lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add patch http://www.matelli.fr/showcases/patchs-dolibarr/patch-dolibarr-fix-sql-injection-check-in-array.html

Browse Source
This commit is contained in:
Laurent Destailleur 2008-09-30 00:10:49 +00:00
parent b5d31f9d5d
commit cf3345a2d5
1 changed files with 330 additions and 308 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
htdocs/main.inc.php
View File

@ -26,7 +26,7 @@
\ingroup core \ingroup core
\brief Fichier de formatage generique des ecrans Dolibarr \brief Fichier de formatage generique des ecrans Dolibarr
\version $Id$ \version $Id$
*/ */
// Pour le tuning optionnel. Activer si la variable d'environnement DOL_TUNING est positionnee. // Pour le tuning optionnel. Activer si la variable d'environnement DOL_TUNING est positionnee.
// A appeler avant tout. Fait l'equivalent de la fonction dol_microtime_float pas encore chargee. // A appeler avant tout. Fait l'equivalent de la fonction dol_microtime_float pas encore chargee.
@ -68,19 +68,41 @@ function test_sql_inject($val)
$sql_inj += eregi('update.+set.+=', $val); $sql_inj += eregi('update.+set.+=', $val);
$sql_inj += eregi('insert[[:space:]]+into', $val); $sql_inj += eregi('insert[[:space:]]+into', $val);
$sql_inj += eregi('select.+from', $val); $sql_inj += eregi('select.+from', $val);
return $sql_inj; return $sql_inj;
} }
foreach ($_GET as $key => $val) // Added by Matelli (See http://matelli.fr/showcases/patchs-dolibarr/patch-dolibarr-fix-sql-injection-check-in-array.html)
function analyse_sql_injection(&$var)
{ {
if (test_sql_inject($val) > 0) if (is_array($var))
unset($_GET[$key]); {
} $result = array();
foreach ($_POST as $key => $val) foreach ($var as $key => $value)
{ {
if (test_sql_inject($val) > 0) if (test_sql_inject($key) > 0)
unset($_POST[$key]); {
unset($var[$key]);
}
else
{
if (analyse_sql_injection($value))
{
$var[$key] = $value;
}
else
{
unset($var[$key]);
}
}
}
return true;
}
else
{
return (test_sql_inject($var) <= 0);
}
} }
analyse_sql_injection($_GET);
analyse_sql_injection($_POST);
// Fin filtre des GET et POST // Fin filtre des GET et POST
@ -575,7 +597,7 @@ else
\param conf Conf object \param conf Conf object
\param mysoc Company object \param mysoc Company object
\remarks Il faut changer le code html dans cette fonction pour changer le design de la logon \remarks Il faut changer le code html dans cette fonction pour changer le design de la logon
*/ */
function dol_loginfunction($langs,$conf,$mysoc) function dol_loginfunction($langs,$conf,$mysoc)
{ {
$langs->load("main"); $langs->load("main");
@ -954,9 +976,9 @@ function top_menu($head, $title="", $target="")
$html=new Form($db); $html=new Form($db);
print $html->textwithtooltip('',$htmltext,2,1,$text); print $html->textwithtooltip('',$htmltext,2,1,$text);
// print '<img class="login" border="0" src="'.DOL_URL_ROOT.'/theme/'.$conf->theme.'/img/logout.png"'; // print '<img class="login" border="0" src="'.DOL_URL_ROOT.'/theme/'.$conf->theme.'/img/logout.png"';
// print ' alt="'.$title.'" title="'.$title.'"'; // print ' alt="'.$title.'" title="'.$title.'"';
// print '>'; // print '>';
print "\n</div>\n<!-- End top horizontal menu -->\n"; print "\n</div>\n<!-- End top horizontal menu -->\n";
} }
@ -972,7 +994,7 @@ function left_menu($menu_array, $helppagename='', $form_search='')
{ {
global $user, $conf, $langs, $db; global $user, $conf, $langs, $db;
// print '<div class="vmenuplusfiche">'."\n"; // print '<div class="vmenuplusfiche">'."\n";
print '<table width="100%" class="notopnoleftnoright"><tr><td class="vmenu" valign="top">'; print '<table width="100%" class="notopnoleftnoright"><tr><td class="vmenu" valign="top">';
print "\n"; print "\n";
@ -1070,8 +1092,8 @@ function left_menu($menu_array, $helppagename='', $form_search='')
print "\n"; print "\n";
print '<!-- fin de zone gauche, debut zone droite -->'."\n"; print '<!-- fin de zone gauche, debut zone droite -->'."\n";
// print '</div>'."\n"; // print '</div>'."\n";
// print '<div class="vmenuplusfiche">'."\n"; // print '<div class="vmenuplusfiche">'."\n";
print '</td><td valign="top">'."\n"; print '</td><td valign="top">'."\n";
@ -1119,7 +1141,7 @@ function llxFooter($foot='',$limitIEbug=1)
print "\n".'</div> <!-- end div class="fiche" -->'."\n"; print "\n".'</div> <!-- end div class="fiche" -->'."\n";
// print "\n".'</div> <!-- end div class="vmenuplusfiche" -->'."\n"; // print "\n".'</div> <!-- end div class="vmenuplusfiche" -->'."\n";
print "\n".'</td></tr></table> <!-- end right area -->'."\n"; print "\n".'</td></tr></table> <!-- end right area -->'."\n";
if (! empty($_SERVER['DOL_TUNING'])) if (! empty($_SERVER['DOL_TUNING']))