diff --git a/htdocs/comm/propal/document.php b/htdocs/comm/propal/document.php index 6cc40873060..0c68a292109 100644 --- a/htdocs/comm/propal/document.php +++ b/htdocs/comm/propal/document.php @@ -1,6 +1,6 @@ - * Copyright (C) 2004-2009 Laurent Destailleur + * Copyright (C) 2004-2017 Laurent Destailleur * Copyright (C) 2005 Marc Barilley / Ocebo * Copyright (C) 2005-2012 Regis Houssin * Copyright (C) 2013 Cédric Salvador @@ -63,17 +63,18 @@ if (! $sortfield) $sortfield="name"; $object = new Propal($db); $object->fetch($id,$ref); -if ($object->id > 0) -{ - $object->fetch_thirdparty(); - $upload_dir = $conf->propal->dir_output.'/'.dol_sanitizeFileName($object->ref); - include_once DOL_DOCUMENT_ROOT . '/core/actions_linkedfiles.inc.php'; -} + /* * Actions */ +if ($object->id > 0) +{ + $object->fetch_thirdparty(); + $upload_dir = $conf->propal->dir_output.'/'.dol_sanitizeFileName($object->ref); + include_once DOL_DOCUMENT_ROOT . '/core/actions_linkedfiles.inc.php'; +} /* @@ -101,10 +102,10 @@ if ($object->id > 0) // Proposal card - + $linkback = '' . $langs->trans("BackToList") . ''; - - + + $morehtmlref='
'; // Ref customer $morehtmlref.=$form->editfieldkey("RefCustomer", 'ref_client', $object->ref_client, $object, 0, 'string', '', 0, 1); @@ -145,24 +146,24 @@ if ($object->id > 0) } } $morehtmlref.='
'; - + dol_banner_tab($object, 'ref', $linkback, 1, 'ref', 'ref', $morehtmlref); - - + + print '
'; print '
'; - + print ''; - + // Files infos print ''; print ''; - + print "
'.$langs->trans("NbOfAttachedFiles").''.count($filearray).'
'.$langs->trans("TotalSizeOfAttachedFiles").''.$totalsize.' '.$langs->trans("bytes").'
\n"; - + print '
'; - - + + dol_fiche_end(); $modulepart = 'propal'; diff --git a/htdocs/comm/propal/list.php b/htdocs/comm/propal/list.php index 47a35ff47a1..a8e3d23565f 100644 --- a/htdocs/comm/propal/list.php +++ b/htdocs/comm/propal/list.php @@ -275,25 +275,25 @@ if (! $user->rights->societe->client->voir && ! $socid) //restriction $sql.= " AND s.rowid = sc.fk_soc AND sc.fk_user = " .$user->id; } if ($search_town) $sql.= natural_search('s.town', $search_town); -if ($search_zip) $sql.= natural_search("s.zip",$search_zip); -if ($search_state) $sql.= natural_search("state.nom",$search_state); -if ($search_country) $sql .= " AND s.fk_pays IN (".$search_country.')'; -if ($search_type_thirdparty) $sql .= " AND s.fk_typent IN (".$search_type_thirdparty.')'; -if ($search_ref) $sql .= natural_search('p.ref', $search_ref); +if ($search_zip) $sql.= natural_search("s.zip", $search_zip); +if ($search_state) $sql.= natural_search("state.nom", $search_state); +if ($search_country) $sql .= " AND s.fk_pays IN (".$db->escape($search_country).')'; +if ($search_type_thirdparty) $sql .= " AND s.fk_typent IN (".$db->escape($search_type_thirdparty).')'; +if ($search_ref) $sql .= natural_search('p.ref', $search_ref); if ($search_refcustomer) $sql .= natural_search('p.ref_client', $search_refcustomer); -if ($search_societe) $sql .= natural_search('s.nom', $search_societe); -if ($search_login) $sql.= " AND u.login LIKE '%".$db->escape(trim($search_login))."%'"; +if ($search_societe) $sql .= natural_search('s.nom', $search_societe); +if ($search_login) $sql .= natural_search("u.login", $search_login); if ($search_montant_ht != '') $sql.= natural_search("p.total_ht", $search_montant_ht, 1); if ($search_montant_vat != '') $sql.= natural_search("p.tva", $search_montant_vat, 1); if ($search_montant_ttc != '') $sql.= natural_search("p.total", $search_montant_ttc, 1); if ($sall) { $sql .= natural_search(array_keys($fieldstosearchall), $sall); } -if ($search_product_category > 0) $sql.=" AND cp.fk_categorie = ".$search_product_category; +if ($search_product_category > 0) $sql.=" AND cp.fk_categorie = ".$db->escape($search_product_category); if ($socid > 0) $sql.= ' AND s.rowid = '.$socid; if ($viewstatut != '' && $viewstatut != '-1') { - $sql.= ' AND p.fk_statut IN ('.$viewstatut.')'; + $sql.= ' AND p.fk_statut IN ('.$db->escape($viewstatut).')'; } if ($month > 0) { @@ -302,16 +302,16 @@ if ($month > 0) else if ($year > 0 && ! empty($day)) $sql.= " AND p.datep BETWEEN '".$db->idate(dol_mktime(0, 0, 0, $month, $day, $year))."' AND '".$db->idate(dol_mktime(23, 59, 59, $month, $day, $year))."'"; else - $sql.= " AND date_format(p.datep, '%m') = '".$month."'"; + $sql.= " AND date_format(p.datep, '%m') = '".$db->escape($month)."'"; } else if ($year > 0) { $sql.= " AND p.datep BETWEEN '".$db->idate(dol_get_first_day($year,1,false))."' AND '".$db->idate(dol_get_last_day($year,12,false))."'"; } -if ($search_sale > 0) $sql.= " AND s.rowid = sc.fk_soc AND sc.fk_user = " .$search_sale; +if ($search_sale > 0) $sql.= " AND s.rowid = sc.fk_soc AND sc.fk_user = " .$db->escape($search_sale); if ($search_user > 0) { - $sql.= " AND c.fk_c_type_contact = tc.rowid AND tc.element='propal' AND tc.source='internal' AND c.element_id = p.rowid AND c.fk_socpeople = ".$search_user; + $sql.= " AND c.fk_c_type_contact = tc.rowid AND tc.element='propal' AND tc.source='internal' AND c.element_id = p.rowid AND c.fk_socpeople = ".$db->escape($search_user); } // Add where from extra fields foreach ($search_array_options as $key => $val) @@ -365,23 +365,24 @@ if ($resql) $arrayofselected=is_array($toselect)?$toselect:array(); - $param='&viewstatut='.$viewstatut; - if (! empty($contextpage) && $contextpage != $_SERVER["PHP_SELF"]) $param.='&contextpage='.$contextpage; - if ($limit > 0 && $limit != $conf->liste_limit) $param.='&limit='.$limit; - if ($sall) $param.='&sall='.$sall; - if ($month) $param.='&month='.$month; - if ($year) $param.='&year='.$year; - if ($search_ref) $param.='&search_ref=' .$search_ref; - if ($search_refcustomer) $param.='&search_refcustomer=' .$search_refcustomer; - if ($search_societe) $param.='&search_societe=' .$search_societe; - if ($search_user > 0) $param.='&search_user='.$search_user; - if ($search_sale > 0) $param.='&search_sale='.$search_sale; - if ($search_montant_ht) $param.='&search_montant_ht='.$search_montant_ht; - if ($search_login) $param.='&search_login='.$search_login; - if ($search_town) $param.='&search_town='.$search_town; - if ($search_zip) $param.='&search_zip='.$search_zip; - if ($socid > 0) $param.='&socid='.$socid; - if ($optioncss != '') $param.='&optioncss='.$optioncss; + $param='&viewstatut='.urlencode($viewstatut); + if (! empty($contextpage) && $contextpage != $_SERVER["PHP_SELF"]) $param.='&contextpage='.urlencode($contextpage); + if ($limit > 0 && $limit != $conf->liste_limit) $param.='&limit='.urlencode($limit); + if ($sall) $param.='&sall='.urlencode($sall); + if ($month) $param.='&month='.urlencode($month); + if ($year) $param.='&year='.urlencode($year); + if ($search_ref) $param.='&search_ref='.urlencode($search_ref); + if ($search_refcustomer) $param.='&search_refcustomer='.urlencode($search_refcustomer); + if ($search_societe) $param.='&search_societe='.urlencode($search_societe); + if ($search_user > 0) $param.='&search_user='.urlencode($search_user); + if ($search_sale > 0) $param.='&search_sale='.urlencode($search_sale); + if ($search_montant_ht) $param.='&search_montant_ht='.urlencode($search_montant_ht); + if ($search_login) $param.='&search_login='.urlencode($search_login); + if ($search_town) $param.='&search_town='.urlencode($search_town); + if ($search_zip) $param.='&search_zip='.urlencode($search_zip); + if ($socid > 0) $param.='&socid='.urlencode($socid); + if ($optioncss != '') $param.='&optioncss='.urlencode($optioncss); + // Add $param from extra fields foreach ($search_array_options as $key => $val) { diff --git a/htdocs/core/actions_linkedfiles.inc.php b/htdocs/core/actions_linkedfiles.inc.php index 018baab0cc0..f21c41d828d 100644 --- a/htdocs/core/actions_linkedfiles.inc.php +++ b/htdocs/core/actions_linkedfiles.inc.php @@ -73,7 +73,7 @@ if ($action == 'confirm_deletefile' && $confirm == 'yes') $ret = dol_delete_file($file, 0, 0, 0, $object); if (! empty($fileold)) dol_delete_file($fileold, 0, 0, 0, $object); // Delete file using old path - + // Si elle existe, on efface la vignette if (preg_match('/(\.jpg|\.jpeg|\.bmp|\.gif|\.png|\.tiff)$/i',$file,$regs)) { @@ -152,19 +152,28 @@ elseif ($action == 'renamefile' && GETPOST('renamefilesave')) { $filenamefrom=dol_sanitizeFileName(GETPOST('renamefilefrom')); $filenameto=dol_sanitizeFileName(GETPOST('renamefileto')); + + // Security: + // Disallow file with some extensions. We rename them. + // Because if we put the documents directory into a directory inside web root (very bad), this allows to execute on demand arbitrary code. + if (preg_match('/\.htm|\.html|\.php|\.pl|\.cgi$/i',$filenameto) && empty($conf->global->MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED)) + { + $filenameto.= '.noexe'; + } + if ($filenamefrom && $filenameto) { $srcpath = $upload_dir.'/'.$filenamefrom; $destpath = $upload_dir.'/'.$filenameto; - + $result = dol_move($srcpath, $destpath); - if ($result) + if ($result) { $object->addThumbs($destpath); - + // TODO Add revert function of addThumbs //$object->delThumbs($srcpath); - + setEventMessages($langs->trans("FileRenamed"), null); } else diff --git a/htdocs/core/lib/files.lib.php b/htdocs/core/lib/files.lib.php index 21fb1be7c0d..7f2be7f5a3d 100644 --- a/htdocs/core/lib/files.lib.php +++ b/htdocs/core/lib/files.lib.php @@ -910,8 +910,8 @@ function dol_move_uploaded_file($src_file, $dest_file, $allowoverwrite, $disable } // Security: - // Disallow file with some extensions. We renamed them. - // Car si on a mis le rep documents dans un rep de la racine web (pas bien), cela permet d'executer du code a la demande. + // Disallow file with some extensions. We rename them. + // Because if we put the documents directory into a directory inside web root (very bad), this allows to execute on demand arbitrary code. if (preg_match('/\.htm|\.html|\.php|\.pl|\.cgi$/i',$dest_file) && empty($conf->global->MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED)) { $file_name.= '.noexe'; diff --git a/htdocs/don/card.php b/htdocs/don/card.php index 3f58982624d..203c35caa72 100644 --- a/htdocs/don/card.php +++ b/htdocs/don/card.php @@ -316,17 +316,17 @@ if ($action == 'create') print ''; // Amount - print "".''.$langs->trans("Amount").' '.$langs->trans("Currency".$conf->currency).''; + print "".''.$langs->trans("Amount").' '.$langs->trans("Currency".$conf->currency).''; print ''.$langs->trans("PublicDonation").""; print $form->selectyesno("public",isset($_POST["public"])?$_POST["public"]:1,1); print "\n"; - print "".''.$langs->trans("Company").''; - print "".''.$langs->trans("Lastname").''; - print "".''.$langs->trans("Firstname").''; + print "".''.$langs->trans("Company").''; + print "".''.$langs->trans("Lastname").''; + print "".''.$langs->trans("Firstname").''; print "".''.$langs->trans("Address").''; - print ''; + print ''; // Zip / Town print ''.$langs->trans("Zip").' / '.$langs->trans("Town").''; @@ -341,7 +341,7 @@ if ($action == 'create') if ($user->admin) print info_admin($langs->trans("YouCanChangeValuesForThisListFromDictionarySetup"),1); print ''; - print "".''.$langs->trans("EMail").''; + print "".''.$langs->trans("EMail").''; // Public note print ''; @@ -385,9 +385,9 @@ if ($action == 'create') dol_fiche_end(); print '
'; - print ''; + print ''; print '     '; - print ''; + print ''; print '
'; print "\n"; @@ -439,7 +439,7 @@ if (! empty($id) && $action == 'edit') // Amount if ($object->statut == 0) { - print "".''.$langs->trans("Amount").' '.$langs->trans("Currency".$conf->currency).''; + print "".''.$langs->trans("Amount").' '.$langs->trans("Currency".$conf->currency).''; } else { @@ -454,11 +454,11 @@ if (! empty($id) && $action == 'edit') print "\n"; $langs->load("companies"); - print ''.$langs->trans("Company").''; - print ''.$langs->trans("Lastname").''; - print ''.$langs->trans("Firstname").''; + print ''.$langs->trans("Company").''; + print ''.$langs->trans("Lastname").''; + print ''.$langs->trans("Firstname").''; print ''.$langs->trans("Address").''; - print ''; + print ''; // Zip / Town print ''.$langs->trans("Zip").' / '.$langs->trans("Town").''; @@ -473,7 +473,7 @@ if (! empty($id) && $action == 'edit') if ($user->admin) print info_admin($langs->trans("YouCanChangeValuesForThisListFromDictionarySetup"),1); print ''; - print "".''.$langs->trans("EMail").''; + print "".''.$langs->trans("EMail").''; print "".$langs->trans("PaymentMode")."\n"; @@ -594,13 +594,6 @@ if (! empty($id) && $action != 'edit') print ''; - // Ref - /* - print ''; - print ''; - */ // Date print ''; print ''; print ''; - /*print ''; - - // Zip / Town - print ''; - - // Country - print ''; - - // EMail - print "".''; - */ // Payment mode print "\n"; - //print "".''; - - // Project - /* - if (! empty($conf->projet->enabled)) - { - print ''; - print ''; - print ''; - print ''; - }*/ - // Other attributes $cols = 2; include DOL_DOCUMENT_ROOT . '/core/tpl/extrafields_view.tpl.php'; diff --git a/htdocs/holiday/list.php b/htdocs/holiday/list.php index e5afb2cfa42..2b917927067 100644 --- a/htdocs/holiday/list.php +++ b/htdocs/holiday/list.php @@ -138,7 +138,7 @@ if($year_start > 0) { } } else { if($month_start > 0) { - $filter.= " AND date_format(cp.date_debut, '%m') = '$month_start'"; + $filter.= " AND date_format(cp.date_debut, '%m') = '".$db->escape($month_start)."'"; } } @@ -153,7 +153,7 @@ if($year_end > 0) { } } else { if($month_end > 0) { - $filter.= " AND date_format(cp.date_fin, '%m') = '$month_end'"; + $filter.= " AND date_format(cp.date_fin, '%m') = '".$db->escape($month_end)."'"; } } @@ -357,13 +357,13 @@ print ''; // DATE DEBUT print ''; // DATE FIN print '';
'.$langs->trans("Ref").''; - print $form->showrefnav($object, 'rowid', $linkback, 1, 'rowid', 'ref', ''); - print '
'.$langs->trans("Date").''; print dol_print_date($object->date,"day"); @@ -617,52 +610,12 @@ if (! empty($id) && $action != 'edit') print '
'.$langs->trans("Company").''.$object->societe.'
'.$langs->trans("Lastname").''.$object->lastname.'
'.$langs->trans("Firstname").''.$object->firstname.'
'.$langs->trans("Address").''.dol_nl2br($object->address).'
'.$langs->trans("Zip").' / '.$langs->trans("Town").''; - print $object->zip.($object->zip && $object->town?' / ':'').$object->town.'
'.$langs->trans('Country').''; - if (! empty($object->country_code)) - { - $img=picto_from_langcode($object->country_code); - print ($img?$img.' ':''); - print $object->country; - } - else - { - print $object->country_olddata; - } - print '
'.$langs->trans("EMail").''.dol_print_email($object->email).'
".$langs->trans("PaymentMode").""; $form->form_modes_reglement(null, $object->modepaymentid,'none'); print "
'.$langs->trans("Status").''.$object->getLibStatut(4).'
'.$langs->trans("Project").''; - $projettmp=new Project($db); - $projettmp->id=$object->fk_projet; - $projettmp->ref=$object->project; - if(! empty($object->fk_projet)) print $projettmp->getNomUrl(1); - print '
 '; -print ''; +print ''; $formother->select_year($year_start,'year_start',1, $min_year, $max_year); print ''; -print ''; +print ''; $formother->select_year($year_end,'year_end',1, $min_year, $max_year); print '