->modules as $module) { foreach ($conf->modules as $module) {
if (in_array($module, $modulepart)) { if (in_array($module, $modulepart)) {
$conf->modulepart = $module; $modulepart = $module;
break; break;
} }
} }
} }
if (is_array($modulepart)) {
$modulepart = '';
}
/* /*
* Phase authentication / login * Phase authentication / login
@ -3106,7 +3109,7 @@ function main_area($title = '')
print '<tbody>'; print '<tbody>';
print '<tr><td rowspan="0" class="width20p">'; print '<tr><td rowspan="0" class="width20p">';
if ($conf->global->MAIN_SHOW_LOGO && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER) && !empty($conf->global->MAIN_INFO_SOCIETE_LOGO)) { if ($conf->global->MAIN_SHOW_LOGO && empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER) && !empty($conf->global->MAIN_INFO_SOCIETE_LOGO)) {
print '<img id="mysoc-info-header-logo" style="max-width:100%" alt="" src="'.DOL_URL_ROOT.'/viewimage.php?cache=1&amp;modulepart=mycompany&amp;file='.urlencode('logos/'.dol_escape_htmltag($conf->global->MAIN_INFO_SOCIETE_LOGO)).'">'; print '<img id="mysoc-info-header-logo" style="max-width:100%" alt="" src="'.DOL_URL_ROOT.'/viewimage.php?cache=1&modulepart=mycompany&file='.urlencode('logos/'.dol_escape_htmltag($conf->global->MAIN_INFO_SOCIETE_LOGO)).'">';
} }
print '</td><td rowspan="0" class="width50p"></td></tr>'."\n"; print '</td><td rowspan="0" class="width50p"></td></tr>'."\n";
print '<tr><td class="titre bold">'.dol_escape_htmltag($conf->global->MAIN_INFO_SOCIETE_NOM).'</td></tr>'."\n"; print '<tr><td class="titre bold">'.dol_escape_htmltag($conf->global->MAIN_INFO_SOCIETE_NOM).'</td></tr>'."\n";