Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2026-02-12 10:52:37 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix use of invoke into computed fields

Browse Source
This commit is contained in:
Laurent Destailleur
2024-03-03 19:35:37 +01:00
parent 717297ef29
commit 17ff0972ab
2 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
test/phpunit/SecurityTest.php
View File

@@ -960,6 +960,16 @@ class SecurityTest extends PHPUnit\Framework\TestCase
print "result = ".$result."\n";
$this->assertEquals('Parent project not found', $result);
$s = 'new abc->invoke(\'whoami\')';
$result=dol_eval($s, 1, 1, '2');
print "result = ".$result."\n";
$this->assertEquals('Bad string syntax to evaluate: new abc__forbiddenstring__(\'whoami\')', $result);
$s = 'new ReflectionFunction(\'abc\')';
$result=dol_eval($s, 1, 1, '2');
print "result = ".$result."\n";
$this->assertEquals('Bad string syntax to evaluate: new __forbiddenstring__(\'abc\')', $result);
$result=dol_eval('$a=function() { }; $a;', 1, 1, '');
print "result = ".$result."\n";
$this->assertContains('Bad string syntax to evaluate', $result);