lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Typo fix

Browse Source
This commit is contained in:
Laurent Destailleur 2009-08-21 20:22:46 +00:00
parent 7edaddcd17
commit c7e3ffbadb
4 changed files with 18 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
htdocs/admin/index.php
View File

@ -55,10 +55,11 @@ print $langs->trans("SetupDescription1").' ';
print $langs->trans("AreaForAdminOnly").'<br>'; print $langs->trans("AreaForAdminOnly").'<br>';
print "<br>";
print "<br>"; print "<br>";
print $langs->trans("SetupDescription2")."<br>"; print $langs->trans("SetupDescription2")."<br>";
print "<br><br>"; print "<br>";
//print '<hr style="color: #DDDDDD;">'; //print '<hr style="color: #DDDDDD;">';
print img_picto('','puce').' '.$langs->trans("SetupDescription3")."<br>"; print img_picto('','puce').' '.$langs->trans("SetupDescription3")."<br>";
print '<br>'; print '<br>';

2
htdocs/cron/functions_cron.lib.php
View File

@ -20,7 +20,7 @@
/** /**
* \file cron/functions_cron.lib.php * \file cron/functions_cron.lib.php
* \ingroup core * \ingroup core
* \brief Functions for miscellanous cron tasks * \brief Functions for miscellaneous cron tasks
* \version $Id$ * \version $Id$
*/ */

2
htdocs/langs/en_US/admin.lang
View File

@ -660,7 +660,7 @@ ListEvents=Audit events
ListOfSecurityEvents=List of Dolibarr security events ListOfSecurityEvents=List of Dolibarr security events
LogEventDesc=You can enable here the logging for Dolibarr security events. Administrators can then see its content via menu <b>System tools - Audit</b>. Warning, this feature can consume a large amount of data in database. LogEventDesc=You can enable here the logging for Dolibarr security events. Administrators can then see its content via menu <b>System tools - Audit</b>. Warning, this feature can consume a large amount of data in database.
AreaForAdminOnly=Those features can be used by <b>administrator users</b> only. AreaForAdminOnly=Those features can be used by <b>administrator users</b> only.
SystemInfoDesc=System information is miscellanous technical information you get in read only mode and visible for administrators only. SystemInfoDesc=System information is miscellaneous technical information you get in read only mode and visible for administrators only.
SystemAreaForAdminOnly=This area is available for administrator users only. None of the Dolibarr permissions can reduce this limit. SystemAreaForAdminOnly=This area is available for administrator users only. None of the Dolibarr permissions can reduce this limit.
CompanyFundationDesc=Edit on this page all known information of the company or foundation you need to manage CompanyFundationDesc=Edit on this page all known information of the company or foundation you need to manage
DisplayDesc=You can choose each parameter related to the Dolibarr look and feel here DisplayDesc=You can choose each parameter related to the Dolibarr look and feel here

25
htdocs/main.inc.php
View File

@ -62,8 +62,9 @@ if (function_exists('get_magic_quotes_gpc')) // magic_quotes_* removed in PHP6
@set_magic_quotes_runtime(0); @set_magic_quotes_runtime(0);
} }
// Security: SQL Injection protection (Filters on GET, POST, REQUEST, COOKIE)
function test_sql_inject($val) // Security: SQL and Script Injection protection (Filters on GET, POST)
function test_sql_and_script_inject($val)
{ {
$sql_inj = 0; $sql_inj = 0;
$sql_inj += eregi('delete[[:space:]]+from', $val); $sql_inj += eregi('delete[[:space:]]+from', $val);
@ -71,29 +72,31 @@ function test_sql_inject($val)
$sql_inj += eregi('update.+set.+=', $val); $sql_inj += eregi('update.+set.+=', $val);
$sql_inj += eregi('insert[[:space:]]+into', $val); $sql_inj += eregi('insert[[:space:]]+into', $val);
$sql_inj += eregi('select.+from', $val); $sql_inj += eregi('select.+from', $val);
$sql_inj += eregi('<script', $val);
return $sql_inj; return $sql_inj;
} }
// Added by Matelli (See http://matelli.fr/showcases/patchs-dolibarr/patch-dolibarr-fix-sql-injection-check-in-array.html) function analyse_sql_and_script(&$var)
function analyse_sql_injection(&$var)
{ {
if (is_array($var)) if (is_array($var))
{ {
$result = array(); $result = array();
foreach ($var as $key => $value) foreach ($var as $key => $value)
{ {
if (test_sql_inject($key) > 0) if (test_sql_and_script_inject($key) > 0)
{ {
unset($var[$key]); print 'Access refused by SQL/Script injection protection in main.inc.php';
exit;
} }
else else
{ {
if (analyse_sql_injection($value)) if (analyse_sql_and_script($value))
{ {
$var[$key] = $value; $var[$key] = $value;
} }
else else
{ {
unset($var[$key]); print 'Access refused by SQL/Script injection protection in main.inc.php';
exit;
} }
} }
} }
@ -101,11 +104,11 @@ function analyse_sql_injection(&$var)
} }
else else
{ {
return (test_sql_inject($var) <= 0); return (test_sql_and_script_inject($var) <= 0);
} }
} }
analyse_sql_injection($_GET); analyse_sql_and_script($_GET);
analyse_sql_injection($_POST); analyse_sql_and_script($_POST);
// Security: CSRF protection // Security: CSRF protection
// The test to do is to check if referrer ($_SERVER['HTTP_REFERER']) is same web site than Dolibarr ($_SERVER['HTTP_HOST']). // The test to do is to check if referrer ($_SERVER['HTTP_REFERER']) is same web site than Dolibarr ($_SERVER['HTTP_HOST']).