diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php index 4dc5221cea3..e9ac1dfa28f 100644 --- a/htdocs/comm/action/card.php +++ b/htdocs/comm/action/card.php @@ -32,7 +32,6 @@ // Load Dolibarr environment require '../../main.inc.php'; - require_once DOL_DOCUMENT_ROOT.'/core/class/extrafields.class.php'; require_once DOL_DOCUMENT_ROOT.'/core/class/html.form.class.php'; require_once DOL_DOCUMENT_ROOT.'/core/class/html.formactions.class.php'; @@ -154,7 +153,7 @@ if (!empty($conf->global->AGENDA_REMINDER_EMAIL)) { $TDurationTypes = array('y'=>$langs->trans('Years'), 'm'=>$langs->trans('Month'), 'w'=>$langs->trans('Weeks'), 'd'=>$langs->trans('Days'), 'h'=>$langs->trans('Hours'), 'i'=>$langs->trans('Minutes')); -$result = restrictedArea($user, 'agenda', $object->id, 'actioncomm&societe', 'myactions|allactions', 'fk_soc', 'id'); +$result = restrictedArea($user, 'agenda', $object, 'actioncomm&societe', 'myactions|allactions', 'fk_soc', 'id'); $usercancreate = $user->hasRight('agenda', 'allactions', 'create') || (($object->authorid == $user->id || $object->userownerid == $user->id) && $user->rights->agenda->myactions->create); diff --git a/htdocs/core/ajax/ajaxtooltip.php b/htdocs/core/ajax/ajaxtooltip.php index ae7b33f1f20..90c416100cb 100644 --- a/htdocs/core/ajax/ajaxtooltip.php +++ b/htdocs/core/ajax/ajaxtooltip.php @@ -1,5 +1,5 @@ +/* Copyright (C) 2007-2023 Laurent Destailleur * Copyright (C) 2018-2023 Frédéric France * * This program is free software; you can redistribute it and/or modify @@ -22,7 +22,6 @@ * \brief This script returns content of tooltip */ - if (!defined('NOTOKENRENEWAL')) { define('NOTOKENRENEWAL', 1); // Disables token renewal } @@ -41,7 +40,7 @@ include_once DOL_DOCUMENT_ROOT.'/core/class/html.form.class.php'; $id = GETPOST('id', 'aZ09'); -$objecttype = GETPOST('objecttype', 'aZ09'); // 'module' or 'myobject@mymodule', 'mymodule_myobject' +$objecttype = GETPOST('objecttype', 'aZ09arobase'); // 'module' or 'myobject@mymodule', 'mymodule_myobject' $params = array(); if (GETPOSTISSET('infologin')) { @@ -53,6 +52,9 @@ if (GETPOSTISSET('option')) { // Load object according to $element $object = fetchObjectByElement($id, $objecttype); +if (empty($object->element)) { + httponly_accessforbidden('Failed to get object from objecttype='.$objecttype.' id='.$id); +} $module = $object->module; $element = $object->element; @@ -62,6 +64,8 @@ if ($usesublevelpermission && !isset($user->rights->$module->$element)) { // The $usesublevelpermission = ''; } +//print $object->id.' - '.$object->module.' - '.$object->element.' - '.$object->table_element.' - '.$usesublevelpermission."\n"; + // Security check restrictedArea($user, $object->module, $object, $object->table_element, $usesublevelpermission); diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 84e4a8b36ee..620871abe88 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -536,6 +536,7 @@ function GETPOSTISARRAY($paramname, $method = 0) * 'alphanohtml'=check there is no html content and no " and no ../ * 'aZ'=check it's a-z only * 'aZ09'=check it's simple alpha string (recommended for keys) + * 'aZ09arobase'=check it's a string for an element type * 'aZ09comma'=check it's a string for a sortfield or sortorder * 'san_alpha'=Use filter_var with FILTER_SANITIZE_STRING (do not use this for free text string) * 'nohtml'=check there is no html content @@ -935,6 +936,14 @@ function sanitizeVal($out = '', $check = 'alphanohtml', $filter = null, $options } } break; + case 'aZ09arobase': // great to sanitize objecttype parameter + if (!is_array($out)) { + $out = trim($out); + if (preg_match('/[^a-z0-9_\-\.@]+/i', $out)) { + $out = ''; + } + } + break; case 'aZ09comma': // great to sanitize sortfield or sortorder params that can be t.abc,t.def_gh if (!is_array($out)) { $out = trim($out); diff --git a/htdocs/core/lib/security.lib.php b/htdocs/core/lib/security.lib.php index 211f39606bd..7091eb2ca81 100644 --- a/htdocs/core/lib/security.lib.php +++ b/htdocs/core/lib/security.lib.php @@ -340,7 +340,7 @@ function dolGetLdapPasswordHash($password, $type = 'md5') * @param string $feature2 Feature to check, second level of permission (optional). Can be a 'or' check with 'sublevela|sublevelb'. * This is used to check permission $user->rights->features->feature2... * @param string $dbt_keyfield Field name for socid foreign key if not fk_soc. Not used if objectid is null (optional). Can use '' if NA. - * @param string $dbt_select Field name for select if not "rowid". Not used if objectid is null (optional) + * @param string $dbt_select Field rowid name, for select into tableandshare if not "rowid". Not used if objectid is null (optional) * @param int $isdraft 1=The object with id=$objectid is a draft * @param int $mode Mode (0=default, 1=return without dieing) * @return int If mode = 0 (default): Always 1, die process if not allowed. If mode = 1: Return 0 if access not allowed. @@ -351,6 +351,7 @@ function restrictedArea(User $user, $features, $object = 0, $tableandshare = '', global $db, $conf; global $hookmanager; + // Define $objectid if (is_object($object)) { $objectid = $object->id; } else { @@ -369,6 +370,11 @@ function restrictedArea(User $user, $features, $object = 0, $tableandshare = '', // Fix syntax of $features param $originalfeatures = $features; + if ($features == 'agenda') { + $tableandshare = 'actioncomm&societe'; + $feature2 = 'myactions|allactions'; + $dbt_select = 'id'; + } if ($features == 'facturerec') { $features = 'facture'; } @@ -403,6 +409,8 @@ function restrictedArea(User $user, $features, $object = 0, $tableandshare = '', } } + //print $features.' - '.$tableandshare.' - '.$feature2.' - '.$dbt_select."\n"; + // Get more permissions checks from hooks $parameters = array('features'=>$features, 'originalfeatures'=>$originalfeatures, 'objectid'=>$objectid, 'dbt_select'=>$dbt_select, 'idtype'=>$dbt_select, 'isdraft'=>$isdraft); $reshook = $hookmanager->executeHooks('restrictedArea', $parameters); diff --git a/htdocs/knowledgemanagement/class/knowledgerecord.class.php b/htdocs/knowledgemanagement/class/knowledgerecord.class.php index 4af7cd2bd27..d53a871a6ba 100644 --- a/htdocs/knowledgemanagement/class/knowledgerecord.class.php +++ b/htdocs/knowledgemanagement/class/knowledgerecord.class.php @@ -770,7 +770,7 @@ class KnowledgeRecord extends CommonObject $params = [ 'id' => $this->id, - 'objecttype' => $this->element, + 'objecttype' => $this->element.($this->module ? '@'.$this->module : ''), 'option' => $option, 'nofetch' => 1, ]; diff --git a/htdocs/modulebuilder/template/class/myobject.class.php b/htdocs/modulebuilder/template/class/myobject.class.php index b54eff6a0e3..e1f65576cd0 100644 --- a/htdocs/modulebuilder/template/class/myobject.class.php +++ b/htdocs/modulebuilder/template/class/myobject.class.php @@ -796,7 +796,7 @@ class MyObject extends CommonObject $result = ''; $params = [ 'id' => $this->id, - 'objecttype' => $this->element, + 'objecttype' => $this->element.($this->module ? '@'.$this->module : ''), 'option' => $option, ]; $classfortooltip = 'classfortooltip';