Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-12-12 12:31:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '15.0' of git@github.com:Dolibarr/dolibarr.git into develop

Browse Source
This commit is contained in:
Laurent Destailleur
2022-03-01 18:15:13 +01:00
parent 358f21f06e 883f13b388
commit 12b2a10865
4 changed files with 40 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
htdocs/core/lib/functions.lib.php
View File

@@ -8297,7 +8297,7 @@ function dol_getIdFromCode($db, $key, $tablename, $fieldkey = 'code', $fieldid =
* Verify if condition in string is ok or not
*
* @param string $strToEvaluate String with condition to check
* @return boolean True or False. Note: It returns True if $strToEvaluate is ''
* @return boolean True or False. Note: It returns also True if $strToEvaluate is ''
*/
function verifCond($strToEvaluate)
{
@@ -8308,8 +8308,10 @@ function verifCond($strToEvaluate)
//print $strToEvaluate."<br>\n";
$rights = true;
if (isset($strToEvaluate) && $strToEvaluate !== '') {
$str = 'if(!('.$strToEvaluate.')) { $rights = false; }';
dol_eval($str); // The dol_eval must contains all the global $xxx used into a condition
$str = 'if(!('.$strToEvaluate.')) $rights = false;';
dol_eval($str, 0, 1, '2'); // The dol_eval must contains all the global $xxx used into a condition
//$rep = dol_eval($strToEvaluate, 1, 1 , '1'); // The dol_eval must contains all the global $xxx used into a condition
//$rights = ($rep ? true : false);
}
return $rights;
}
@@ -8321,7 +8323,7 @@ function verifCond($strToEvaluate)
* @param string $s String to evaluate
* @param int $returnvalue 0=No return (used to execute eval($a=something)). 1=Value of eval is returned (used to eval($something)).
* @param int $hideerrors 1=Hide errors
* @param string $onlysimplestring Accept only simple string with char 'a-z0-9\s$_->&|=';
* @param string $onlysimplestring 0=Accept all chars, 1=Accept only simple string with char 'a-z0-9\s$_->&|=';, 2=Accept also '!?():";'
* @return mixed Nothing or return result of eval
*/
function dol_eval($s, $returnvalue = 0, $hideerrors = 1, $onlysimplestring = '1')
@@ -8340,7 +8342,22 @@ function dol_eval($s, $returnvalue = 0, $hideerrors = 1, $onlysimplestring = '1'
if ($onlysimplestring == '1') {
//print preg_quote('$_->&|', '/');
if (preg_match('/[^a-z0-9\s'.preg_quote('$_->&|=', '/').']/i', $s)) {
return 'Bad string syntax to evaluate (found chars that are not chars for simplestring): '.$s;
if ($returnvalue) {
return 'Bad string syntax to evaluate (found chars that are not chars for simplestring): '.$s;
} else {
dol_syslog('Bad string syntax to evaluate (found chars that are not chars for simplestring): '.$s);
return '';
}
}
} elseif ($onlysimplestring == '2') {
//print preg_quote('$_->&|', '/');
if (preg_match('/[^a-z0-9\s'.preg_quote('$_->&|=!?():";', '/').']/i', $s)) {
if ($returnvalue) {
return 'Bad string syntax to evaluate (found chars that are not chars for simplestring): '.$s;
} else {
dol_syslog('Bad string syntax to evaluate (found chars that are not chars for simplestring): '.$s);
return '';
}
}
}
if (strpos($s, '`') !== false) {