Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Enhance error catching on dol_eval

Browse Source
This commit is contained in:
Laurent Destailleur
2023-02-04 15:21:32 +01:00
parent 3cc415af47
commit 70c6ce9bfb
1 changed files with 87 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
htdocs/core/lib/functions.lib.php
View File

@@ -8914,7 +8914,6 @@ function verifCond($strToEvaluate)
*/ */
function dol_eval($s, $returnvalue = 0, $hideerrors = 1, $onlysimplestring = '1') function dol_eval($s, $returnvalue = 0, $hideerrors = 1, $onlysimplestring = '1')
{ {
try {
// Only global variables can be changed by eval function and returned to caller // Only global variables can be changed by eval function and returned to caller
global $db, $langs, $user, $conf, $website, $websitepage; global $db, $langs, $user, $conf, $website, $websitepage;
global $action, $mainmenu, $leftmenu; global $action, $mainmenu, $leftmenu;
@@ -8925,6 +8924,7 @@ function dol_eval($s, $returnvalue = 0, $hideerrors = 1, $onlysimplestring = '1'
global $obj; // To get $obj used into list when dol_eval is used for computed fields and $obj is not yet $object global $obj; // To get $obj used into list when dol_eval is used for computed fields and $obj is not yet $object
global $soc; // For backward compatibility global $soc; // For backward compatibility
try {
// Test on dangerous char (used for RCE), we allow only characters to make PHP variable testing // Test on dangerous char (used for RCE), we allow only characters to make PHP variable testing
if ($onlysimplestring == '1') { if ($onlysimplestring == '1') {
// We must accept: '1 && getDolGlobalInt("doesnotexist1") && $conf->global->MAIN_FEATURES_LEVEL' // We must accept: '1 && getDolGlobalInt("doesnotexist1") && $conf->global->MAIN_FEATURES_LEVEL'
@@ -9020,11 +9020,14 @@ function dol_eval($s, $returnvalue = 0, $hideerrors = 1, $onlysimplestring = '1'
} }
} catch (Error $e) { } catch (Error $e) {
$error = 'Caught error : '; $error = 'Caught error : ';
$error .= $e->getMessage() . ', '; $error .= $e->getMessage();
$error .= 'Trace : '; //$error .= ', Trace : ';
$error .= json_encode($e->getTrace()); //$error .= json_encode($e->getTrace());
error_log($error, 1); error_log($error, 1);
} }
if ($returnvalue) {
return '';
}
} }
/** /**