Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2026-01-04 16:12:39 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix #hunterb03d4415-d4f9-48c8-9ae2-d3aa248027b5

Browse Source
This commit is contained in:
Laurent Destailleur
2022-03-01 16:38:06 +01:00
parent d76e002822
commit 2a48dd349e
43 changed files with 135 additions and 104 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
test/phpunit/SecurityTest.php
View File

@@ -875,11 +875,18 @@ class SecurityTest extends PHPUnit\Framework\TestCase
include_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php';
include_once DOL_DOCUMENT_ROOT.'/projet/class/task.class.php';
$result=dol_eval('(($reloadedobj = new Task($db)) && ($reloadedobj->fetchNoCompute($object->id) > 0) && ($secondloadedobj = new Project($db)) && ($secondloadedobj->fetchNoCompute($reloadedobj->fk_project) > 0)) ? $secondloadedobj->ref: "Parent project not found"', 1, 1);
$s = '(($reloadedobj = new Task($db)) && ($reloadedobj->fetchNoCompute($object->id) > 0) && ($secondloadedobj = new Project($db)) && ($secondloadedobj->fetchNoCompute($reloadedobj->fk_project) > 0)) ? $secondloadedobj->ref: "Parent project not found"';
$result=dol_eval($s, 1, 1, '');
print "result = ".$result."\n";
$this->assertEquals('Parent project not found', $result);
$result=dol_eval('$a=function() { }; $a;', 1, 1);
$s = '(($reloadedobj = new Task($db)) && ($reloadedobj->fetchNoCompute($object->id) > 0) && ($secondloadedobj = new Project($db)) && ($secondloadedobj->fetchNoCompute($reloadedobj->fk_project) > 0)) ? $secondloadedobj->ref: \'Parent project not found\'';
$result=dol_eval($s, 1, 1, '');
print "result = ".$result."\n";
$this->assertEquals('Parent project not found', $result);
$result=dol_eval('$a=function() { }; $a;', 1, 1, '');
print "result = ".$result."\n";
$this->assertContains('Bad string syntax to evaluate', $result);
@@ -898,5 +905,18 @@ class SecurityTest extends PHPUnit\Framework\TestCase
$result=dol_eval('`ls`', 1, 0);
print "result = ".$result."\n";
$this->assertContains('Bad string syntax to evaluate', $result);
$result=dol_eval("('ex'.'ec')('echo abc')", 1, 0);
print "result = ".$result."\n";
$this->assertContains('Bad string syntax to evaluate', $result);
// Case with param onlysimplestring = 1
$result=dol_eval('1 && $conf->abc->doesnotexist1 && $conf->def->doesnotexist1', 1, 0); // Should return false and not a 'Bad string syntax to evaluate ...'
print "result = ".$result."\n";
$this->assertFalse($result);
$result=dol_eval("(\$a.'aa')", 1, 0);
print "result = ".$result."\n";
$this->assertContains('Bad string syntax to evaluate', $result);
}
}