Merge remote-tracking branch 'upstream/develop' into ajaxtooltip

This commit is contained in:
Frédéric FRANCE 2023-02-05 23:04:33 +01:00
commit c77d2ba1c2
5 changed files with 144 additions and 117 deletions

View File

@ -8116,10 +8116,16 @@ abstract class CommonObject
$out .= "\n";
$nbofextrafieldsshown = 0;
$extrafields_collapse_num = '';
$e = 0; // var to manage the modulo (odd/even)
$lastseparatorkeyfound = '';
$extrafields_collapse_num = '';
$extrafields_collapse_num_old = '';
$i = 0;
foreach ($extrafields->attributes[$this->table_element]['label'] as $key => $label) {
$i++;
// Show only the key field in params
if (is_array($params) && array_key_exists('onlykey', $params) && $key != $params['onlykey']) {
continue;
@ -8154,6 +8160,7 @@ abstract class CommonObject
if (empty($perms)) {
continue;
}
// Load language if required
if (!empty($extrafields->attributes[$this->table_element]['langfile'][$key])) {
$langs->load($extrafields->attributes[$this->table_element]['langfile'][$key]);
@ -8215,14 +8222,19 @@ abstract class CommonObject
$extrafield_collapse_display_value = intval($extrafield_param_list[0]);
if ($extrafield_collapse_display_value == 1 || $extrafield_collapse_display_value == 2) {
$extrafields_collapse_num = $extrafields->attributes[$this->table_element]['pos'][$key];
//$extrafields_collapse_num = $extrafields->attributes[$this->table_element]['pos'][$key];
$extrafields_collapse_num = $key;
}
}
}
// if colspan=0 or 1, the second column is not extended, so the separator must be on 2 columns
$out .= $extrafields->showSeparator($key, $this, ($colspan ? $colspan + 1 : 2), $display_type, $mode);
$lastseparatorkeyfound = $key;
} else {
$collapse_group = $extrafields_collapse_num.(!empty($this->id) ? '_'.$this->id : '');
$class = (!empty($extrafields->attributes[$this->table_element]['hidden'][$key]) ? 'hideobject ' : '');
$csstyle = '';
if (is_array($params) && count($params) > 0) {
@ -8293,13 +8305,13 @@ abstract class CommonObject
$helptoshow = $langs->trans($extrafields->attributes[$this->table_element]['help'][$key]);
if ($display_type == 'card') {
$out .= '<tr '.($html_id ? 'id="'.$html_id.'" ' : '').$csstyle.' class="field_options_'.$key.' '.$class.$this->element.'_extras_'.$key.' trextrafields_collapse'.$extrafields_collapse_num.(!empty($this->id)?'_'.$this->id:'').'" '.$domData.' >';
$out .= '<tr '.($html_id ? 'id="'.$html_id.'" ' : '').$csstyle.' class="field_options_'.$key.' '.$class.$this->element.'_extras_'.$key.' trextrafields_collapse'.$collapse_group.'" '.$domData.' >';
if (!empty($conf->global->MAIN_VIEW_LINE_NUMBER) && ($action == 'view' || $action == 'valid' || $action == 'editline' || $action == 'confirm_valid' || $action == 'confirm_cancel')) {
$out .= '<td></td>';
}
$out .= '<td class="titlefieldcreate wordbreak';
} elseif ($display_type == 'line') {
$out .= '<div '.($html_id ? 'id="'.$html_id.'" ' : '').$csstyle.' class="fieldline_options_'.$key.' '.$class.$this->element.'_extras_'.$key.' trextrafields_collapse'.$extrafields_collapse_num.(!empty($this->id)?'_'.$this->id:'').'" '.$domData.' >';
$out .= '<div '.($html_id ? 'id="'.$html_id.'" ' : '').$csstyle.' class="fieldline_options_'.$key.' '.$class.$this->element.'_extras_'.$key.' trextrafields_collapse'.$collapse_group.'" '.$domData.' >';
$out .= '<div style="display: inline-block; padding-right:4px" class="wordbreak';
}
//$out .= "titlefield";

View File

@ -1981,8 +1981,12 @@ class ExtraFields
$extrafield_collapse_display_value = intval($extrafield_param_list[0]);
$expand_display = ((isset($_COOKIE['DOLCOLLAPSE_'.$object->table_element.'_extrafields_'.$key]) || GETPOST('ignorecollapsesetup', 'int')) ? (empty($_COOKIE['DOLCOLLAPSE_'.$object->table_element.'_extrafields_'.$key]) ? false : true) : ($extrafield_collapse_display_value == 2 ? false : true));
}
$disabledcookiewrite = 0;
if ($mode == 'create') {
$extrafield_collapse_display_value = 0;
// On create mode, force separator group to not be collapsable
$extrafield_collapse_display_value = 1;
$expand_display = true; // We force group to be shown expanded
$disabledcookiewrite = 1; // We keep status of group unchanged into the cookie
}
$out = '<'.$tagtype.' id="trextrafieldseparator'.$key.(!empty($object->id)?'_'.$object->id:'').'" class="trextrafieldseparator trextrafieldseparator'.$key.(!empty($object->id)?'_'.$object->id:'').'">';
@ -2004,19 +2008,21 @@ class ExtraFields
// Set the collapse_display status to cookie in priority or if ignorecollapsesetup is 1, if cookie and ignorecollapsesetup not defined, use the setup.
$this->expand_display[$collapse_group] = $expand_display;
if (!empty($conf->use_javascript_ajax) && $mode != 'create') {
if (!empty($conf->use_javascript_ajax)) {
$out .= '<!-- Add js script to manage the collapse/uncollapse of extrafields separators '.$key.' -->'."\n";
$out .= '<script type="text/javascript">'."\n";
$out .= 'jQuery(document).ready(function(){'."\n";
if ($expand_display === false) {
$out .= ' console.log("Inject js for the collapsing of extrafield '.$key.' - hide");'."\n";
$out .= ' jQuery(".trextrafields_collapse'.$collapse_group.'").hide();'."\n";
} else {
$out .= ' console.log("Inject js for collapsing of extrafield '.$key.' - keep visible and set cookie");'."\n";
$out .= ' document.cookie = "DOLCOLLAPSE_'.$object->table_element.'_extrafields_'.$key.'=1; path='.$_SERVER["PHP_SELF"].'"'."\n";
if (empty($disabledcookiewrite)) {
if ($expand_display === false) {
$out .= ' console.log("Inject js for the collapsing of extrafield '.$key.' - hide");'."\n";
$out .= ' jQuery(".trextrafields_collapse'.$collapse_group.'").hide();'."\n";
} else {
$out .= ' console.log("Inject js for collapsing of extrafield '.$key.' - keep visible and set cookie");'."\n";
$out .= ' document.cookie = "DOLCOLLAPSE_'.$object->table_element.'_extrafields_'.$key.'=1; path='.$_SERVER["PHP_SELF"].'"'."\n";
}
}
$out .= ' jQuery("#trextrafieldseparator'.$key.(!empty($object->id)?'_'.$object->id:'').'").click(function(){'."\n";
$out .= ' console.log("We click on collapse/uncollapse .trextrafields_collapse'.$collapse_group.'");'."\n";
$out .= ' console.log("We click on collapse/uncollapse to hide/show .trextrafields_collapse'.$collapse_group.'");'."\n";
$out .= ' jQuery(".trextrafields_collapse'.$collapse_group.'").toggle(100, function(){'."\n";
$out .= ' if (jQuery(".trextrafields_collapse'.$collapse_group.'").is(":hidden")) {'."\n";
$out .= ' jQuery("#trextrafieldseparator'.$key.(!empty($object->id)?'_'.$object->id:'').' '.$tagtype_dyn.' span").addClass("fa-plus-square").removeClass("fa-minus-square");'."\n";

View File

@ -5022,8 +5022,7 @@ function dol_print_error($db = '', $error = '', $errors = null)
$out .= "<br>\n";
$syslog .= "url=".dol_escape_htmltag($_SERVER["REQUEST_URI"]);
$syslog .= ", query_string=".dol_escape_htmltag($_SERVER["QUERY_STRING"]);
} else // Mode CLI
{
} else { // Mode CLI
$out .= '> '.$langs->transnoentities("ErrorInternalErrorDetected").":\n".$argv[0]."\n";
$syslog .= "pid=".dol_getmypid();
}
@ -5035,12 +5034,15 @@ function dol_print_error($db = '', $error = '', $errors = null)
if (is_object($db)) {
if ($_SERVER['DOCUMENT_ROOT']) { // Mode web
$out .= "<b>".$langs->trans("DatabaseTypeManager").":</b> ".$db->type."<br>\n";
$out .= "<b>".$langs->trans("RequestLastAccessInError").":</b> ".($db->lastqueryerror() ? dol_escape_htmltag($db->lastqueryerror()) : $langs->trans("ErrorNoRequestInError"))."<br>\n";
$lastqueryerror = $db->lastqueryerror();
if (!utf8_check($lastqueryerror)) {
$lastqueryerror = "SQL error string is not a valid UTF8 string. We can't show it.";
}
$out .= "<b>".$langs->trans("RequestLastAccessInError").":</b> ".($lastqueryerror ? dol_escape_htmltag($lastqueryerror) : $langs->trans("ErrorNoRequestInError"))."<br>\n";
$out .= "<b>".$langs->trans("ReturnCodeLastAccessInError").":</b> ".($db->lasterrno() ? dol_escape_htmltag($db->lasterrno()) : $langs->trans("ErrorNoRequestInError"))."<br>\n";
$out .= "<b>".$langs->trans("InformationLastAccessInError").":</b> ".($db->lasterror() ? dol_escape_htmltag($db->lasterror()) : $langs->trans("ErrorNoRequestInError"))."<br>\n";
$out .= "<br>\n";
} else // Mode CLI
{
} else { // Mode CLI
// No dol_escape_htmltag for output, we are in CLI mode
$out .= '> '.$langs->transnoentities("DatabaseTypeManager").":\n".$db->type."\n";
$out .= '> '.$langs->transnoentities("RequestLastAccessInError").":\n".($db->lastqueryerror() ? $db->lastqueryerror() : $langs->transnoentities("ErrorNoRequestInError"))."\n";
@ -8946,117 +8948,117 @@ function verifCond($strToEvaluate)
*/
function dol_eval($s, $returnvalue = 0, $hideerrors = 1, $onlysimplestring = '1')
{
try {
// Only global variables can be changed by eval function and returned to caller
global $db, $langs, $user, $conf, $website, $websitepage;
global $action, $mainmenu, $leftmenu;
global $rights;
global $object;
global $mysoc;
try {
// Only global variables can be changed by eval function and returned to caller
global $db, $langs, $user, $conf, $website, $websitepage;
global $action, $mainmenu, $leftmenu;
global $rights;
global $object;
global $mysoc;
global $obj; // To get $obj used into list when dol_eval is used for computed fields and $obj is not yet $object
global $soc; // For backward compatibility
global $obj; // To get $obj used into list when dol_eval is used for computed fields and $obj is not yet $object
global $soc; // For backward compatibility
// Test on dangerous char (used for RCE), we allow only characters to make PHP variable testing
if ($onlysimplestring == '1') {
// We must accept: '1 && getDolGlobalInt("doesnotexist1") && $conf->global->MAIN_FEATURES_LEVEL'
// We must accept: '$conf->barcode->enabled || preg_match(\'/^AAA/\',$leftmenu)'
// We must accept: '$user->rights->cabinetmed->read && !$object->canvas=="patient@cabinetmed"'
if (preg_match('/[^a-z0-9\s'.preg_quote('^$_+-.*>&|=!?():"\',/@', '/').']/i', $s)) {
if ($returnvalue) {
return 'Bad string syntax to evaluate (found chars that are not chars for simplestring): '.$s;
} else {
dol_syslog('Bad string syntax to evaluate (found chars that are not chars for simplestring): '.$s);
return '';
// Test on dangerous char (used for RCE), we allow only characters to make PHP variable testing
if ($onlysimplestring == '1') {
// We must accept: '1 && getDolGlobalInt("doesnotexist1") && $conf->global->MAIN_FEATURES_LEVEL'
// We must accept: '$conf->barcode->enabled || preg_match(\'/^AAA/\',$leftmenu)'
// We must accept: '$user->rights->cabinetmed->read && !$object->canvas=="patient@cabinetmed"'
if (preg_match('/[^a-z0-9\s'.preg_quote('^$_+-.*>&|=!?():"\',/@', '/').']/i', $s)) {
if ($returnvalue) {
return 'Bad string syntax to evaluate (found chars that are not chars for simplestring): '.$s;
} else {
dol_syslog('Bad string syntax to evaluate (found chars that are not chars for simplestring): '.$s);
return '';
}
// TODO
// We can exclude all parenthesis ( that are not '($db' and 'getDolGlobalInt(' and 'getDolGlobalString(' and 'preg_match(' and 'isModEnabled('
// ...
}
} elseif ($onlysimplestring == '2') {
// We must accept: (($reloadedobj = new Task($db)) && ($reloadedobj->fetchNoCompute($object->id) > 0) && ($secondloadedobj = new Project($db)) && ($secondloadedobj->fetchNoCompute($reloadedobj->fk_project) > 0)) ? $secondloadedobj->ref : "Parent project not found"
if (preg_match('/[^a-z0-9\s'.preg_quote('^$_+-.*>&|=!?():"\',/@;[]', '/').']/i', $s)) {
if ($returnvalue) {
return 'Bad string syntax to evaluate (found chars that are not chars for simplestring): '.$s;
} else {
dol_syslog('Bad string syntax to evaluate (found chars that are not chars for simplestring): '.$s);
return '';
}
}
// TODO
// We can exclude all parenthesis ( that are not '($db' and 'getDolGlobalInt(' and 'getDolGlobalString(' and 'preg_match(' and 'isModEnabled('
// ...
}
} elseif ($onlysimplestring == '2') {
// We must accept: (($reloadedobj = new Task($db)) && ($reloadedobj->fetchNoCompute($object->id) > 0) && ($secondloadedobj = new Project($db)) && ($secondloadedobj->fetchNoCompute($reloadedobj->fk_project) > 0)) ? $secondloadedobj->ref : "Parent project not found"
if (preg_match('/[^a-z0-9\s'.preg_quote('^$_+-.*>&|=!?():"\',/@;[]', '/').']/i', $s)) {
if (strpos($s, '::') !== false) {
if ($returnvalue) {
return 'Bad string syntax to evaluate (found chars that are not chars for simplestring): '.$s;
return 'Bad string syntax to evaluate (double : char is forbidden): '.$s;
} else {
dol_syslog('Bad string syntax to evaluate (found chars that are not chars for simplestring): '.$s);
dol_syslog('Bad string syntax to evaluate (double : char is forbidden): '.$s);
return '';
}
}
}
if (strpos($s, '::') !== false) {
if (strpos($s, '`') !== false) {
if ($returnvalue) {
return 'Bad string syntax to evaluate (backtick char is forbidden): '.$s;
} else {
dol_syslog('Bad string syntax to evaluate (backtick char is forbidden): '.$s);
return '';
}
}
if (preg_match('/[^0-9]+\.[^0-9]+/', $s)) { // We refuse . if not between 2 numbers
if ($returnvalue) {
return 'Bad string syntax to evaluate (dot char is forbidden): '.$s;
} else {
dol_syslog('Bad string syntax to evaluate (dot char is forbidden): '.$s);
return '';
}
}
// We block use of php exec or php file functions
$forbiddenphpstrings = array('$$');
$forbiddenphpstrings = array_merge($forbiddenphpstrings, array('_ENV', '_SESSION', '_COOKIE', '_GET', '_POST', '_REQUEST'));
$forbiddenphpfunctions = array("exec", "passthru", "shell_exec", "system", "proc_open", "popen", "eval", "dol_eval", "executeCLI", "verifCond", "base64_decode");
$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("fopen", "file_put_contents", "fputs", "fputscsv", "fwrite", "fpassthru", "require", "include", "mkdir", "rmdir", "symlink", "touch", "unlink", "umask"));
$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("function", "call_user_func"));
$forbiddenphpregex = 'global\s+\$|\b('.implode('|', $forbiddenphpfunctions).')\b';
do {
$oldstringtoclean = $s;
$s = str_ireplace($forbiddenphpstrings, '__forbiddenstring__', $s);
$s = preg_replace('/'.$forbiddenphpregex.'/i', '__forbiddenstring__', $s);
//$s = preg_replace('/\$[a-zA-Z0-9_\->\$]+\(/i', '', $s); // Remove $function( call and $mycall->mymethod(
} while ($oldstringtoclean != $s);
if (strpos($s, '__forbiddenstring__') !== false) {
dol_syslog('Bad string syntax to evaluate: '.$s, LOG_WARNING);
if ($returnvalue) {
return 'Bad string syntax to evaluate: '.$s;
} else {
dol_syslog('Bad string syntax to evaluate: '.$s);
return '';
}
}
//print $s."<br>\n";
if ($returnvalue) {
return 'Bad string syntax to evaluate (double : char is forbidden): '.$s;
if ($hideerrors) {
return @eval('return '.$s.';');
} else {
return eval('return '.$s.';');
}
} else {
dol_syslog('Bad string syntax to evaluate (double : char is forbidden): '.$s);
return '';
if ($hideerrors) {
@eval($s);
} else {
eval($s);
}
}
} catch (Error $e) {
$error = 'Caught error : ';
$error .= $e->getMessage() . ', ';
$error .= 'Trace : ';
$error .= json_encode($e->getTrace());
error_log($error, 1);
}
if (strpos($s, '`') !== false) {
if ($returnvalue) {
return 'Bad string syntax to evaluate (backtick char is forbidden): '.$s;
} else {
dol_syslog('Bad string syntax to evaluate (backtick char is forbidden): '.$s);
return '';
}
}
if (preg_match('/[^0-9]+\.[^0-9]+/', $s)) { // We refuse . if not between 2 numbers
if ($returnvalue) {
return 'Bad string syntax to evaluate (dot char is forbidden): '.$s;
} else {
dol_syslog('Bad string syntax to evaluate (dot char is forbidden): '.$s);
return '';
}
}
// We block use of php exec or php file functions
$forbiddenphpstrings = array('$$');
$forbiddenphpstrings = array_merge($forbiddenphpstrings, array('_ENV', '_SESSION', '_COOKIE', '_GET', '_POST', '_REQUEST'));
$forbiddenphpfunctions = array("exec", "passthru", "shell_exec", "system", "proc_open", "popen", "eval", "dol_eval", "executeCLI", "verifCond", "base64_decode");
$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("fopen", "file_put_contents", "fputs", "fputscsv", "fwrite", "fpassthru", "require", "include", "mkdir", "rmdir", "symlink", "touch", "unlink", "umask"));
$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("function", "call_user_func"));
$forbiddenphpregex = 'global\s+\$|\b('.implode('|', $forbiddenphpfunctions).')\b';
do {
$oldstringtoclean = $s;
$s = str_ireplace($forbiddenphpstrings, '__forbiddenstring__', $s);
$s = preg_replace('/'.$forbiddenphpregex.'/i', '__forbiddenstring__', $s);
//$s = preg_replace('/\$[a-zA-Z0-9_\->\$]+\(/i', '', $s); // Remove $function( call and $mycall->mymethod(
} while ($oldstringtoclean != $s);
if (strpos($s, '__forbiddenstring__') !== false) {
dol_syslog('Bad string syntax to evaluate: '.$s, LOG_WARNING);
if ($returnvalue) {
return 'Bad string syntax to evaluate: '.$s;
} else {
dol_syslog('Bad string syntax to evaluate: '.$s);
return '';
}
}
//print $s."<br>\n";
if ($returnvalue) {
if ($hideerrors) {
return @eval('return '.$s.';');
} else {
return eval('return '.$s.';');
}
} else {
if ($hideerrors) {
@eval($s);
} else {
eval($s);
}
}
} catch (Error $e) {
$error = 'Caught error : ';
$error .= $e->getMessage() . ', ';
$error .= 'Trace : ';
$error .= json_encode($e->getTrace());
error_log($error, 1);
}
}
/**

View File

@ -43,7 +43,11 @@ $reshook = $hookmanager->executeHooks('formObjectOptions', $parameters, $object,
print $hookmanager->resPrint;
if (empty($reshook)) {
$params = array();
$params['cols'] = isset($parameters['colspanvalue']) ? $parameters['colspanvalue'] : null;
if (isset($tpl_context)) {
$params['tpl_context'] = $tpl_context;
}
$params['cols'] = key_exists('colspanvalue', $parameters) ? $parameters['colspanvalue'] : null;
print $object->showOptionals($extrafields, 'edit', $params);
}

View File

@ -65,6 +65,8 @@ if (empty($reshook) && isset($extrafields->attributes[$object->table_element]['l
$extrafields_collapse_num = '';
$extrafields_collapse_num_old = '';
$i = 0;
// Loop on each extrafield
foreach ($extrafields->attributes[$object->table_element]['label'] as $tmpkeyextra => $tmplabelextra) {
$i++;
@ -114,6 +116,7 @@ if (empty($reshook) && isset($extrafields->attributes[$object->table_element]['l
$lastseparatorkeyfound = $tmpkeyextra;
} else {
$collapse_group = $extrafields_collapse_num.(!empty($object->id) ? '_'.$object->id : '');
print '<tr class="trextrafields_collapse'.$collapse_group;
/*if ($extrafields_collapse_num && $extrafields_collapse_num_old && $extrafields_collapse_num != $extrafields_collapse_num_old) {
print ' trextrafields_collapse_new';