lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX CWE-79 - huntr - Fix option MAIN_ALLOW_SVG_FILES_AS_IMAGES

Browse Source
This commit is contained in:
Laurent Destailleur 2021-05-24 19:46:19 +02:00
parent cdf3b7f9a8
commit d4310f49c4
2 changed files with 57 additions and 43 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
htdocs/admin/system/security.php
View File

@ -217,7 +217,7 @@ print '<br>';
print '<strong>$dolibarr_nocsrfcheck</strong>: '.$dolibarr_nocsrfcheck;
if (!empty($dolibarr_nocsrfcheck)) {
print img_picto('', 'warning').' &nbsp; '.$langs->trans("IfYouAreOnAProductionSetThis", 0);
print ' &nbsp; '.img_picto('', 'warning').' '.$langs->trans("IfYouAreOnAProductionSetThis", 0);
}
print '<br>';
@ -234,16 +234,18 @@ print '<br>';
print '<br>';
print '<br>';
print '<br>';
print load_fiche_titre($langs->trans("Menu").' '.$langs->trans("SecuritySetup"), '', 'folder');
print load_fiche_titre($langs->trans("Menu").' '.$langs->trans("SecuritySetup").' + '.$langs->trans("OtherSetup"), '', 'folder');
//print '<strong>'.$langs->trans("PasswordEncryption").'</strong>: ';
print '<strong>MAIN_SECURITY_HASH_ALGO</strong> = '.(empty($conf->global->MAIN_SECURITY_HASH_ALGO) ? '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>' : $conf->global->MAIN_SECURITY_HASH_ALGO)." &nbsp; ";
if (empty($conf->global->MAIN_SECURITY_HASH_ALGO)) {
print '<span class="opacitymedium"> &nbsp; &nbsp; If unset: \'md5\'</span>';
}
print '<br>';
if ($conf->global->MAIN_SECURITY_HASH_ALGO != 'password_hash') {
print '<strong>MAIN_SECURITY_SALT</strong> = '.(empty($conf->global->MAIN_SECURITY_SALT) ? '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>' : $conf->global->MAIN_SECURITY_SALT).'<br>';
print '<br><strong>MAIN_SECURITY_SALT</strong> = '.(empty($conf->global->MAIN_SECURITY_SALT) ? '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>' : $conf->global->MAIN_SECURITY_SALT).'<br>';
} else {
print '<span class="opacitymedium">('.$langs->trans("Recommanded").': password_hash)</span>';
print '<br>';
}
if ($conf->global->MAIN_SECURITY_HASH_ALGO != 'password_hash') {
print '<div class="info">The recommanded value for MAIN_SECURITY_HASH_ALGO is now \'password_hash\' but setting it now will make ALL existing passwords of all users not valid, so update is not possible.<br>';
@ -259,18 +261,20 @@ print '<br>';
print '<strong>MAIN_SECURITY_ANTI_SSRF_SERVER_IP</strong> = '.(empty($conf->global->MAIN_SECURITY_ANTI_SSRF_SERVER_IP) ? '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>' : $conf->global->MAIN_SECURITY_ANTI_SSRF_SERVER_IP)."<br>";
print '<br>';
print '<strong>MAIN_ALLOW_SVG_FILES_AS_IMAGES</strong> = '.(empty($conf->global->MAIN_ALLOW_SVG_FILES_AS_IMAGES) ? '0 &nbsp; <span class="opacitymedium">('.$langs->trans("Recommanded").': 0)</span>' : $conf->global->MAIN_ALLOW_SVG_FILES_AS_IMAGES)."<br>";
print '<br>';
print '<strong>MAIN_EXEC_USE_POPEN</strong> = ';
if (empty($conf->global->MAIN_EXEC_USE_POPEN)) {
print '<span class="opacitymedium">'.$langs->trans("Undefined").'</span> &nbsp; ';
print '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>';
} else {
print $conf->global->MAIN_EXEC_USE_POPEN.' &nbsp; ';
print $conf->global->MAIN_EXEC_USE_POPEN;
}
if ($execmethod == 1) {
print ' --> "exec" PHP method will be used for shell commands.';
print ' &nbsp; <span class="opacitymedium">("exec" PHP method will be used for shell commands)</span>';
}
if ($execmethod == 2) {
print ' --> "popen" PHP method will be used for shell commands.';
print ' &nbsp; <span class="opacitymedium">("popen" PHP method will be used for shell commands)</span>';
}
print "<br>";
print '<br>';

80
htdocs/core/class/html.form.class.php
View File

@ -8193,41 +8193,47 @@ class Form
if ($modulepart == 'societe') {
$dir = $conf->societe->multidir_output[$entity];
if (!empty($object->logo)) {
if ((string) $imagesize == 'mini') {
$file = get_exdir(0, 0, 0, 0, $object, 'thirdparty').'logos/'.getImageFileNameForSize($object->logo, '_mini'); // getImageFileNameForSize include the thumbs
} elseif ((string) $imagesize == 'small') {
$file = get_exdir(0, 0, 0, 0, $object, 'thirdparty').'logos/'.getImageFileNameForSize($object->logo, '_small');
} else {
$file = get_exdir(0, 0, 0, 0, $object, 'thirdparty').'logos/'.$object->logo;
if (dolIsAllowedForPreview($object->logo)) {
if ((string) $imagesize == 'mini') {
$file = get_exdir(0, 0, 0, 0, $object, 'thirdparty').'logos/'.getImageFileNameForSize($object->logo, '_mini'); // getImageFileNameForSize include the thumbs
} elseif ((string) $imagesize == 'small') {
$file = get_exdir(0, 0, 0, 0, $object, 'thirdparty').'logos/'.getImageFileNameForSize($object->logo, '_small');
} else {
$file = get_exdir(0, 0, 0, 0, $object, 'thirdparty').'logos/'.$object->logo;
}
$originalfile = get_exdir(0, 0, 0, 0, $object, 'thirdparty').'logos/'.$object->logo;
}
$originalfile = get_exdir(0, 0, 0, 0, $object, 'thirdparty').'logos/'.$object->logo;
}
$email = $object->email;
} elseif ($modulepart == 'contact') {
$dir = $conf->societe->multidir_output[$entity].'/contact';
if (!empty($object->photo)) {
if ((string) $imagesize == 'mini') {
$file = get_exdir(0, 0, 0, 0, $object, 'contact').'photos/'.getImageFileNameForSize($object->photo, '_mini');
} elseif ((string) $imagesize == 'small') {
$file = get_exdir(0, 0, 0, 0, $object, 'contact').'photos/'.getImageFileNameForSize($object->photo, '_small');
} else {
$file = get_exdir(0, 0, 0, 0, $object, 'contact').'photos/'.$object->photo;
if (dolIsAllowedForPreview($object->logo)) {
if ((string) $imagesize == 'mini') {
$file = get_exdir(0, 0, 0, 0, $object, 'contact').'photos/'.getImageFileNameForSize($object->photo, '_mini');
} elseif ((string) $imagesize == 'small') {
$file = get_exdir(0, 0, 0, 0, $object, 'contact').'photos/'.getImageFileNameForSize($object->photo, '_small');
} else {
$file = get_exdir(0, 0, 0, 0, $object, 'contact').'photos/'.$object->photo;
}
$originalfile = get_exdir(0, 0, 0, 0, $object, 'contact').'photos/'.$object->photo;
}
$originalfile = get_exdir(0, 0, 0, 0, $object, 'contact').'photos/'.$object->photo;
}
$email = $object->email;
$capture = 'user';
} elseif ($modulepart == 'userphoto') {
$dir = $conf->user->dir_output;
if (!empty($object->photo)) {
if ((string) $imagesize == 'mini') {
$file = get_exdir(0, 0, 0, 0, $object, 'user').getImageFileNameForSize($object->photo, '_mini');
} elseif ((string) $imagesize == 'small') {
$file = get_exdir(0, 0, 0, 0, $object, 'user').getImageFileNameForSize($object->photo, '_small');
} else {
$file = get_exdir(0, 0, 0, 0, $object, 'user').$object->photo;
if (dolIsAllowedForPreview($object->logo)) {
if ((string) $imagesize == 'mini') {
$file = get_exdir(0, 0, 0, 0, $object, 'user').getImageFileNameForSize($object->photo, '_mini');
} elseif ((string) $imagesize == 'small') {
$file = get_exdir(0, 0, 0, 0, $object, 'user').getImageFileNameForSize($object->photo, '_small');
} else {
$file = get_exdir(0, 0, 0, 0, $object, 'user').$object->photo;
}
$originalfile = get_exdir(0, 0, 0, 0, $object, 'user').$object->photo;
}
$originalfile = get_exdir(0, 0, 0, 0, $object, 'user').$object->photo;
}
if (!empty($conf->global->MAIN_OLD_IMAGE_LINKS)) {
$altfile = $object->id.".jpg"; // For backward compatibility
@ -8237,14 +8243,16 @@ class Form
} elseif ($modulepart == 'memberphoto') {
$dir = $conf->adherent->dir_output;
if (!empty($object->photo)) {
if ((string) $imagesize == 'mini') {
$file = get_exdir(0, 0, 0, 0, $object, 'member').'photos/'.getImageFileNameForSize($object->photo, '_mini');
} elseif ((string) $imagesize == 'small') {
$file = get_exdir(0, 0, 0, 0, $object, 'member').'photos/'.getImageFileNameForSize($object->photo, '_small');
} else {
$file = get_exdir(0, 0, 0, 0, $object, 'member').'photos/'.$object->photo;
if (dolIsAllowedForPreview($object->logo)) {
if ((string) $imagesize == 'mini') {
$file = get_exdir(0, 0, 0, 0, $object, 'member').'photos/'.getImageFileNameForSize($object->photo, '_mini');
} elseif ((string) $imagesize == 'small') {
$file = get_exdir(0, 0, 0, 0, $object, 'member').'photos/'.getImageFileNameForSize($object->photo, '_small');
} else {
$file = get_exdir(0, 0, 0, 0, $object, 'member').'photos/'.$object->photo;
}
$originalfile = get_exdir(0, 0, 0, 0, $object, 'member').'photos/'.$object->photo;
}
$originalfile = get_exdir(0, 0, 0, 0, $object, 'member').'photos/'.$object->photo;
}
if (!empty($conf->global->MAIN_OLD_IMAGE_LINKS)) {
$altfile = $object->id.".jpg"; // For backward compatibility
@ -8255,14 +8263,16 @@ class Form
// Generic case to show photos
$dir = $conf->$modulepart->dir_output;
if (!empty($object->photo)) {
if ((string) $imagesize == 'mini') {
$file = get_exdir($id, 2, 0, 0, $object, $modulepart).'photos/'.getImageFileNameForSize($object->photo, '_mini');
} elseif ((string) $imagesize == 'small') {
$file = get_exdir($id, 2, 0, 0, $object, $modulepart).'photos/'.getImageFileNameForSize($object->photo, '_small');
} else {
$file = get_exdir($id, 2, 0, 0, $object, $modulepart).'photos/'.$object->photo;
if (dolIsAllowedForPreview($object->logo)) {
if ((string) $imagesize == 'mini') {
$file = get_exdir($id, 2, 0, 0, $object, $modulepart).'photos/'.getImageFileNameForSize($object->photo, '_mini');
} elseif ((string) $imagesize == 'small') {
$file = get_exdir($id, 2, 0, 0, $object, $modulepart).'photos/'.getImageFileNameForSize($object->photo, '_small');
} else {
$file = get_exdir($id, 2, 0, 0, $object, $modulepart).'photos/'.$object->photo;
}
$originalfile = get_exdir($id, 2, 0, 0, $object, $modulepart).'photos/'.$object->photo;
}
$originalfile = get_exdir($id, 2, 0, 0, $object, $modulepart).'photos/'.$object->photo;
}
if (!empty($conf->global->MAIN_OLD_IMAGE_LINKS)) {
$altfile = $object->id.".jpg"; // For backward compatibility