From a7f6bbd316e9b96216e9b2c7a065c9251c9a8907 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Doursenaud?= Date: Wed, 20 May 2015 17:32:34 +0200 Subject: [PATCH] Properly escape untrusted data to prevent HTML injection. First pass for #2857 --- htdocs/adherents/liste.php | 36 ++++++++++++++++++------------------ htdocs/contact/list.php | 36 ++++++++++++++++++------------------ htdocs/contrat/liste.php | 12 ++++++------ htdocs/product/liste.php | 18 +++++++++--------- htdocs/societe/societe.php | 36 ++++++++++++++++++------------------ 5 files changed, 69 insertions(+), 69 deletions(-) diff --git a/htdocs/adherents/liste.php b/htdocs/adherents/liste.php index 1d80c82a713..13bd3aee736 100644 --- a/htdocs/adherents/liste.php +++ b/htdocs/adherents/liste.php @@ -2,7 +2,7 @@ /* Copyright (C) 2001-2003 Rodolphe Quiedeville * Copyright (C) 2002-2003 Jean-Louis Bergamo * Copyright (C) 2004-2014 Laurent Destailleur - * Copyright (C) 2013 Raphaël Doursenaud + * Copyright (C) 2013-2015 Raphaël Doursenaud * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -97,7 +97,7 @@ $sql.= ", ".MAIN_DB_PREFIX."adherent_type as t"; $sql.= " WHERE d.fk_adherent_type = t.rowid "; if ($catid > 0) $sql.= " AND cm.fk_categorie = ".$catid; if ($catid == -2) $sql.= " AND cm.fk_categorie IS NULL"; -if ($search_categ > 0) $sql.= " AND cm.fk_categorie = ".$search_categ; +if ($search_categ > 0) $sql.= " AND cm.fk_categorie = ".$db->escape($search_categ); if ($search_categ == -2) $sql.= " AND cm.fk_categorie IS NULL"; $sql.= " AND d.entity = ".$conf->entity; if ($sall) @@ -106,15 +106,15 @@ if ($sall) $scrit = explode(' ', $sall); foreach ($scrit as $crit) { $sql.=" AND ("; - if (is_numeric($sall)) $sql.= "d.rowid = ".$sall." OR "; - $sql.=" d.firstname LIKE '%".$sall."%' OR d.lastname LIKE '%".$sall."%' OR d.societe LIKE '%".$sall."%'"; - $sql.=" OR d.email LIKE '%".$sall."%' OR d.login LIKE '%".$sall."%' OR d.address LIKE '%".$sall."%'"; - $sql.=" OR d.town LIKE '%".$sall."%' OR d.note LIKE '%".$sall."%')"; + if (is_numeric($sall)) $sql.= "d.rowid = ".$db->escape($sall)." OR "; + $sql.=" d.firstname LIKE '%".$db->escape($sall)."%' OR d.lastname LIKE '%".$db->escape($sall)."%' OR d.societe LIKE '%".$db->escape($sall)."%'"; + $sql.=" OR d.email LIKE '%".$db->escape($sall)."%' OR d.login LIKE '%".$db->escape($sall)."%' OR d.address LIKE '%".$db->escape($sall)."%'"; + $sql.=" OR d.town LIKE '%".$db->escape($sall)."%' OR d.note LIKE '%".$db->escape($sall)."%')"; } } if ($type > 0) { - $sql.=" AND t.rowid=".$type; + $sql.=" AND t.rowid=".$db->escape($type); } if (isset($_GET["statut"]) || isset($_POST["statut"])) { @@ -188,17 +188,17 @@ if ($resql) } $param=""; - if ($statut != "") $param.="&statut=".$statut; - if ($search_nom) $param.="&search_nom=".$search_nom; - if ($search_login) $param.="&search_login=".$search_login; - if ($search_email) $param.="&search_email=".$search_email; - if ($filter) $param.="&filter=".$filter; - if ($type > 0) $param.="&type=".$type; + if ($statut != "") $param.="&statut=".htmlspecialchars($statut); + if ($search_nom) $param.="&search_nom=".htmlspecialchars($search_nom); + if ($search_login) $param.="&search_login=".htmlspecialchars($search_login); + if ($search_email) $param.="&search_email=".htmlspecialchars($search_email); + if ($filter) $param.="&filter=".htmlspecialchars($filter); + if ($type > 0) $param.="&type=".htmlspecialchars($type); print_barre_liste($titre,$page,$_SERVER["PHP_SELF"],$param,$sortfield,$sortorder,'',$num,$nbtotalofrecords); if ($sall) { - print $langs->trans("Filter")." (".$langs->trans("Ref").", ".$langs->trans("Lastname").", ".$langs->trans("Firstname").", ".$langs->trans("EMail").", ".$langs->trans("Address")." ".$langs->trans("or")." ".$langs->trans("Town")."): ".$sall; + print $langs->trans("Filter")." (".$langs->trans("Ref").", ".$langs->trans("Lastname").", ".$langs->trans("Firstname").", ".$langs->trans("EMail").", ".$langs->trans("Address")." ".$langs->trans("or")." ".$langs->trans("Town")."): ".htmlspecialchars($sall); } print '
'; @@ -236,13 +236,13 @@ if ($resql) print ''; print ''; - print ''; + print ''; print ''; - print ''; + print ''; print ''; - print ''; + print ''; print ''; $listetype=$membertypestatic->liste_array(); @@ -252,7 +252,7 @@ if ($resql) print ' '; print ''; - print ''; + print ''; print ' '; diff --git a/htdocs/contact/list.php b/htdocs/contact/list.php index 234dff307a6..6a2e2a55fe8 100644 --- a/htdocs/contact/list.php +++ b/htdocs/contact/list.php @@ -3,7 +3,7 @@ * Copyright (C) 2003 Eric Seigne * Copyright (C) 2004-2012 Laurent Destailleur * Copyright (C) 2005-2012 Regis Houssin - * Copyright (C) 2013 Raphaël Doursenaud + * Copyright (C) 2013-2015 Raphaël Doursenaud * Copyright (C) 2013 Cédric Salvador * Copyright (C) 2013 Alexandre Spangaro * @@ -151,7 +151,7 @@ else if ($search_priv == '1') $sql .= " AND (p.priv='1' AND p.fk_user_creat=".$user->id.")"; } -if ($search_categ > 0) $sql.= " AND cs.fk_categorie = ".$search_categ; +if ($search_categ > 0) $sql.= " AND cs.fk_categorie = ".$db->escape($search_categ); if ($search_categ == -2) $sql.= " AND cs.fk_categorie IS NULL"; if ($search_lastname) { // filter on lastname @@ -245,11 +245,11 @@ if ($result) { $contactstatic=new Contact($db); - $param ='&begin='.urlencode($begin).'&view='.urlencode($view).'&userid='.urlencode($userid).'&contactname='.urlencode($sall); - $param.='&type='.urlencode($type).'&view='.urlencode($view).'&search_lastname='.urlencode($search_lastname).'&search_firstname='.urlencode($search_firstname).'&search_societe='.urlencode($search_societe).'&search_email='.urlencode($search_email); - if (!empty($search_categ)) $param.='&search_categ='.$search_categ; - if ($search_status != '') $param.='&search_status='.$search_status; - if ($search_priv == '0' || $search_priv == '1') $param.="&search_priv=".urlencode($search_priv); + $param ='&begin='.htmlspecialchars($begin).'&view='.htmlspecialchars($view).'&userid='.htmlspecialchars($userid).'&contactname='.htmlspecialchars($sall); + $param.='&type='.htmlspecialchars($type).'&view='.htmlspecialchars($view).'&search_lastname='.htmlspecialchars($search_lastname).'&search_firstname='.htmlspecialchars($search_firstname).'&search_societe='.htmlspecialchars($search_societe).'&search_email='.htmlspecialchars($search_email); + if (!empty($search_categ)) $param.='&search_categ='.htmlspecialchars($search_categ); + if ($search_status != '') $param.='&search_status='.htmlspecialchars($search_status); + if ($search_priv == '0' || $search_priv == '1') $param.="&search_priv=".htmlspecialchars($search_priv); $num = $db->num_rows($result); $i = 0; @@ -258,7 +258,7 @@ if ($result) print ''; print ''; - print ''; + print ''; print ''; print ''; @@ -277,7 +277,7 @@ if ($result) if ($sall) { - print $langs->trans("Filter")." (".$langs->trans("Lastname").", ".$langs->trans("Firstname")." ".$langs->trans("or")." ".$langs->trans("EMail")."): ".$sall; + print $langs->trans("Filter")." (".$langs->trans("Lastname").", ".$langs->trans("Firstname")." ".$langs->trans("or")." ".$langs->trans("EMail")."): ".htmlspecialchars($sall); } print ''; @@ -302,36 +302,36 @@ if ($result) // Ligne des champs de filtres print ''; print ''; print ''; print ''; if (empty($conf->global->SOCIETE_DISABLE_CONTACTS)) { print ''; } print ''; print ''; print ''; print ''; if (! empty($conf->skype->enabled)) { print ''; } print ''; diff --git a/htdocs/contrat/liste.php b/htdocs/contrat/liste.php index 38576f7e764..3c350d0de03 100644 --- a/htdocs/contrat/liste.php +++ b/htdocs/contrat/liste.php @@ -78,7 +78,7 @@ $sql.= ", ".MAIN_DB_PREFIX."contrat as c"; $sql.= " LEFT JOIN ".MAIN_DB_PREFIX."contratdet as cd ON c.rowid = cd.fk_contrat"; $sql.= " WHERE c.fk_soc = s.rowid "; $sql.= " AND c.entity = ".$conf->entity; -if ($socid) $sql.= " AND s.rowid = ".$socid; +if ($socid) $sql.= " AND s.rowid = ".$db->escape($socid); if (!$user->rights->societe->client->voir && !$socid) $sql.= " AND s.rowid = sc.fk_soc AND sc.fk_user = " .$user->id; if ($search_nom) { $sql .= natural_search('s.nom', $search_nom); @@ -100,13 +100,13 @@ if ($resql) $num = $db->num_rows($resql); $i = 0; - print_barre_liste($langs->trans("ListOfContracts"), $page, $_SERVER["PHP_SELF"], '&search_contract='.$search_contract.'&search_nom='.$search_nom, $sortfield, $sortorder,'',$num); + print_barre_liste($langs->trans("ListOfContracts"), $page, $_SERVER["PHP_SELF"], '&search_contract='.htmlspecialchars($search_contract).'&search_nom='.htmlspecialchars($search_nom), $sortfield, $sortorder,'',$num); print '
'; - print ''; + print ''; print ''; - print ''; + print ''; print ''; - print ''; + print ''; print ''; - print ''; + print ''; print ''; - print ''; + print ''; print ''; - print ''; + print ''; print ''; - print ''; + print ''; print ''; - print ''; + print ''; print ''; - print ''; + print ''; print ' 
'; print ''; - $param='&search_contract='.$search_contract; - $param.='&search_nom='.$search_nom; + $param='&search_contract='.htmlspecialchars($search_contract); + $param.='&search_nom='.htmlspecialchars($search_nom); print_liste_field_titre($langs->trans("Ref"), $_SERVER["PHP_SELF"], "c.rowid","","$param",'',$sortfield,$sortorder); print_liste_field_titre($langs->trans("Company"), $_SERVER["PHP_SELF"], "s.nom","","$param",'',$sortfield,$sortorder); //print_liste_field_titre($langs->trans("DateCreation"), $_SERVER["PHP_SELF"], "c.datec","","$param",'align="center"',$sortfield,$sortorder); @@ -122,10 +122,10 @@ if ($resql) print ''; print ''; print ''; print ''; print ''; //print ''; diff --git a/htdocs/product/liste.php b/htdocs/product/liste.php index 923b19e3daa..28563edc5eb 100644 --- a/htdocs/product/liste.php +++ b/htdocs/product/liste.php @@ -4,7 +4,7 @@ * Copyright (C) 2005-2012 Regis Houssin * Copyright (C) 2012-2013 Marcos García * Copyright (C) 2013 Juanjo Menent - * Copyright (C) 2013 Raphaël Doursenaud + * Copyright (C) 2013-2015 Raphaël Doursenaud * Copyright (C) 2013 Jean Heimburger * Copyright (C) 2013 Cédric Salvador * Copyright (C) 2013 Florian Henry @@ -181,7 +181,7 @@ else if (dol_strlen($canvas) > 0) $sql.= " AND p.canvas = '".$db->escape($canvas)."'"; if ($catid > 0) $sql.= " AND cp.fk_categorie = ".$catid; if ($catid == -2) $sql.= " AND cp.fk_categorie IS NULL"; - if ($search_categ > 0) $sql.= " AND cp.fk_categorie = ".$search_categ; + if ($search_categ > 0) $sql.= " AND cp.fk_categorie = ".$db->escape($search_categ); if ($search_categ == -2) $sql.= " AND cp.fk_categorie IS NULL"; if ($fourn_id > 0) $sql.= " AND pfp.fk_soc = ".$fourn_id; $sql.= " GROUP BY p.rowid, p.ref, p.label, p.barcode, p.price, p.price_ttc, p.price_base_type,"; @@ -233,9 +233,9 @@ else // Displays product removal confirmation if (GETPOST('delprod')) dol_htmloutput_mesg($langs->trans("ProductDeleted",GETPOST('delprod'))); - $param="&sref=".$sref.($sbarcode?"&sbarcode=".$sbarcode:"")."&snom=".$snom."&sall=".$sall."&tosell=".$tosell."&tobuy=".$tobuy; + $param="&sref=".htmlspecialchars($sref).($sbarcode?"&sbarcode=".htmlspecialchars($sbarcode):"")."&snom=".htmlspecialchars($snom)."&sall=".htmlspecialchars($sall)."&tosell=".htmlspecialchars($tosell)."&tobuy=".htmlspecialchars($tobuy); $param.=($fourn_id?"&fourn_id=".$fourn_id:""); - $param.=($search_categ?"&search_categ=".$search_categ:""); + $param.=($search_categ?"&search_categ=".htmlspecialchars($search_categ):""); $param.=isset($type)?"&type=".$type:""; print_barre_liste($texte, $page, "liste.php", $param, $sortfield, $sortorder, '', $num, $nbtotalofrecords); @@ -320,15 +320,15 @@ else // Lignes des champs de filtre print ''; print ''; print ''; if (! empty($conf->barcode->enabled)) { print ''; } print ''; // Barcode if (! empty($conf->barcode->enabled)) { - print ''; + print ''; } // Town print ''; // IdProf1 print ''; // IdProf2 print ''; // IdProf3 print ''; // IdProf4 print ''; // Type (customer/prospect/supplier) print '
'; - print ''; + print ''; print ''; - print ''; + print ''; print '  
'; - print ''; + print ''; print ''; - print ''; + print ''; print ''; - print ''; + print ''; print ''; @@ -510,9 +510,9 @@ else $i++; } - $param="&sref=".$sref.($sbarcode?"&sbarcode=".$sbarcode:"")."&snom=".$snom."&sall=".$sall."&tosell=".$tosell."&tobuy=".$tobuy; + $param="&sref=".htmlspecialchars($sref).($sbarcode?"&sbarcode=".htmlspecialchars($sbarcode):"")."&snom=".htmlspecialchars($snom)."&sall=".htmlspecialchars($sall)."&tosell=".htmlspecialchars($tosell)."&tobuy=".htmlspecialchars($tobuy); $param.=($fourn_id?"&fourn_id=".$fourn_id:""); - $param.=($search_categ?"&search_categ=".$search_categ:""); + $param.=($search_categ?"&search_categ=".htmlspecialchars($search_categ):""); $param.=isset($type)?"&type=".$type:""; print_barre_liste('', $page, "liste.php", $param, $sortfield, $sortorder,'',$num,$nbtotalofrecords); diff --git a/htdocs/societe/societe.php b/htdocs/societe/societe.php index 7d3e2e1a78d..8957b72581c 100644 --- a/htdocs/societe/societe.php +++ b/htdocs/societe/societe.php @@ -3,7 +3,7 @@ * Copyright (C) 2004-2013 Laurent Destailleur * Copyright (C) 2005-2012 Regis Houssin * Copyright (C) 2012 Marcos García - * Copyright (C) 2013 Raphaël Doursenaud + * Copyright (C) 2013-2015 Raphaël Doursenaud * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -210,12 +210,12 @@ if (! $user->rights->fournisseur->lire) $sql.=" AND (s.fournisseur <> 1 OR s.cli // Insert sale filter if ($search_sale) { - $sql .= " AND sc.fk_user = ".$search_sale; + $sql .= " AND sc.fk_user = ".$db->escape($search_sale); } // Insert categ filter if ($search_categ) { - $sql .= " AND cs.fk_categorie = ".$search_categ; + $sql .= " AND cs.fk_categorie = ".$db->escape($search_categ); } if ($search_nom_only) { @@ -272,12 +272,12 @@ if ($resql) $num = $db->num_rows($resql); $i = 0; - $params = "&socname=".$socname."&search_nom=".$search_nom."&search_town=".$search_town; - $params.= ($sbarcode?"&sbarcode=".$sbarcode:""); - $params.= '&search_idprof1='.$search_idprof1; - $params.= '&search_idprof2='.$search_idprof2; - $params.= '&search_idprof3='.$search_idprof3; - $params.= '&search_idprof4='.$search_idprof4; + $params = "&socname=".htmlspecialchars($socname)."&search_nom=".htmlspecialchars($search_nom)."&search_town=".htmlspecialchars($search_town); + $params.= ($sbarcode?"&sbarcode=".htmlspecialchars($sbarcode):""); + $params.= '&search_idprof1='.htmlspecialchars($search_idprof1); + $params.= '&search_idprof2='.htmlspecialchars($search_idprof2); + $params.= '&search_idprof3='.htmlspecialchars($search_idprof3); + $params.= '&search_idprof4='.htmlspecialchars($search_idprof4); print_barre_liste($title, $page, $_SERVER["PHP_SELF"],$params,$sortfield,$sortorder,'',$num,$nbtotalofrecords); @@ -348,34 +348,34 @@ if ($resql) print ''; print ''; if (! empty($search_nom_only) && empty($search_nom)) $search_nom=$search_nom_only; - print ''; + print ''; print ''; - print ''; - print ''; + print ''; + print ''; - print ''; + print ''; print ''; - print ''; + print ''; print ''; - print ''; + print ''; print ''; - print ''; + print ''; print ''; - print ''; + print ''; print '';