FIX #yogosha19628

htdocs/core/class/commonobject.class.php

@@ -5628,7 +5628,9 @@ abstract class CommonObject
 					$file = $prefix."_".$modele.".modules.php";
 				}
 
-				// On verifie l'emplacement du modele
+				$file = dol_sanitizeFileName($file);
+
+				// We chack if file exists
 				$file = dol_buildpath($reldir.$modelspath.$file, 0);
 				if (file_exists($file)) {
 					$filefound = $file;
@@ -5648,10 +5650,13 @@ abstract class CommonObject
 			return -1;
 		}
 
-		// If generator was found
-		global $db; // Required to solve a conception default making an include of code using $db instead of $this->db just after.
+		// Sanitize $filefound
+		$filefound = dol_sanitizePathName($filefound);
 
-		require_once $file;
+		// If generator was found
+		global $db; // Required to solve a conception default making an include of some code that uses $db instead of $this->db just after.
+
+		require_once $filefound;
 
 		$obj = new $classname($this->db);
 

htdocs/core/lib/functions.lib.php

@@ -1357,7 +1357,7 @@ function dol_sanitizeFileName($str, $newstr = '_', $unaccent = 1)
 }
 
 /**
- *	Clean a string to use it as a path name.
+ *	Clean a string to use it as a path name. Similare to dol_sanitizeFileName but accept / and \ chars.
  *  Replace also '--' and ' -' strings, they are used for parameters separation (Note: ' - ' is allowed).
  *
  *	@param	string	$str            String to clean