From d1fa46089fc7ed0bf998a997f499482fc0651c6f Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Wed, 24 Mar 2021 22:54:40 +0100 Subject: [PATCH] Removed not used page. Enhance the WAF --- htdocs/core/lib/functions.lib.php | 3 ++- htdocs/societe/card.php | 4 ++-- htdocs/ticket/card.php | 14 ++++++++------ 3 files changed, 12 insertions(+), 9 deletions(-) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 5a1745a9822..d567489c2f1 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -746,6 +746,7 @@ function checkVal($out = '', $check = 'alphanohtml', $filter = null, $options = case 'alpha': // No html and no ../ and " case 'alphanohtml': // Recommended for most scalar parameters and search parameters if (!is_array($out)) { + $out = dol_string_nohtmltag($out, 0); // '"' is dangerous because param in url can close the href= or src= and add javascript functions. // '../' is dangerous because it allows dir transversals $out = trim($out); @@ -754,11 +755,11 @@ function checkVal($out = '', $check = 'alphanohtml', $filter = null, $options = $out = str_ireplace(array('"', '"', '../'), '', $out); } while ($oldstringtoclean != $out); // keep lines feed - $out = dol_string_nohtmltag($out, 0); } break; case 'alphawithlgt': // No " and no ../ but we keep balanced < > tags with no special chars inside. Can be used for email string like "Name " if (!is_array($out)) { + $out = dol_html_entity_decode($out, ENT_COMPAT | ENT_HTML5, 'UTF-8'); // '"' is dangerous because param in url can close the href= or src= and add javascript functions. // '../' is dangerous because it allows dir transversals $out = trim($out); diff --git a/htdocs/societe/card.php b/htdocs/societe/card.php index d42ed635e82..fd4fde95243 100644 --- a/htdocs/societe/card.php +++ b/htdocs/societe/card.php @@ -2067,8 +2067,8 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action)) { print ''.img_picto('', 'object_phoning_fax').' '; // EMail / Web - print ''.$form->editfieldkey('EMail', 'email', GETPOST('email', 'alpha'), $object, 0, 'string', '', (!empty($conf->global->SOCIETE_EMAIL_MANDATORY))).''; - print ''.img_picto('', 'object_email').' '; + print ''.$form->editfieldkey('EMail', 'email', GETPOST('email', 'custom', 0, FILTER_SANITIZE_EMAIL), $object, 0, 'string', '', (!empty($conf->global->SOCIETE_EMAIL_MANDATORY))).''; + print ''.img_picto('', 'object_email').' '; print ''.$form->editfieldkey('Web', 'url', GETPOST('url', 'alpha'), $object, 0).''; print ''.img_picto('', 'globe').' '; diff --git a/htdocs/ticket/card.php b/htdocs/ticket/card.php index 8741fdc6b66..98bcccd4ca1 100644 --- a/htdocs/ticket/card.php +++ b/htdocs/ticket/card.php @@ -692,7 +692,7 @@ if ($action == 'create' || $action == 'presend') { $formticket->param = array('origin' => GETPOST('origin'), 'originid' => GETPOST('originid')); $formticket->showForm(1, 'create', 0); -} elseif ($action == 'edit' && $user->rights->ticket->write && $object->fk_statut < Ticket::STATUS_CLOSED) { + /*} elseif ($action == 'edit' && $user->rights->ticket->write && $object->fk_statut < Ticket::STATUS_CLOSED) { $formticket = new FormTicket($db); $head = ticket_prepare_head($object); @@ -709,22 +709,22 @@ if ($action == 'create' || $action == 'presend') { // Type print ''; - $formticket->selectTypesTickets((GETPOST('type_code') ? GETPOST('type_code') : $object->type_code), 'type_code', '', '2'); + $formticket->selectTypesTickets((GETPOSTISSET('type_code') ? GETPOST('type_code') : $object->type_code), 'type_code', '', '2'); print ''; // Severity print ''; - $formticket->selectSeveritiesTickets((GETPOST('severity_code') ? GETPOST('severity_code') : $object->severity_code), 'severity_code', '', '2'); + $formticket->selectSeveritiesTickets((GETPOSTISSET('severity_code') ? GETPOST('severity_code') : $object->severity_code), 'severity_code', '', '2'); print ''; // Group print ''; - $formticket->selectGroupTickets((GETPOST('category_code') ? GETPOST('category_code') : $object->category_code), 'category_code', '', '2'); + $formticket->selectGroupTickets((GETPOSTISSET('category_code') ? GETPOST('category_code') : $object->category_code), 'category_code', '', '2'); print ''; // Subject print ''; - print ''; + print ''; print ''; // Other attributes @@ -746,7 +746,7 @@ if ($action == 'create' || $action == 'presend') { print ''; print ''; - print ''; + print ''; */ } elseif (empty($action) || $action == 'view' || $action == 'addlink' || $action == 'dellink' || $action == 'presend' || $action == 'presend_addmessage' || $action == 'close' || $action == 'delete' || $action == 'editcustomer' || $action == 'progression' || $action == 'reopen' || $action == 'editsubject' || $action == 'edit_extras' || $action == 'update_extras' || $action == 'edit_extrafields' || $action == 'set_extrafields' || $action == 'classify' || $action == 'sel_contract' || $action == 'edit_message_init' || $action == 'set_status' || $action == 'dellink') { if ($res > 0) { @@ -1282,9 +1282,11 @@ if ($action == 'create' || $action == 'presend') { print '
'.$langs->trans('TicketAddIntervention').'
'; } + /* This is useless. We can already modify each field individually if ($user->rights->ticket->write && $object->fk_statut < Ticket::STATUS_CLOSED) { print '
'.$langs->trans('Modify').'
'; } + */ // Close ticket if statut is read if ($object->fk_statut > 0 && $object->fk_statut < Ticket::STATUS_CLOSED && $user->rights->ticket->write) {