Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Fix #yogosha4529

Browse Source
This commit is contained in:
Laurent Destailleur
2020-09-19 00:02:38 +02:00
parent d21c2f0d61
commit 6d2d5d7cae
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
htdocs/core/lib/functions.lib.php
View File

@@ -606,6 +606,11 @@ function GETPOST($paramname, $check = 'alphanohtml', $method = 0, $filter = null
break; break;
} }
// Sanitizing for special var name. There is no reason to allow a backtopage to an external URL.
if ($paramname == 'backtopage') {
$out = preg_replace(array('/\/\//', '/^[a-z]*:/'), '', $out);
}
// Code for search criteria persistence. // Code for search criteria persistence.
// Save data into session if key start with 'search_' or is 'smonth', 'syear', 'month', 'year' // Save data into session if key start with 'search_' or is 'smonth', 'syear', 'month', 'year'
if (empty($method) || $method == 3 || $method == 4) if (empty($method) || $method == 3 || $method == 4)