lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #14756 from aspangaro/10.0_p42

Browse Source 
FIX Yogosha report 4425 (backport)
This commit is contained in:
Laurent Destailleur 2020-09-17 11:10:56 +02:00 committed by GitHub
commit ca52b5755f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 35 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
htdocs/core/lib/functions.lib.php
View File

@ -7705,19 +7705,16 @@ function getAdvancedPreviewUrl($modulepart, $relativepath, $alldata = 0, $param
if (empty($conf->use_javascript_ajax)) return ''; if (empty($conf->use_javascript_ajax)) return '';
$mime_preview = array('bmp', 'jpeg', 'png', 'gif', 'tiff', 'pdf', 'plain', 'css', 'svg+xml'); $isAllowedForPreview = dolIsAllowedForPreview($relativepath);
//$mime_preview[]='vnd.oasis.opendocument.presentation';
//$mime_preview[]='archive';
$num_mime = array_search(dol_mimetype($relativepath, '', 1), $mime_preview);
if ($alldata == 1) if ($alldata == 1)
{ {
if ($num_mime !== false) return array('target'=>'_blank', 'css'=>'documentpreview', 'url'=>DOL_URL_ROOT.'/document.php?modulepart='.$modulepart.'&attachment=0&file='.urlencode($relativepath).($param?'&'.$param:''), 'mime'=>dol_mimetype($relativepath), ); if (isAllowedForPreview) return array('target'=>'_blank', 'css'=>'documentpreview', 'url'=>DOL_URL_ROOT.'/document.php?modulepart='.$modulepart.'&attachment=0&file='.urlencode($relativepath).($param?'&'.$param:''), 'mime'=>dol_mimetype($relativepath), );
else return array(); else return array();
} }
// old behavior // old behavior, return a string
if ($num_mime !== false) return 'javascript:document_preview(\''.dol_escape_js(DOL_URL_ROOT.'/document.php?modulepart='.$modulepart.'&attachment=0&file='.urlencode($relativepath).($param?'&'.$param:'')).'\', \''.dol_mimetype($relativepath).'\', \''.dol_escape_js($langs->trans('Preview')).'\')'; if ($isAllowedForPreview) return 'javascript:document_preview(\''.dol_escape_js(DOL_URL_ROOT.'/document.php?modulepart='.$modulepart.'&attachment=0&file='.urlencode($relativepath).($param?'&'.$param:'')).'\', \''.dol_mimetype($relativepath).'\', \''.dol_escape_js($langs->trans('Preview')).'\')';
else return ''; else return '';
} }
@ -7741,6 +7738,31 @@ function ajax_autoselect($htmlname, $addlink = '')
return $out; return $out;
} }
/**
* Return if a file is qualified for preview
*
* @param string $file Filename we looking for information
* @return int 1 If allowed, 0 otherwise
* @see dol_mimetype(), image_format_supported() from images.lib.php
*/
function dolIsAllowedForPreview($file)
{
global $conf;
// Check .noexe extension in filename
if (preg_match('/\.noexe$/i', $file)) return 0;
// Check mime types
$mime_preview = array('bmp', 'jpeg', 'png', 'gif', 'tiff', 'pdf', 'plain', 'css', 'webp');
if (!empty($conf->global->MAIN_ALLOW_SVG_FILES_AS_IMAGES)) $mime_preview[] = 'svg+xml';
//$mime_preview[]='vnd.oasis.opendocument.presentation';
//$mime_preview[]='archive';
$num_mime = array_search(dol_mimetype($file, '', 1), $mime_preview);
if ($num_mime !== false) return 1;
// By default, not allowed for preview
return 0;
}
/** /**
* Return mime type of a file * Return mime type of a file
@ -7749,7 +7771,7 @@ function ajax_autoselect($htmlname, $addlink = '')
* @param string $default Default mime type if extension not found in known list * @param string $default Default mime type if extension not found in known list
* @param int $mode 0=Return full mime, 1=otherwise short mime string, 2=image for mime type, 3=source language, 4=css of font fa * @param int $mode 0=Return full mime, 1=otherwise short mime string, 2=image for mime type, 3=source language, 4=css of font fa
* @return string Return a mime type family (text/xxx, application/xxx, image/xxx, audio, video, archive) * @return string Return a mime type family (text/xxx, application/xxx, image/xxx, audio, video, archive)
* @see image_format_supported() from images.lib.php * @see dolIsAllowedForPreview(), image_format_supported() from images.lib.php
*/ */
function dol_mimetype($file, $default = 'application/octet-stream', $mode = 0) function dol_mimetype($file, $default = 'application/octet-stream', $mode = 0)
{ {

9
htdocs/document.php
View File

@ -156,12 +156,13 @@ if (isset($_GET["attachment"])) $attachment = GETPOST("attachment", 'alpha')?tru
if (! empty($conf->global->MAIN_DISABLE_FORCE_SAVEAS)) $attachment=false; if (! empty($conf->global->MAIN_DISABLE_FORCE_SAVEAS)) $attachment=false;
// Define mime type // Define mime type
$type = 'application/octet-stream'; $type = 'application/octet-stream'; // By default
if (GETPOST('type', 'alpha')) $type=GETPOST('type', 'alpha'); if (GETPOST('type', 'alpha')) $type=GETPOST('type', 'alpha');
else $type=dol_mimetype($original_file); else $type=dol_mimetype($original_file);
// Security: Force to octet-stream if file is a dangerous file // Security: Force to octet-stream if file is a dangerous file. For example when it is a .noexe file
if (preg_match('/\.noexe$/i', $original_file)) $type = 'application/octet-stream'; if (!dolIsAllowedForPreview($original_file)) {
$type = 'application/octet-stream';
}
// Security: Delete string ../ into $original_file // Security: Delete string ../ into $original_file
$original_file = str_replace("../", "/", $original_file); $original_file = str_replace("../", "/", $original_file);