lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix SQLi reported by op7ica

Browse Source
This commit is contained in:
Laurent Destailleur 2018-03-15 01:33:46 +01:00
parent c62d68f4be
commit c3b9c91200
4 changed files with 49 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
htdocs/adherents/card.php
View File

@ -320,16 +320,16 @@ if (empty($reshook))
$object->skype = trim($_POST["skype"]); $object->skype = trim($_POST["skype"]);
$object->birth = $birthdate; $object->birth = $birthdate;
$object->typeid = $_POST["typeid"]; $object->typeid = GETPOST("typeid",'int');
//$object->note = trim($_POST["comment"]); //$object->note = trim($_POST["comment"]);
$object->morphy = $_POST["morphy"]; $object->morphy = GETPOST("morphy",'alpha');
if (GETPOST('deletephoto')) $object->photo=''; if (GETPOST('deletephoto')) $object->photo='';
elseif (! empty($_FILES['photo']['name'])) $object->photo = dol_sanitizeFileName($_FILES['photo']['name']); elseif (! empty($_FILES['photo']['name'])) $object->photo = dol_sanitizeFileName($_FILES['photo']['name']);
// Get status and public property // Get status and public property
$object->statut = $_POST["statut"]; $object->statut = GETPOST("statut",'alpha');
$object->public = $_POST["public"]; $object->public = GETPOST("public",'alpha');
// Fill array 'array_options' with data from add form // Fill array 'array_options' with data from add form
$ret = $extrafields->setOptionalsFromPost($extralabels,$object); $ret = $extrafields->setOptionalsFromPost($extralabels,$object);
@ -445,29 +445,29 @@ if (empty($reshook))
$datesubscription=dol_mktime(12, 0, 0, $_POST["remonth"], $_POST["reday"], $_POST["reyear"]); $datesubscription=dol_mktime(12, 0, 0, $_POST["remonth"], $_POST["reday"], $_POST["reyear"]);
} }
$typeid=$_POST["typeid"]; $typeid=GETPOST("typeid",'int');
$civility_id=$_POST["civility_id"]; $civility_id=GETPOST("civility_id",'int');
$lastname=$_POST["lastname"]; $lastname=GETPOST("lastname",'alpha');
$firstname=$_POST["firstname"]; $firstname=GETPOST("firstname",'alpha');
$societe=$_POST["societe"]; $societe=GETPOST("societe",'alpha');
$address=$_POST["address"]; $address=GETPOST("address",'alpha');
$zip=$_POST["zipcode"]; $zip=GETPOST("zipcode",'alpha');
$town=$_POST["town"]; $town=GETPOST("town",'alpha');
$state_id=$_POST["state_id"]; $state_id=GETPOST("state_id",'int');
$country_id=$_POST["country_id"]; $country_id=GETPOST("country_id",'int');
$phone=$_POST["phone"]; $phone=GETPOST("phone",'alpha');
$phone_perso=$_POST["phone_perso"]; $phone_perso=GETPOST("phone_perso",'alpha');
$phone_mobile=$_POST["phone_mobile"]; $phone_mobile=GETPOST("phone_mobile",'alpha');
$skype=$_POST["member_skype"]; $skype=GETPOST("member_skype",'alpha');
$email=$_POST["member_email"]; $email=GETPOST("member_email",'alpha');
$login=$_POST["member_login"]; $login=GETPOST("member_login",'alpha');
$pass=$_POST["password"]; $pass=GETPOST("password",'alpha');
$photo=$_POST["photo"]; $photo=GETPOST("photo",'alpha');
//$comment=$_POST["comment"]; //$comment=GETPOST("comment",'none');
$morphy=$_POST["morphy"]; $morphy=GETPOST("morphy",'alpha');
$subscription=$_POST["subscription"]; $subscription=GETPOST("subscription",'alpha');
$public=$_POST["public"]; $public=GETPOST("public",'alpha');
$userid=$_POST["userid"]; $userid=$_POST["userid"];
$socid=$_POST["socid"]; $socid=$_POST["socid"];
@ -1093,14 +1093,14 @@ else
$morphys["phy"] = $langs->trans("Physical"); $morphys["phy"] = $langs->trans("Physical");
$morphys["mor"] = $langs->trans("Morale"); $morphys["mor"] = $langs->trans("Morale");
print '<tr><td><span class="fieldrequired">'.$langs->trans("Nature").'</span></td><td>'; print '<tr><td><span class="fieldrequired">'.$langs->trans("Nature").'</span></td><td>';
print $form->selectarray("morphy", $morphys, isset($_POST["morphy"])?$_POST["morphy"]:$object->morphy); print $form->selectarray("morphy", $morphys, (GETPOSTISSET("morphy")?GETPOST("morphy",'alpha'):$object->morphy));
print "</td></tr>"; print "</td></tr>";
// Type // Type
print '<tr><td class="fieldrequired">'.$langs->trans("Type").'</td><td>'; print '<tr><td class="fieldrequired">'.$langs->trans("Type").'</td><td>';
if ($user->rights->adherent->creer) if ($user->rights->adherent->creer)
{ {
print $form->selectarray("typeid", $adht->liste_array(), (isset($_POST["typeid"])?$_POST["typeid"]:$object->typeid)); print $form->selectarray("typeid", $adht->liste_array(), (GETPOSTISSET("typeid")?GETPOST("typeid",'int'):$object->typeid));
} }
else else
{ {

2
htdocs/adherents/class/adherent_type.class.php
View File

@ -265,7 +265,7 @@ class AdherentType extends CommonObject
{ {
$sql = "SELECT d.rowid, d.libelle as label, d.statut, d.subscription, d.mail_valid, d.note, d.vote"; $sql = "SELECT d.rowid, d.libelle as label, d.statut, d.subscription, d.mail_valid, d.note, d.vote";
$sql .= " FROM ".MAIN_DB_PREFIX."adherent_type as d"; $sql .= " FROM ".MAIN_DB_PREFIX."adherent_type as d";
$sql .= " WHERE d.rowid = ".$rowid; $sql .= " WHERE d.rowid = ".(int) $rowid;
dol_syslog("Adherent_type::fetch", LOG_DEBUG); dol_syslog("Adherent_type::fetch", LOG_DEBUG);

36
htdocs/adherents/list.php
View File

@ -42,23 +42,23 @@ $toselect = GETPOST('toselect', 'array');
// Security check // Security check
$result=restrictedArea($user,'adherent'); $result=restrictedArea($user,'adherent');
$filter=GETPOST("filter"); $filter=GETPOST("filter",'alpha');
$statut=GETPOST("statut"); $statut=GETPOST("statut",'alpha');
$search=GETPOST("search"); $search=GETPOST("search",'alpha');
$search_ref=GETPOST("search_ref"); $search_ref=GETPOST("search_ref",'alpha');
$search_lastname=GETPOST("search_lastname"); $search_lastname=GETPOST("search_lastname",'alpha');
$search_firstname=GETPOST("search_firstname"); $search_firstname=GETPOST("search_firstname",'alpha');
$search_login=GETPOST("search_login"); $search_login=GETPOST("search_login",'alpha');
$search_address=GETPOST("search_address"); $search_address=GETPOST("search_address",'alpha');
$search_zip=GETPOST("search_zip"); $search_zip=GETPOST("search_zip",'alpha');
$search_town=GETPOST("search_town"); $search_town=GETPOST("search_town",'alpha');
$search_state=GETPOST("search_state"); $search_state=GETPOST("search_state",'alpha');
$search_country=GETPOST("search_country"); $search_country=GETPOST("search_country",'alpha');
$search_phone=GETPOST("search_phone"); $search_phone=GETPOST("search_phone",'alpha');
$search_phone_perso=GETPOST("search_phone_perso"); $search_phone_perso=GETPOST("search_phone_perso",'alpha');
$search_phone_mobile=GETPOST("search_phone_mobile"); $search_phone_mobile=GETPOST("search_phone_mobile",'alpha');
$search_type=GETPOST("search_type"); $search_type=GETPOST("search_type",'alpha');
$search_email=GETPOST("search_email"); $search_email=GETPOST("search_email",'alpha');
$search_categ = GETPOST("search_categ",'int'); $search_categ = GETPOST("search_categ",'int');
$catid = GETPOST("catid",'int'); $catid = GETPOST("catid",'int');
$optioncss = GETPOST('optioncss','alpha'); $optioncss = GETPOST('optioncss','alpha');
@ -288,7 +288,7 @@ if ($num == 1 && ! empty($conf->global->MAIN_SEARCH_DIRECT_OPEN_IF_ONLY_ONE) &&
llxHeader('',$langs->trans("Member"),'EN:Module_Foundations|FR:Module_Adh&eacute;rents|ES:M&oacute;dulo_Miembros'); llxHeader('',$langs->trans("Member"),'EN:Module_Foundations|FR:Module_Adh&eacute;rents|ES:M&oacute;dulo_Miembros');
$titre=$langs->trans("MembersList"); $titre=$langs->trans("MembersList");
if (isset($_GET["statut"])) if (GETPOSTISSET("statut"))
{ {
if ($statut == '-1,1') { $titre=$langs->trans("MembersListQualified"); } if ($statut == '-1,1') { $titre=$langs->trans("MembersListQualified"); }
if ($statut == '-1') { $titre=$langs->trans("MembersListToValid"); } if ($statut == '-1') { $titre=$langs->trans("MembersListToValid"); }

4
htdocs/societe/class/societe.class.php
View File

@ -999,9 +999,9 @@ class Societe extends CommonObject
$sql .= ", code_fournisseur = ".(! empty($this->code_fournisseur)?"'".$this->db->escape($this->code_fournisseur)."'":"null"); $sql .= ", code_fournisseur = ".(! empty($this->code_fournisseur)?"'".$this->db->escape($this->code_fournisseur)."'":"null");
$sql .= ", code_compta_fournisseur = ".(! empty($this->code_compta_fournisseur)?"'".$this->db->escape($this->code_compta_fournisseur)."'":"null"); $sql .= ", code_compta_fournisseur = ".(! empty($this->code_compta_fournisseur)?"'".$this->db->escape($this->code_compta_fournisseur)."'":"null");
} }
$sql .= ", fk_user_modif = ".(! empty($user->id)?"'".$user->id."'":"null"); $sql .= ", fk_user_modif = ".($user->id > 0 ? $user->id:"null");
$sql .= ", fk_multicurrency = ".(int) $this->fk_multicurrency; $sql .= ", fk_multicurrency = ".(int) $this->fk_multicurrency;
$sql .= ', multicurrency_code = \''.$this->db->escape($this->multicurrency_code)."'"; $sql .= ", multicurrency_code = '".$this->db->escape($this->multicurrency_code)."'";
$sql .= " WHERE rowid = '" . $id ."'"; $sql .= " WHERE rowid = '" . $id ."'";
$resql=$this->db->query($sql); $resql=$this->db->query($sql);