lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

every id is now clear in url + in the hash of the securekey

Browse Source
This commit is contained in:
Dorian Vabre 2021-04-29 09:40:47 +02:00
parent 7405725198
commit df28491524
5 changed files with 7 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
htdocs/eventorganization/class/conferenceorbooth.class.php
View File

@ -241,8 +241,7 @@ class ConferenceOrBooth extends ActionComm
$result = parent::fetch($id, $ref, $ref_ext, $email_msgid); $result = parent::fetch($id, $ref, $ref_ext, $email_msgid);
$encodedid = dol_encode($id, $dolibarr_main_instance_unique_id); $link_subscription = $dolibarr_main_url_root.'/public/eventorganization/attendee_subscription.php?id='.$id;
$link_subscription = $dolibarr_main_url_root.'/public/eventorganization/attendee_subscription.php?id='.$encodedid;
$encodedsecurekey = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2); $encodedsecurekey = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);
$link_subscription .= '&securekey='.urlencode($encodedsecurekey); $link_subscription .= '&securekey='.urlencode($encodedsecurekey);

3
htdocs/eventorganization/conferenceorbooth_list.php
View File

@ -364,8 +364,7 @@ if ($projectid > 0) {
// Link to the vote/register page // Link to the vote/register page
print '<tr><td>'.$langs->trans("RegisterPage").'</td><td>'; print '<tr><td>'.$langs->trans("RegisterPage").'</td><td>';
$encodedid = dol_encode($project->id, $dolibarr_main_instance_unique_id); $linkregister = $dolibarr_main_url_root.'/public/project/index.php?id='.$project->id;
$linkregister = $dolibarr_main_url_root.'/public/project/index.php?id='.$encodedid;
$encodedsecurekey = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$project->id, 2); $encodedsecurekey = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$project->id, 2);
$linkregister .= '&securekey='.urlencode($encodedsecurekey); $linkregister .= '&securekey='.urlencode($encodedsecurekey);
print '<a target="_blank" href="'.$linkregister.'">'.$linkregister.'</a>'; print '<a target="_blank" href="'.$linkregister.'">'.$linkregister.'</a>';

9
htdocs/public/eventorganization/attendee_subscription.php
View File

@ -85,8 +85,7 @@ $email = GETPOST("email");
$societe = GETPOST("societe"); $societe = GETPOST("societe");
// Getting id from Post and decoding it // Getting id from Post and decoding it
$encodedid = GETPOST('id'); $id = GETPOST('id');
$id = dol_decode($encodedid, $dolibarr_main_instance_unique_id);
$conference = new ConferenceOrBooth($db); $conference = new ConferenceOrBooth($db);
$resultconf = $conference->fetch($id); $resultconf = $conference->fetch($id);
@ -248,9 +247,8 @@ if (empty($reshook) && $action == 'add') {
// If the attendee has already paid // If the attendee has already paid
if ($confattendee->status == 1) { if ($confattendee->status == 1) {
$encodedid = dol_encode($id, $dolibarr_main_instance_unique_id);
$securekeyurl = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2); $securekeyurl = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);
$redirection = $dolibarr_main_url_root.'/public/eventorganization/subscriptionok.php?id='.$encodedid.'&securekey='.$securekeyurl; $redirection = $dolibarr_main_url_root.'/public/eventorganization/subscriptionok.php?id='.$id.'&securekey='.$securekeyurl;
Header("Location: ".$redirection); Header("Location: ".$redirection);
exit; exit;
} }
@ -434,9 +432,8 @@ if (empty($reshook) && $action == 'add') {
dol_syslog("Failed to send EMail to ".$sendto, LOG_ERR, 0, '_payment'); dol_syslog("Failed to send EMail to ".$sendto, LOG_ERR, 0, '_payment');
} }
$encodedid = dol_encode($id, $dolibarr_main_instance_unique_id);
$securekeyurl = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2); $securekeyurl = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);
$redirection = $dolibarr_main_url_root.'/public/eventorganization/subscriptionok.php?id='.$encodedid.'&securekey='.$securekeyurl; $redirection = $dolibarr_main_url_root.'/public/eventorganization/subscriptionok.php?id='.$id.'&securekey='.$securekeyurl;
Header("Location: ".$redirection); Header("Location: ".$redirection);
exit; exit;
} }

3
htdocs/public/eventorganization/subscriptionok.php
View File

@ -65,8 +65,7 @@ $object = new stdClass(); // For triggers
$error = 0; $error = 0;
// Security check // Security check
$encodedid = GETPOST("id"); $id = GETPOST("id");
$id = dol_decode($encodedid, $dolibarr_main_instance_unique_id);
$securekeyreceived = GETPOST("securekey"); $securekeyreceived = GETPOST("securekey");
$securekeytocompare = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2); $securekeytocompare = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);

3
htdocs/public/project/index.php
View File

@ -78,8 +78,7 @@ $langs->loadLangs(array("main", "other", "dict", "bills", "companies", "errors",
// No check on module enabled. Done later according to $validpaymentmethod // No check on module enabled. Done later according to $validpaymentmethod
$action = GETPOST('action', 'aZ09'); $action = GETPOST('action', 'aZ09');
$encodedid = GETPOST('id'); $id = GETPOST('id');
$id = dol_decode($encodedid, $dolibarr_main_instance_unique_id);
$securekeyreceived = GETPOST("securekey"); $securekeyreceived = GETPOST("securekey");
$securekeytocompare = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2); $securekeytocompare = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);