lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX #15892 #15017

Browse Source
This commit is contained in:
Laurent Destailleur 2021-01-06 20:41:40 +01:00
parent 71278b173e
commit ef8021467b
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
htdocs/core/lib/functions.lib.php
View File

@ -680,7 +680,8 @@ function checkVal($out = '', $check = 'alphanohtml', $filter = null, $options =
if (!is_array($out)) { if (!is_array($out)) {
// '"' is dangerous because param in url can close the href= or src= and add javascript functions. // '"' is dangerous because param in url can close the href= or src= and add javascript functions.
// '../' is dangerous because it allows dir transversals // '../' is dangerous because it allows dir transversals
$out = str_replace(array('"', '"', '../'), '', trim($out)); $out = str_replace(array('"', '"'), "''", trim($out));
$out = str_replace(array('../'), '', trim($out));
// keep lines feed // keep lines feed
$out = dol_string_nohtmltag($out, 0); $out = dol_string_nohtmltag($out, 0);
} }