Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Merge branch '21.0' of git@github.com:Dolibarr/dolibarr.git into develop

Browse Source
This commit is contained in:
Laurent Destailleur (aka Eldy)
2025-02-13 20:42:23 +01:00
parent e70995ca7e 805d9a58ec
commit d223f8a0b9
10 changed files with 28 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
test/phpunit/SecurityTest.php
View File

@@ -202,6 +202,13 @@ class SecurityTest extends CommonClassTest
$result = testSqlAndScriptInject($test, 0);
$this->assertGreaterThanOrEqual($expectedresult, $result, 'Error on testSqlAndScriptInject bbb');
$test='<marquee onbeforeintput="alert(1)">';
$result=testSqlAndScriptInject($test, 0);
$this->assertGreaterThanOrEqual($expectedresult, $result, 'Error on testSqlAndScriptInject onbeforeintput');
$test='<marquee onbounce="alert(1)">';
$result=testSqlAndScriptInject($test, 0);
$this->assertGreaterThanOrEqual($expectedresult, $result, 'Error on testSqlAndScriptInject onbounce');
$test = '<SCRIPT SRC=http://xss.rocks/xss.js></SCRIPT>';
$result = testSqlAndScriptInject($test, 0);
$this->assertGreaterThanOrEqual($expectedresult, $result, 'Error on testSqlAndScriptInject ccc');
@@ -702,6 +709,7 @@ class SecurityTest extends CommonClassTest
// Must be allowed
global $leftmenu; // Used into strings to eval
$conf->global->MAIN_FEATURES_LEVEL = 1;
$leftmenu = 'AAA';
$result = dol_eval('$conf->currency && preg_match(\'/^(AAA|BBB)/\',$leftmenu)', 1, 1, '1');
@@ -726,7 +734,7 @@ class SecurityTest extends CommonClassTest
$leftmenu = 'XXX';
$conf->global->MAIN_FEATURES_LEVEL = 1; // Force for the case option is -1
$string = '(isModEnabled("agenda") || isModEnabled("resource")) && getDolGlobalInt("MAIN_FEATURES_LEVEL") >= 0 && preg_match(\'/^(admintools|all|XXX)/\', $leftmenu)';
$string = '(isModEnabled("user") || isModEnabled("resource")) && getDolGlobalInt("MAIN_FEATURES_LEVEL") >= 0 && preg_match(\'/^(admintools|all|XXX)/\', $leftmenu)';
$result = dol_eval($string, 1, 1, '1');
print "result17 = ".$result."\n";
$this->assertTrue($result);