lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix #yogosha6561

Browse Source
This commit is contained in:
Laurent Destailleur 2021-07-05 22:26:38 +02:00
parent db95339085
commit f8eadf6fe1
2 changed files with 21 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
htdocs/core/lib/functions.lib.php
View File

@ -1029,10 +1029,11 @@ function dol_size($size, $type = '')
/** /**
* Clean a string to use it as a file name * Clean a string to use it as a file name.
* Replace also '--' and ' -' strings, they are used for parameters separation.
* *
* @param string $str String to clean * @param string $str String to clean
* @param string $newstr String to replace bad chars with * @param string $newstr String to replace bad chars with.
* @param int $unaccent 1=Remove also accent (default), 0 do not remove them * @param int $unaccent 1=Remove also accent (default), 0 do not remove them
* @return string String cleaned (a-zA-Z_) * @return string String cleaned (a-zA-Z_)
* *
@ -1044,8 +1045,11 @@ function dol_sanitizeFileName($str, $newstr = '_', $unaccent = 1)
// Char '>' '<' '|' '$' and ';' are special chars for shells. // Char '>' '<' '|' '$' and ';' are special chars for shells.
// Char '/' and '\' are file delimiters. // Char '/' and '\' are file delimiters.
// -- car can be used into filename to inject special paramaters like --use-compress-program to make command with file as parameter making remote execution of command // -- car can be used into filename to inject special paramaters like --use-compress-program to make command with file as parameter making remote execution of command
$filesystem_forbidden_chars = array('<', '>', '/', '\\', '?', '*', '|', '"', ':', '°', '$', ';', '--'); $filesystem_forbidden_chars = array('<', '>', '/', '\\', '?', '*', '|', '"', ':', '°', '$', ';');
return dol_string_nospecial($unaccent ? dol_string_unaccent($str) : $str, $newstr, $filesystem_forbidden_chars); $tmp = dol_string_nospecial($unaccent ? dol_string_unaccent($str) : $str, $newstr, $filesystem_forbidden_chars);
$tmp = preg_replace('/\-\-+/', '_', $tmp);
$tmp = preg_replace('/\s+\-/', ' _', $tmp);
return $tmp;
} }
/** /**
@ -1157,21 +1161,26 @@ function dol_string_unaccent($str)
* Clean a string from all punctuation characters to use it as a ref or login. * Clean a string from all punctuation characters to use it as a ref or login.
* This is a more complete function than dol_sanitizeFileName. * This is a more complete function than dol_sanitizeFileName.
* *
* @param string $str String to clean * @param string $str String to clean
* @param string $newstr String to replace forbidden chars with * @param string $newstr String to replace forbidden chars with
* @param array $badcharstoreplace List of forbidden characters * @param array|string $badcharstoreplace List of forbidden characters to replace
* @return string Cleaned string * @param array|string $badcharstoremove List of forbidden characters to remove
* @return string Cleaned string
* *
* @see dol_sanitizeFilename(), dol_string_unaccent(), dol_string_nounprintableascii() * @see dol_sanitizeFilename(), dol_string_unaccent(), dol_string_nounprintableascii()
*/ */
function dol_string_nospecial($str, $newstr = '_', $badcharstoreplace = '') function dol_string_nospecial($str, $newstr = '_', $badcharstoreplace = '', $badcharstoremove = '')
{ {
$forbidden_chars_to_replace = array(" ", "'", "/", "\\", ":", "*", "?", "\"", "<", ">", "|", "[", "]", ",", ";", "=", '°'); // more complete than dol_sanitizeFileName $forbidden_chars_to_replace = array(" ", "'", "/", "\\", ":", "*", "?", "\"", "<", ">", "|", "[", "]", ",", ";", "=", '°'); // more complete than dol_sanitizeFileName
$forbidden_chars_to_remove = array(); $forbidden_chars_to_remove = array();
//$forbidden_chars_to_remove=array("(",")");
if (is_array($badcharstoreplace)) { if (is_array($badcharstoreplace)) {
$forbidden_chars_to_replace = $badcharstoreplace; $forbidden_chars_to_replace = $badcharstoreplace;
} }
//$forbidden_chars_to_remove=array("(",")"); if (is_array($badcharstoremove)) {
$forbidden_chars_to_remove = $badcharstoremove;
}
return str_replace($forbidden_chars_to_replace, $newstr, str_replace($forbidden_chars_to_remove, "", $str)); return str_replace($forbidden_chars_to_replace, $newstr, str_replace($forbidden_chars_to_remove, "", $str));
} }

4
test/phpunit/SecurityTest.php
View File

@ -798,8 +798,8 @@ class SecurityTest extends PHPUnit\Framework\TestCase
$result=dol_sanitizeFileName('bad file | evilaction'); $result=dol_sanitizeFileName('bad file | evilaction');
$this->assertEquals('bad file _ evilaction', $result); $this->assertEquals('bad file _ evilaction', $result);
$result=dol_sanitizeFileName('bad file --evilparam'); $result=dol_sanitizeFileName('bad file -evilparam --evilparam ---evilparam ----evilparam');
$this->assertEquals('bad file _evilparam', $result); $this->assertEquals('bad file_evilparam _evilparam _evilparam _evilparam', $result);
} }
/** /**