Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Merge branch '19.0' of git@github.com:Dolibarr/dolibarr.git into 20.0

Browse Source
This commit is contained in:
ldestailleur
2025-05-10 13:25:31 +02:00
parent 584d37784f 629533494a
commit ae94c71a10
5 changed files with 29 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
htdocs/core/lib/functions.lib.php
View File

@@ -10404,14 +10404,16 @@ function dol_eval($s, $returnvalue = 1, $hideerrors = 1, $onlysimplestring = '1'
return '';
}
}
if (strpos($s, '::') !== false) {
if (!getDolGlobalString('MAIN_ALLOW_DOUBLE_COLON_IN_DOL_EVAL') && strpos($s, '::') !== false) {
if ($returnvalue) {
return 'Bad string syntax to evaluate (double : char is forbidden): '.$s;
return 'Bad string syntax to evaluate (double : char is forbidden without setting MAIN_ALLOW_DOUBLE_COLON_IN_DOL_EVAL): '.$s;
} else {
dol_syslog('Bad string syntax to evaluate (double : char is forbidden): '.$s, LOG_WARNING);
dol_syslog('Bad string syntax to evaluate (double : char is forbidden without setting MAIN_ALLOW_DOUBLE_COLON_IN_DOL_EVAL): '.$s, LOG_WARNING);
return '';
}
}
if (strpos($s, '`') !== false) {
if ($returnvalue) {
return 'Bad string syntax to evaluate (backtick char is forbidden): '.$s;
@@ -10420,12 +10422,16 @@ function dol_eval($s, $returnvalue = 1, $hideerrors = 1, $onlysimplestring = '1'
return '';
}
}
if (preg_match('/[^0-9]+\.[^0-9]+/', $s)) { // We refuse . if not between 2 numbers
if ($returnvalue) {
return 'Bad string syntax to evaluate (dot char is forbidden): '.$s;
} else {
dol_syslog('Bad string syntax to evaluate (dot char is forbidden): '.$s, LOG_WARNING);
return '';
// Disallow also concat
if (getDolGlobalString('MAIN_DISALLOW_STRING_OBFUSCATION_IN_DOL_EVAL')) {
if (preg_match('/[^0-9]+\.[^0-9]+/', $s)) { // We refuse . if not between 2 numbers
if ($returnvalue) {
return 'Bad string syntax to evaluate (dot char is forbidden): '.$s;
} else {
dol_syslog('Bad string syntax to evaluate (dot char is forbidden): '.$s, LOG_WARNING);
return '';
}
}
}