Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Fix Add '_pw' var as var sensibles.

Browse Source
This commit is contained in:
Laurent Destailleur
2020-05-06 04:03:07 +02:00
parent 8512fba7db
commit 30fede216c
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/api/class/api_setup.class.php
View File

@@ -1429,7 +1429,7 @@ class Setup extends DolibarrApi
if (!preg_match('/^[a-zA-Z0-9_]+$/', $constantname) || !isset($conf->global->$constantname)) {
throw new RestException(500, 'Error Bad or unknown value for constantname');
}
if (preg_match('/(_pass|password|secret|_key|key$)/i', $constantname)) {
if (preg_match('/(_pass|_pw|password|secret|_key|key$)/i', $constantname)) {
throw new RestException(403, 'Forbidden');
}