lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: Disable feature by default. Need option MAIN_SOCIETE_UNSUBSCRIBE to

Browse Source 
enable because feature is a security hole.
This commit is contained in:
Laurent Destailleur 2012-04-05 21:02:00 +02:00
parent 66b001653c
commit befaf655aa
4 changed files with 73 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
htdocs/comm/mailing/fiche.php
View File

@ -47,8 +47,6 @@ $object=new Mailing($db);
$substitutionarray=array(
'__ID__' => 'IdRecord',
'__EMAIL__' => 'EMail',
'__CHECK_READ__' => 'CheckMail',
'__UNSUSCRIBE__' => 'Unsuscribe',
'__LASTNAME__' => 'Lastname',
'__FIRSTNAME__' => 'Firstname',
'__OTHER1__' => 'Other1',
@ -59,11 +57,20 @@ $substitutionarray=array(
'__SIGNATURE__' => 'Signature',
'__PERSONALIZED__' => 'Personalized'
);
if ($conf->global->MAIN_SOCIETE_UNSUBSCRIBE)
{
$substitutionarray=array_merge(
$substitutionarray,
array(
'__CHECK_READ__' => 'CheckMail',
'__UNSUSCRIBE__' => 'Unsuscribe'
)
);
}
$substitutionarrayfortest=array(
'__ID__' => 'TESTIdRecord',
'__EMAIL__' => 'TESTEMail',
'__CHECK_READ__' => 'TESTCheckMail',
'__UNSUSCRIBE__' => 'TESTUnsuscribe',
'__LASTNAME__' => 'TESTLastname',
'__FIRSTNAME__' => 'TESTFirstname',
'__OTHER1__' => 'TESTOther1',
@ -74,7 +81,16 @@ $substitutionarrayfortest=array(
'__SIGNATURE__' => 'TESTSignature',
'__PERSONALIZED__' => 'TESTPersonalized'
);
if ($conf->global->MAIN_SOCIETE_UNSUBSCRIBE)
{
$substitutionarray=array_merge(
$substitutionarray,
array(
'__CHECK_READ__' => 'TESTCheckMail',
'__UNSUSCRIBE__' => 'TESTCheckMail'
)
);
}
// Action clone object
if ($action == 'confirm_clone' && $confirm == 'yes')
@ -191,9 +207,9 @@ if ($action == 'sendallconfirmed' && $confirm == 'yes')
$tmpfield=explode('=',$other[4],2); $other5=(isset($tmpfield[1])?$tmpfield[1]:$tmpfield[0]);
$substitutionarray=array(
'__ID__' => $obj->source_id,
'__EMAIL__' => '<a href="mailto:'.$obj->email.'">'.$obj->email.'</a>',
'__CHECK_READ__' => '<img src="'.DOL_MAIN_URL_ROOT.'/public/emailing/mailing-read.php?tag='.$obj->tag.'" width="0" height="0" style="width:0px;height:0px" border="0"/>',
'__UNSUSCRIBE__' => '<a href="'.DOL_MAIN_URL_ROOT.'/public/emailing/mailing-usubscribe.php?tag='.$obj->tag.'&unsuscrib=1" target="_blank">'.$langs->trans("MailUnsubcribe").'</a>',
'__EMAIL__' => $obj->email,
'__CHECK_READ__' => '<img src="'.DOL_MAIN_URL_ROOT.'/public/emailing/mailing-read.php?tag='.$obj->tag.'" width="0" height="0" style="width:0px;height:0px" border="0"/>',
'__UNSUSCRIBE__' => '<a href="'.DOL_MAIN_URL_ROOT.'/public/emailing/mailing-unsubscribe.php?tag='.$obj->tag.'&unsuscrib=1" target="_blank">'.$langs->trans("MailUnsubcribe").'</a>',
'__LASTNAME__' => $obj->nom,
'__FIRSTNAME__' => $obj->prenom,
'__OTHER1__' => $other1,
@ -1027,8 +1043,11 @@ else
print '<br><i>'.$langs->trans("CommonSubstitutions").':<br>';
print '__ID__ = '.$langs->trans("IdRecord").'<br>';
print '__EMAIL__ = '.$langs->trans("EMail").'<br>';
print '__CHECK_READ__ = '.$langs->trans("CheckRead").'<br>';
print '__UNSUSCRIBE__ = '.$langs->trans("MailUnsubcribe").'<br>';
if ($conf->global->MAIN_SOCIETE_UNSUBSCRIBE)
{
print '__CHECK_READ__ = '.$langs->trans("CheckRead").'<br>';
print '__UNSUSCRIBE__ = '.$langs->trans("MailUnsubcribe").'<br>';
}
print '__LASTNAME__ = '.$langs->trans("Lastname").'<br>';
print '__FIRSTNAME__ = '.$langs->trans("Firstname").'<br>';
print '__OTHER1__ = '.$langs->trans("Other").'1<br>';

9
htdocs/public/emailing/mailing-read.php
View File

@ -32,6 +32,12 @@ require("../../main.inc.php");
$id=GETPOST('tag');
if (empty($conf->global->MAIN_SOCIETE_UNSUBSCRIBE)) accessforbidden('Option not enabled');
/*
* Actions
*/
if ($id!='')
{
@ -55,8 +61,5 @@ if ($id!='')
}
$db->close();
?>

12
htdocs/public/emailing/mailing-usubscribe.php
View File

@ -20,7 +20,7 @@
/**
* \file scripts/emailings/mailing-usubscribe.php
* \file scripts/emailings/mailing-unsubscribe.php
* \ingroup mailing
* \brief Script use to update unsubcribe contact to prospect mailing list
*/
@ -39,13 +39,19 @@ $langs->load("mails");
$id=GETPOST('tag');
$unsuscrib=GETPOST('unsuscrib');
if (empty($conf->global->MAIN_SOCIETE_UNSUBSCRIBE)) accessforbidden('Option not enabled');
/*
* Actions
*/
if (($id!='') && ($unsuscrib=='1'))
{
//Udate status of mail in Destinaries maling list
$statut='3';
$sql = "UPDATE ".MAIN_DB_PREFIX."mailing_cibles SET statut=".$statut." WHERE tag='".$id."'";
dol_syslog("public/emailing/mailing-usubscribe.php : Mail unsubcribe : ".$sql, LOG_DEBUG);
dol_syslog("public/emailing/mailing-unsubscribe.php : Mail unsubcribe : ".$sql, LOG_DEBUG);
$resql=$db->query($sql);
@ -92,8 +98,6 @@ if (($id!='') && ($unsuscrib=='1'))
print '</td></tr></table>';
print "</body>\n";
print "</html>\n";
}
$db->close();

9
scripts/emailings/mailing-send.php
View File

@ -106,8 +106,11 @@ if ($resql)
{
dol_syslog("nb of targets = ".$num, LOG_DEBUG);
$now=dol_now();
// Positionne date debut envoi
$sql="UPDATE ".MAIN_DB_PREFIX."mailing SET date_envoi=SYSDATE() WHERE rowid=".$id;
$sql="UPDATE ".MAIN_DB_PREFIX."mailing SET date_envoi='".$db->idate($now)."' WHERE rowid=".$id;
$resql2=$db->query($sql);
if (! $resql2)
{
@ -135,9 +138,9 @@ if ($resql)
$other5=$other[4];
$substitutionarray=array(
'__ID__' => $obj->source_id,
'__EMAIL__' => '<a href="mailto:'.$obj->email.'">'.$obj->email.'</a>',
'__EMAIL__' => $obj->email,
'__CHECK_READ__' => '<img src="'.DOL_MAIN_URL_ROOT.'/public/emailing/mailing-read.php?tag='.$obj->tag.'" width="0" height="0" style="width:0px;height:0px" border="0"/>',
'__UNSUSCRIBE__' => '<a href="'.DOL_MAIN_URL_ROOT.'/public/emailing/mailing-usubscribe.php?tag='.$obj->tag.'&unsuscrib=1" target="_blank">'.$langs->trans("MailUnsubcribe").'</a>',
'__UNSUSCRIBE__' => '<a href="'.DOL_MAIN_URL_ROOT.'/public/emailing/mailing-unsubscribe.php?tag='.$obj->tag.'&unsuscrib=1" target="_blank">'.$langs->trans("MailUnsubcribe").'</a>',
'__LASTNAME__' => $obj->lastname,
'__FIRSTNAME__' => $obj->firstname,
'__OTHER1__' => $other1,