lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch '13.0' of git@github.com:Dolibarr/dolibarr.git into develop

Browse Source 
Conflicts:
	htdocs/main.inc.php
This commit is contained in:
Laurent Destailleur 2021-06-23 11:39:17 +02:00
commit c46097ccd9
2 changed files with 12 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/admin/modules.php
View File

@ -29,7 +29,7 @@
* \brief Page to activate/disable all modules * \brief Page to activate/disable all modules
*/ */
if (!defined('CSRFCHECK_WITH_TOKEN')) { if (!defined('CSRFCHECK_WITH_TOKEN') && (empty($_GET['action']) || $_GET['action'] != 'reset')) { // We do not force security to disable modules so we can do it if problem
define('CSRFCHECK_WITH_TOKEN', '1'); // Force use of CSRF protection with tokens even for GET define('CSRFCHECK_WITH_TOKEN', '1'); // Force use of CSRF protection with tokens even for GET
} }

19
htdocs/main.inc.php
View File

@ -438,15 +438,18 @@ if ((!empty($conf->global->MAIN_VERSION_LAST_UPGRADE) && ($conf->global->MAIN_VE
// Creation of a token against CSRF vulnerabilities // Creation of a token against CSRF vulnerabilities
if (!defined('NOTOKENRENEWAL')) { if (!defined('NOTOKENRENEWAL')) {
// Rolling token at each call ($_SESSION['token'] contains token of previous page) // No token renewal on .css.php, .js.php and .json.php
if (isset($_SESSION['newtoken'])) { if (!preg_match('/\.(css|js|json)\.php$/', $_SERVER["PHP_SELF"])) {
$_SESSION['token'] = $_SESSION['newtoken']; // Rolling token at each call ($_SESSION['token'] contains token of previous page)
} if (isset($_SESSION['newtoken'])) {
$_SESSION['token'] = $_SESSION['newtoken'];
}
// Save in $_SESSION['newtoken'] what will be next token. Into forms, we will add param token = newToken(); // Save in $_SESSION['newtoken'] what will be next token. Into forms, we will add param token = $_SESSION['newtoken']
$token = dol_hash(uniqid(mt_rand(), true)); // Generates a hash of a random number $token = dol_hash(uniqid(mt_rand(), true)); // Generates a hash of a random number
$_SESSION['newtoken'] = $token; $_SESSION['newtoken'] = $token;
dol_syslog("NEW TOKEN reclaimed by : " . $_SERVER['PHP_SELF'], LOG_DEBUG); dol_syslog("NEW TOKEN generated by : " . $_SERVER['PHP_SELF'], LOG_DEBUG);
}
} }
//dol_syslog("aaaa - ".defined('NOCSRFCHECK')." - ".$dolibarr_nocsrfcheck." - ".$conf->global->MAIN_SECURITY_CSRF_WITH_TOKEN." - ".$_SERVER['REQUEST_METHOD']." - ".GETPOST('token', 'alpha')); //dol_syslog("aaaa - ".defined('NOCSRFCHECK')." - ".$dolibarr_nocsrfcheck." - ".$conf->global->MAIN_SECURITY_CSRF_WITH_TOKEN." - ".$_SERVER['REQUEST_METHOD']." - ".GETPOST('token', 'alpha'));