Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

FIX XSS

Browse Source
This commit is contained in:
Laurent Destailleur
2017-05-10 11:47:34 +02:00
parent 2fc64b8e11
commit c4722e3694
4 changed files with 35 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
htdocs/core/lib/functions.lib.php
View File

@@ -302,7 +302,7 @@ function GETPOST($paramname,$check='',$method=0,$filter=NULL,$options=NULL)
break; break;
case 'aZ09': case 'aZ09':
$out=trim($out); $out=trim($out);
if (preg_match('/[^a-z0-9_]+/i',$out)) $out=''; if (preg_match('/[^a-z0-9_\-]+/i',$out)) $out='';
break; break;
case 'array': case 'array':
if (! is_array($out) || empty($out)) $out=array(); if (! is_array($out) || empty($out)) $out=array();
@@ -2937,7 +2937,7 @@ function dol_print_error($db='',$error='',$errors=null)
if ($_SERVER['DOCUMENT_ROOT']) // Mode web if ($_SERVER['DOCUMENT_ROOT']) // Mode web
{ {
$out.="<b>".$langs->trans("DatabaseTypeManager").":</b> ".$db->type."<br>\n"; $out.="<b>".$langs->trans("DatabaseTypeManager").":</b> ".$db->type."<br>\n";
$out.="<b>".$langs->trans("RequestLastAccessInError").":</b> ".($db->lastqueryerror()?$db->lastqueryerror():$langs->trans("ErrorNoRequestInError"))."<br>\n"; $out.="<b>".$langs->trans("RequestLastAccessInError").":</b> ".($db->lastqueryerror()?dol_escape_htmltag($db->lastqueryerror()):$langs->trans("ErrorNoRequestInError"))."<br>\n";
$out.="<b>".$langs->trans("ReturnCodeLastAccessInError").":</b> ".($db->lasterrno()?$db->lasterrno():$langs->trans("ErrorNoRequestInError"))."<br>\n"; $out.="<b>".$langs->trans("ReturnCodeLastAccessInError").":</b> ".($db->lasterrno()?$db->lasterrno():$langs->trans("ErrorNoRequestInError"))."<br>\n";
$out.="<b>".$langs->trans("InformationLastAccessInError").":</b> ".($db->lasterror()?$db->lasterror():$langs->trans("ErrorNoRequestInError"))."<br>\n"; $out.="<b>".$langs->trans("InformationLastAccessInError").":</b> ".($db->lasterror()?$db->lasterror():$langs->trans("ErrorNoRequestInError"))."<br>\n";
$out.="<br>\n"; $out.="<br>\n";
@@ -2945,7 +2945,9 @@ function dol_print_error($db='',$error='',$errors=null)
else // Mode CLI else // Mode CLI
{ {
$out.='> '.$langs->transnoentities("DatabaseTypeManager").":\n".$db->type."\n"; $out.='> '.$langs->transnoentities("DatabaseTypeManager").":\n".$db->type."\n";
$out.='> '.$langs->transnoentities("RequestLastAccessInError").":\n".($db->lastqueryerror()?$db->lastqueryerror():$langs->trans("ErrorNoRequestInError"))."\n"; $out.='> '.$langs->transnoentities("RequestLastAccessInError").":\n".($db->lastqueryerror()?dol_escape_htmltag($db->lastqueryerror()):$langs->trans("ErrorNoRequestInError"))."\n";
// To make detection of xss vulnerabilities or sql injection easier with a scanner, replace line with this one:
//$out.='> '.$langs->transnoentities("RequestLastAccessInError").":\n".($db->lastqueryerror()?$db->lastqueryerror:$langs->trans("ErrorNoRequestInError"))."\n";
$out.='> '.$langs->transnoentities("ReturnCodeLastAccessInError").":\n".($db->lasterrno()?$db->lasterrno():$langs->trans("ErrorNoRequestInError"))."\n"; $out.='> '.$langs->transnoentities("ReturnCodeLastAccessInError").":\n".($db->lasterrno()?$db->lasterrno():$langs->trans("ErrorNoRequestInError"))."\n";
$out.='> '.$langs->transnoentities("InformationLastAccessInError").":\n".($db->lasterror()?$db->lasterror():$langs->trans("ErrorNoRequestInError"))."\n"; $out.='> '.$langs->transnoentities("InformationLastAccessInError").":\n".($db->lasterror()?$db->lasterror():$langs->trans("ErrorNoRequestInError"))."\n";

8
htdocs/index.php
View File

@@ -55,10 +55,10 @@ if (count($conf->modules) <= (empty($conf->global->MAIN_MIN_NB_ENABLED_MODULE_FO
if (GETPOST('addbox')) // Add box (when submit is done from a form when ajax disabled) if (GETPOST('addbox')) // Add box (when submit is done from a form when ajax disabled)
{ {
require_once DOL_DOCUMENT_ROOT.'/core/class/infobox.class.php'; require_once DOL_DOCUMENT_ROOT.'/core/class/infobox.class.php';
$zone=GETPOST('areacode'); $zone=GETPOST('areacode', 'aZ09');
$userid=GETPOST('userid'); $userid=GETPOST('userid', 'int');
$boxorder=GETPOST('boxorder'); $boxorder=GETPOST('boxorder', 'aZ09');
$boxorder.=GETPOST('boxcombo'); $boxorder.=GETPOST('boxcombo', 'aZ09');
$result=InfoBox::saveboxorder($db,$zone,$boxorder,$userid); $result=InfoBox::saveboxorder($db,$zone,$boxorder,$userid);
} }

1
htdocs/langs/en_US/agenda.lang
View File

@@ -75,6 +75,7 @@ ProposalDeleted=Proposal deleted
OrderDeleted=Order deleted OrderDeleted=Order deleted
InvoiceDeleted=Invoice deleted InvoiceDeleted=Invoice deleted
##### End agenda events ##### ##### End agenda events #####
AgendaModelModule=Document templates for event
DateActionStart=Start date DateActionStart=Start date
DateActionEnd=End date DateActionEnd=End date
AgendaUrlOptions1=You can also add following parameters to filter output: AgendaUrlOptions1=You can also add following parameters to filter output:

24
test/phpunit/SecurityTest.php
View File

@@ -147,7 +147,9 @@ class SecurityTest extends PHPUnit_Framework_TestCase
$_GET["param2"]='a/b#e(pr)qq-rr\cc'; $_GET["param2"]='a/b#e(pr)qq-rr\cc';
$_GET["param3"]='"a/b#e(pr)qq-rr\cc'; // Same than param2 + " $_GET["param3"]='"a/b#e(pr)qq-rr\cc'; // Same than param2 + "
$_GET["param4"]='../dir'; $_GET["param4"]='../dir';
$_GET["param5"]="a_1-b";
// Test int
$result=GETPOST('id','int'); // Must return nothing $result=GETPOST('id','int'); // Must return nothing
print __METHOD__." result=".$result."\n"; print __METHOD__." result=".$result."\n";
$this->assertEquals($result,''); $this->assertEquals($result,'');
@@ -160,6 +162,7 @@ class SecurityTest extends PHPUnit_Framework_TestCase
print __METHOD__." result=".$result."\n"; print __METHOD__." result=".$result."\n";
$this->assertEquals($result,333); $this->assertEquals($result,333);
// Test alpha
$result=GETPOST("param2",'alpha'); $result=GETPOST("param2",'alpha');
print __METHOD__." result=".$result."\n"; print __METHOD__." result=".$result."\n";
$this->assertEquals($result,$_GET["param2"]); $this->assertEquals($result,$_GET["param2"]);
@@ -172,6 +175,27 @@ class SecurityTest extends PHPUnit_Framework_TestCase
print __METHOD__." result=".$result."\n"; print __METHOD__." result=".$result."\n";
$this->assertEquals($result,''); $this->assertEquals($result,'');
// Test aZ09
$result=GETPOST("param1",'aZ09'); // Must return '' as there is a forbidden char ../
print __METHOD__." result=".$result."\n";
$this->assertEquals($result,$_GET["param1"]);
$result=GETPOST("param2",'aZ09'); // Must return '' as there is a forbidden char ../
print __METHOD__." result=".$result."\n";
$this->assertEquals($result,'');
$result=GETPOST("param3",'aZ09'); // Must return '' as there is a forbidden char ../
print __METHOD__." result=".$result."\n";
$this->assertEquals($result,'');
$result=GETPOST("param4",'aZ09'); // Must return '' as there is a forbidden char ../
print __METHOD__." result=".$result."\n";
$this->assertEquals($result,'');
$result=GETPOST("param5",'aZ09');
print __METHOD__." result=".$result."\n";
$this->assertEquals($result,$_GET["param5"]);
return $result; return $result;
} }