lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix #huntr88841fe0-e332-49ce-a46b-36d4f091fd89

Browse Source
This commit is contained in:
Laurent Destailleur 2023-02-13 13:29:30 +01:00
parent 61c734a6e3
commit cccd7494df
3 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/core/lib/website.lib.php
View File

@ -69,7 +69,7 @@ function dolStripPhpCode($str, $replacewith = '')
* *
* @param string $str String to clean * @param string $str String to clean
* @return string Result string with php code only * @return string Result string with php code only
* @see dolStripPhpCode() * @see dolStripPhpCode(), checkPHPCode()
*/ */
function dolKeepOnlyPhpCode($str) function dolKeepOnlyPhpCode($str)
{ {

1
htdocs/core/lib/website2.lib.php
View File

@ -680,6 +680,7 @@ function showWebsiteTemplates(Website $website)
* @param string $phpfullcodestringold PHP old string. For exemple "<?php echo 'a' ?><php echo 'b' ?>" * @param string $phpfullcodestringold PHP old string. For exemple "<?php echo 'a' ?><php echo 'b' ?>"
* @param string $phpfullcodestring PHP new string. For exemple "<?php echo 'a' ?><php echo 'c' ?>" * @param string $phpfullcodestring PHP new string. For exemple "<?php echo 'a' ?><php echo 'c' ?>"
* @return int Error or not * @return int Error or not
* @see dolKeepOnlyPhpCode()
*/ */
function checkPHPCode($phpfullcodestringold, $phpfullcodestring) function checkPHPCode($phpfullcodestringold, $phpfullcodestring)
{ {

10
htdocs/website/index.php
View File

@ -806,6 +806,16 @@ if ($action == 'addcontainer' && $usercanedit) {
// Remove comments // Remove comments
$tmp['content'] = removeHtmlComment($tmp['content']); $tmp['content'] = removeHtmlComment($tmp['content']);
// Check there is no PHP content into the imported file (must be only HTML + JS)
$phpcontent = dolKeepOnlyPhpCode('', $tmp['content']);
if ($phpcontent) {
$error++;
setEventMessages('Error getting '.$urltograb.': file that include PHP content is not allowed', null, 'errors');
$action = 'createcontainer';
}
}
if (!$error) {
$regs = array(); $regs = array();
preg_match('/<head>(.*)<\/head>/ims', $tmp['content'], $regs); preg_match('/<head>(.*)<\/head>/ims', $tmp['content'], $regs);