Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Merge branch '18.0' of git@github.com:Dolibarr/dolibarr.git into 19.0

Browse Source
This commit is contained in:
Laurent Destailleur
2024-03-03 19:50:22 +01:00
parent af6a091ab2 17ff0972ab
commit 1e00cf34d4
4 changed files with 56 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/compta/sociales/list.php
View File

@@ -102,7 +102,7 @@ $arrayfields = array(
'cs.fk_type' =>array('label'=>"Type", 'checked'=>1, 'position'=>30), 'cs.fk_type' =>array('label'=>"Type", 'checked'=>1, 'position'=>30),
'cs.date_ech' =>array('label'=>"Date", 'checked'=>1, 'position'=>40), 'cs.date_ech' =>array('label'=>"Date", 'checked'=>1, 'position'=>40),
'cs.periode' =>array('label'=>"PeriodEndDate", 'checked'=>1, 'position'=>50), 'cs.periode' =>array('label'=>"PeriodEndDate", 'checked'=>1, 'position'=>50),
'p.ref' =>array('label'=>"ProjectRef", 'checked'=>1, 'position'=>60, 'enable'=>(isModEnabled('project'))), 'p.ref' =>array('label'=>"ProjectRef", 'checked'=>1, 'position'=>60, 'enabled'=>(isModEnabled('project'))),
'cs.fk_user' =>array('label'=>"Employee", 'checked'=>1, 'position'=>70), 'cs.fk_user' =>array('label'=>"Employee", 'checked'=>1, 'position'=>70),
'cs.fk_mode_reglement' =>array('checked'=>-1, 'position'=>80, 'label'=>"DefaultPaymentMode"), 'cs.fk_mode_reglement' =>array('checked'=>-1, 'position'=>80, 'label'=>"DefaultPaymentMode"),
'cs.amount' =>array('label'=>"Amount", 'checked'=>1, 'position'=>100), 'cs.amount' =>array('label'=>"Amount", 'checked'=>1, 'position'=>100),

9
htdocs/core/lib/functions.lib.php
View File

@@ -9730,22 +9730,27 @@ function dol_eval($s, $returnvalue = 0, $hideerrors = 1, $onlysimplestring = '1'
// We block use of php exec or php file functions // We block use of php exec or php file functions
$forbiddenphpstrings = array('$$'); $forbiddenphpstrings = array('$$');
$forbiddenphpstrings = array_merge($forbiddenphpstrings, array('_ENV', '_SESSION', '_COOKIE', '_GET', '_POST', '_REQUEST')); $forbiddenphpstrings = array_merge($forbiddenphpstrings, array('_ENV', '_SESSION', '_COOKIE', '_GET', '_POST', '_REQUEST', 'ReflectionFunction'));
$forbiddenphpfunctions = array("exec", "passthru", "shell_exec", "system", "proc_open", "popen"); $forbiddenphpfunctions = array("exec", "passthru", "shell_exec", "system", "proc_open", "popen");
$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("dol_eval", "executeCLI", "verifCond")); // native dolibarr functions $forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("dol_eval", "executeCLI", "verifCond")); // native dolibarr functions
$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("base64_decode", "rawurldecode", "urldecode")); // decode string functions $forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("base64_decode", "rawurldecode", "urldecode", "str_rot13", "hex2bin")); // decode string functions used to obfuscated function name
$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("fopen", "file_put_contents", "fputs", "fputscsv", "fwrite", "fpassthru", "require", "include", "mkdir", "rmdir", "symlink", "touch", "unlink", "umask")); $forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("fopen", "file_put_contents", "fputs", "fputscsv", "fwrite", "fpassthru", "require", "include", "mkdir", "rmdir", "symlink", "touch", "unlink", "umask"));
$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("get_defined_functions", "get_defined_vars", "get_defined_constants", "get_declared_classes")); $forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("get_defined_functions", "get_defined_vars", "get_defined_constants", "get_declared_classes"));
$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("function", "call_user_func")); $forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("function", "call_user_func"));
$forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("eval", "create_function", "assert", "mb_ereg_replace")); // function with eval capabilities $forbiddenphpfunctions = array_merge($forbiddenphpfunctions, array("eval", "create_function", "assert", "mb_ereg_replace")); // function with eval capabilities
$forbiddenphpmethods = array('invoke', 'invokeArgs'); // Method of ReflectionFunction to execute a function
$forbiddenphpregex = 'global\s+\$|\b('.implode('|', $forbiddenphpfunctions).')\b'; $forbiddenphpregex = 'global\s+\$|\b('.implode('|', $forbiddenphpfunctions).')\b';
$forbiddenphpmethodsregex = '->('.implode('|', $forbiddenphpmethods).')';
do { do {
$oldstringtoclean = $s; $oldstringtoclean = $s;
$s = str_ireplace($forbiddenphpstrings, '__forbiddenstring__', $s); $s = str_ireplace($forbiddenphpstrings, '__forbiddenstring__', $s);
$s = preg_replace('/'.$forbiddenphpregex.'/i', '__forbiddenstring__', $s); $s = preg_replace('/'.$forbiddenphpregex.'/i', '__forbiddenstring__', $s);
$s = preg_replace('/'.$forbiddenphpmethodsregex.'/i', '__forbiddenstring__', $s);
//$s = preg_replace('/\$[a-zA-Z0-9_\->\$]+\(/i', '', $s); // Remove $function( call and $mycall->mymethod( //$s = preg_replace('/\$[a-zA-Z0-9_\->\$]+\(/i', '', $s); // Remove $function( call and $mycall->mymethod(
} while ($oldstringtoclean != $s); } while ($oldstringtoclean != $s);

40
htdocs/takepos/pay.php
View File

@@ -253,6 +253,7 @@ if ($resql) {
} }
} }
} }
?> ?>
<script> <script>
@@ -520,20 +521,51 @@ if (getDolGlobalString('TAKEPOS_CUSTOMER_DISPLAY')) {
?> ?>
</script> </script>
<?php
$showothercurrency = 0;
if (isModEnabled('multicurrency') && $_SESSION["takeposcustomercurrency"] != "" && $conf->currency != $_SESSION["takeposcustomercurrency"]) {
//Only show customer currency if multicurrency module is enabled, if currency selected and if this currency selected is not the same as main currency
$showothercurrency = 1;
include_once DOL_DOCUMENT_ROOT . '/multicurrency/class/multicurrency.class.php';
$multicurrency = new MultiCurrency($db);
$multicurrency->fetch(0, $_SESSION["takeposcustomercurrency"]);
}
?>
<div style="position:relative; padding-top: 20px; left:5%; height:140px; width:90%;"> <div style="position:relative; padding-top: 20px; left:5%; height:140px; width:90%;">
<div class="paymentbordline paymentbordlinetotal center"> <div class="paymentbordline paymentbordlinetotal center">
<span class="takepospay colorwhite"><?php echo $langs->trans('TotalTTC'); ?>: <span id="totaldisplay" class="colorwhite"><?php echo price($invoice->total_ttc, 1, '', 1, -1, -1, $invoice->multicurrency_code); ?></span></span> <span class="takepospay colorwhite"><?php echo $langs->trans('TotalTTC'); ?>: <span id="totaldisplay" class="colorwhite"><?php
echo price($invoice->total_ttc, 1, '', 1, -1, -1, $conf->currency);
if ($showothercurrency) {
print ' &nbsp; <span id="linecolht-span-total opacitymedium" style="font-size:0.9em; font-style:italic;">(' . price($invoice->total_ht * $multicurrency->rate->rate) . ' ' . $_SESSION["takeposcustomercurrency"] . ')</span>';
}
?></span></span>
</div> </div>
<?php if ($remaintopay != $invoice->total_ttc) { ?> <?php if ($remaintopay != $invoice->total_ttc) { ?>
<div class="paymentbordline paymentbordlineremain center"> <div class="paymentbordline paymentbordlineremain center">
<span class="takepospay colorwhite"><?php echo $langs->trans('RemainToPay'); ?>: <span id="remaintopaydisplay" class="colorwhite"><?php echo price($remaintopay, 1, '', 1, -1, -1, $invoice->multicurrency_code); ?></span></span> <span class="takepospay colorwhite"><?php echo $langs->trans('RemainToPay'); ?>: <span id="remaintopaydisplay" class="colorwhite"><?php
echo price($remaintopay, 1, '', 1, -1, -1, $invoice->multicurrency_code);
if ($showothercurrency) {
print ' &nbsp; <span id="linecolht-span-total opacitymedium" style="font-size:0.9em; font-style:italic;">(' . price($remaintopay * $multicurrency->rate->rate) . ' ' . $_SESSION["takeposcustomercurrency"] . ')</span>';
}
?></span></span>
</div> </div>
<?php } ?> <?php } ?>
<div class="paymentbordline paymentbordlinereceived center"> <div class="paymentbordline paymentbordlinereceived center">
<span class="takepospay colorwhite"><?php echo $langs->trans("Received"); ?>: <span class="change1 colorred"><?php echo price(0, 1, '', 1, -1, -1, $invoice->multicurrency_code); ?></span><input type="hidden" id="change1" class="change1" value="0"></span> <span class="takepospay colorwhite"><?php echo $langs->trans("Received"); ?>: <span class="change1 colorred"><?php
echo price(0, 1, '', 1, -1, -1, $invoice->multicurrency_code);
if ($showothercurrency) {
print ' &nbsp; <span id="linecolht-span-total opacitymedium" style="font-size:0.9em; font-style:italic;">(' . price(0 * $multicurrency->rate->rate) . ' ' . $_SESSION["takeposcustomercurrency"] . ')</span>';
}
?></span><input type="hidden" id="change1" class="change1" value="0"></span>
</div> </div>
<div class="paymentbordline paymentbordlinechange center"> <div class="paymentbordline paymentbordlinechange center">
<span class="takepospay colorwhite"><?php echo $langs->trans("Change"); ?>: <span class="change2 colorwhite"><?php echo price(0, 1, '', 1, -1, -1, $invoice->multicurrency_code); ?></span><input type="hidden" id="change2" class="change2" value="0"></span> <span class="takepospay colorwhite"><?php echo $langs->trans("Change"); ?>: <span class="change2 colorwhite"><?php
echo price(0, 1, '', 1, -1, -1, $invoice->multicurrency_code);
if ($showothercurrency) {
print ' &nbsp; <span id="linecolht-span-total opacitymedium" style="font-size:0.9em; font-style:italic;">(' . price(0 * $multicurrency->rate->rate) . ' ' . $_SESSION["takeposcustomercurrency"] . ')</span>';
}
?></span><input type="hidden" id="change2" class="change2" value="0"></span>
</div> </div>
<?php <?php
if (getDolGlobalString('TAKEPOS_CAN_FORCE_BANK_ACCOUNT_DURING_PAYMENT')) { if (getDolGlobalString('TAKEPOS_CAN_FORCE_BANK_ACCOUNT_DURING_PAYMENT')) {

13
test/phpunit/SecurityTest.php
View File

@@ -1084,7 +1084,7 @@ class SecurityTest extends PHPUnit\Framework\TestCase
$this->assertEquals('0', $result3b); $this->assertEquals('0', $result3b);
$s = '(($reloadedobj = new Task($db)) && ($reloadedobj->fetchNoCompute($object->id) > 0) && ($secondloadedobj = new Project($db)) && ($secondloadedobj->fetchNoCompute($reloadedobj->fk_project) > 0)) ? $secondloadedobj->ref : "Parent project not found"'; $s = '(($reloadedobj = new Task($db)) && ($reloadedobj->fetchNoCompute($object->id) > 0) && ($secondloadedobj = new Project($db)) && ($secondloadedobj->fetchNoCompute($reloadedobj->fk_project) > 0)) ? $secondloadedobj->ref : "Parent project not found"';
$result=dol_eval($s, 1, 1, '2'); $result = (string) dol_eval($s, 1, 1, '2');
print "result3 = ".$result."\n"; print "result3 = ".$result."\n";
$this->assertEquals('Parent project not found', $result); $this->assertEquals('Parent project not found', $result);
@@ -1093,6 +1093,17 @@ class SecurityTest extends PHPUnit\Framework\TestCase
print "result4 = ".$result."\n"; print "result4 = ".$result."\n";
$this->assertEquals('Parent project not found', $result); $this->assertEquals('Parent project not found', $result);
$s = 'new abc->invoke(\'whoami\')';
$result = (string) dol_eval($s, 1, 1, '2');
print "result = ".$result."\n";
$this->assertEquals('Bad string syntax to evaluate: new abc__forbiddenstring__(\'whoami\')', $result);
$s = 'new ReflectionFunction(\'abc\')';
$result = (string) dol_eval($s, 1, 1, '2');
print "result = ".$result."\n";
$this->assertEquals('Bad string syntax to evaluate: new __forbiddenstring__(\'abc\')', $result);
$result = (string) dol_eval('$a=function() { }; $a;', 1, 1, '0'); $result = (string) dol_eval('$a=function() { }; $a;', 1, 1, '0');
print "result5 = ".$result."\n"; print "result5 = ".$result."\n";
$this->assertStringContainsString('Bad string syntax to evaluate', $result); $this->assertStringContainsString('Bad string syntax to evaluate', $result);