diff --git a/SECURITY.md b/SECURITY.md
index f63f9c3f277..7d65b7e98e4 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -12,7 +12,7 @@ This file contains some policies about the security reports on Dolibarr ERP CRM
## Reporting a Vulnerability
-To report a vulnerability, please use GitHub security advisory at https://github.com/Dolibarr/dolibarr/security/advisories/new (or alternatively send an email to security@dolibarr.org)
+To report a vulnerability, please use GitHub security advisory at https://github.com/Dolibarr/dolibarr/security/advisories/new (if you have permissions) or alternatively send an email to security@dolibarr.org (for everybody)
## Hunting vulnerabilities on Dolibarr
@@ -55,7 +55,7 @@ ONLY vulnerabilities discovered, when the following setup on test platform is us
* $dolibarr_nocsrfcheck must be kept to the value 0 into conf.php (this is the default value)
* $dolibarr_main_force_https must be set to something else than 0.
* The constant MAIN_SECURITY_CSRF_WITH_TOKEN must be set to 1 into backoffice menu Home - Setup - Other (this protection should be set to 1 soon by default)
-* The module DebugBar and ModuleBuilder must NOT be enabled (by default, this module is not enabled. This is a developer tool)
+* The module DebugBar and ModuleBuilder must NOT be enabled (by default, these modules are not enabled. They are developer tools)
* ONLY security reports on modules provided by default and with the "stable" status are valid (troubles into "experimental", "developement" or external modules are not valid vulnerabilities).
* The root of web server must link to htdocs and the documents directory must be outside of the web server root (this is the default when using the default installer but may differs with external installer).
* The web server setup must be done so only the documents directory is in write mode. The root directory called htdocs must be readonly.
@@ -65,12 +65,12 @@ ONLY vulnerabilities discovered, when the following setup on test platform is us
Scope is the web application (back office) and the APIs.
-## Qualifying vulnerabilities for Bug bounty programs
+## Qualifying vulnerabilities for reporting
* Remote code execution (RCE)
* Local files access and manipulation (LFI, RFI, XXE, SSRF, XSPA)
* Code injections (HTML, JS, SQL, PHP, ...)
-* Cross-Site Scripting (XSS)
+* Cross-Site Scripting (XSS), except from setup page of module "External web site" (allowing any content here, editable by admin user only, is accepted on purpose or into module "Web site" when permission to edit website content is allowed).
* Cross-Site Requests Forgery (CSRF) with real security impact (when using GET URLs, CSRF are qualified only for creating, updating or deleting data from pages restricted to admin users)
* Open redirect
* Broken authentication & session management
@@ -82,7 +82,7 @@ Scope is the web application (back office) and the APIs.
* Stack traces or path disclosure (for non admin users only)
-## Non-qualifying vulnerabilities for Bug bounty programs, but qualified for reporting
+## Non-qualifying vulnerabilities for reporting
* "Self" XSS
* SSL/TLS best practices
diff --git a/htdocs/accountancy/admin/account.php b/htdocs/accountancy/admin/account.php
index 8982376ded6..cf2bd2065a2 100644
--- a/htdocs/accountancy/admin/account.php
+++ b/htdocs/accountancy/admin/account.php
@@ -582,6 +582,10 @@ if ($resql) {
$i++;
}
+ if ($num == 0) {
+ print '
';
diff --git a/htdocs/admin/multicurrency.php b/htdocs/admin/multicurrency.php
index be4de854099..3a479480812 100644
--- a/htdocs/admin/multicurrency.php
+++ b/htdocs/admin/multicurrency.php
@@ -33,7 +33,7 @@ require_once DOL_DOCUMENT_ROOT.'/multicurrency/class/multicurrency.class.php';
$langs->loadLangs(array('admin', 'multicurrency'));
// Access control
-if (!$user->admin) {
+if (!$user->admin || empty($conf->multicurrency->enabled)) {
accessforbidden();
}
@@ -45,7 +45,7 @@ $action = GETPOST('action', 'aZ09');
* Actions
*/
-
+$reg = array();
if (preg_match('/set_([a-z0-9_\-]+)/i', $action, $reg)) {
$code = $reg[1];
$value = GETPOST($code, 'alpha');
diff --git a/htdocs/admin/sms.php b/htdocs/admin/sms.php
index d2cf26a0c9a..9ddbc3361c8 100644
--- a/htdocs/admin/sms.php
+++ b/htdocs/admin/sms.php
@@ -66,7 +66,7 @@ if ($action == 'send' && !$_POST['cancel']) {
$error = 0;
$smsfrom = '';
- if (!empty($_POST["fromsms"])) {
+ if (GETPOST("fromsms", 'alphanohtml')) {
$smsfrom = GETPOST("fromsms", 'alphanohtml');
}
if (empty($smsfrom)) {
diff --git a/htdocs/api/admin/explorer.php b/htdocs/api/admin/explorer.php
deleted file mode 100644
index 53b9233c130..00000000000
--- a/htdocs/api/admin/explorer.php
+++ /dev/null
@@ -1,216 +0,0 @@
-
- * Copyright (C) 2016 Laurent Destailleur
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see .
- *
- * @deprecated Old explorer. Not using Swagger. See instead explorer in htdocs/api/index.php.
- */
-
-/**
- * \defgroup api Module DolibarrApi
- * \brief API loader
- * Search files htdocs//class/api_.class.php
- * \file htdocs/api/admin/explorer.php
- */
-
-use Luracast\Restler\Routes;
-
-require_once '../../main.inc.php';
-require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php';
-require_once DOL_DOCUMENT_ROOT.'/api/class/api.class.php';
-require_once DOL_DOCUMENT_ROOT.'/api/class/api_access.class.php';
-
-// Load translation files required by the page
-$langs->load("admin");
-
-
-/*
- * View
- */
-
-// Enable and test if module Api is enabled
-if (empty($conf->global->MAIN_MODULE_API)) {
- dol_syslog("Call Dolibarr API interfaces with module REST disabled");
- print $langs->trans("WarningModuleNotActive", 'Api').'.
';
- print $langs->trans("ToActivateModule");
- exit;
-}
-
-
-$api = new DolibarrApi($db);
-
-$api->r->addAPIClass('Luracast\\Restler\\Resources'); //this creates resources.json at API Root
-$api->r->setSupportedFormats('JsonFormat', 'XmlFormat');
-$api->r->addAuthenticationClass('DolibarrApiAccess', '');
-
-$listofapis = array();
-
-$modulesdir = dolGetModulesDirs();
-foreach ($modulesdir as $dir) {
- /*
- * Search available module
- */
- //dol_syslog("Scan directory ".$dir." for API modules");
-
- $handle = @opendir(dol_osencode($dir));
- if (is_resource($handle)) {
- while (($file = readdir($handle)) !== false) {
- if (is_readable($dir.$file) && preg_match("/^(mod.*)\.class\.php$/i", $file, $reg)) {
- $modulename = $reg[1];
-
- // Defined if module is enabled
- $enabled = true;
- $module = $part = $obj = strtolower(preg_replace('/^mod/i', '', $modulename));
- //if ($part == 'propale') $part='propal';
- if ($module == 'societe') {
- $obj = 'thirdparty';
- }
- if ($module == 'categorie') {
- $part = 'categories';
- $obj = 'category';
- }
- if ($module == 'facture') {
- $part = 'compta/facture';
- $obj = 'facture';
- }
- if ($module == 'ficheinter') {
- $obj = 'fichinter';
- $part = 'fichinter';
- $module = 'fichinter';
- }
-
- if (empty($conf->$module->enabled)) {
- $enabled = false;
- }
-
- if ($enabled) {
- /*
- * If exists, load the API class for enable module
- *
- * Search files named api_