mirror of
https://github.com/Dolibarr/dolibarr.git
synced 2026-02-07 16:41:48 +01:00
Merge branch 'develop' into develop
This commit is contained in:
Laurent Destailleur
committed by
Laurent Destailleur (aka Eldy)
Laurent Destailleur (aka Eldy)
commit
35c638cba7
2
.github/CONTRIBUTING.md
vendored
2
.github/CONTRIBUTING.md
vendored
@@ -36,7 +36,7 @@ Definition:
|
||||
|
||||
As the Developer:
|
||||
|
||||
1. Check you agree with the terms of the [DCO - Developer's Certificate of Origin](https://github.com/Dolibarr/dolibarr/DCO)
|
||||
1. Check you agree with the terms of the [DCO - Developer's Certificate of Origin](https://github.com/Dolibarr/dolibarr/blob/develop/DCO)
|
||||
2. [Fork](https://help.github.com/articles/fork-a-repo) the [GitHub repository](https://github.com/Dolibarr/dolibarr).
|
||||
3. Clone your fork.
|
||||
4. Choose a branch(See the [Branches](#branches) section below).
|
||||
|
||||
@@ -16908,18 +16908,6 @@ parameters:
|
||||
count: 1
|
||||
path: ../../htdocs/core/tpl/objectline_view.tpl.php
|
||||
|
||||
-
|
||||
message: '#^Variable \$action might not be defined\.$#'
|
||||
identifier: variable.undefined
|
||||
count: 2
|
||||
path: ../../htdocs/core/tpl/objectline_view.tpl.php
|
||||
|
||||
-
|
||||
message: '#^Variable \$i might not be defined\.$#'
|
||||
identifier: variable.undefined
|
||||
count: 5
|
||||
path: ../../htdocs/core/tpl/objectline_view.tpl.php
|
||||
|
||||
-
|
||||
message: '#^Variable \$objp might not be defined\.$#'
|
||||
identifier: variable.undefined
|
||||
|
||||
@@ -1351,7 +1351,7 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action)) {
|
||||
|
||||
// EMail
|
||||
print '<tr><td>'.(getDolGlobalString("ADHERENT_MAIL_REQUIRED") ? '<span class="fieldrequired">' : '').$langs->trans("EMail").(getDolGlobalString("ADHERENT_MAIL_REQUIRED") ? '</span>' : '').'</td>';
|
||||
print '<td>'.img_picto('', 'object_email', 'class="pictofixedwidth"').'<input type="text" name="member_email" class="minwidth300" maxlength="255" value="'.(GETPOSTISSET("member_email") ? GETPOST("member_email", '', 2) : $object->email).'"></td></tr>';
|
||||
print '<td>'.img_picto('', 'object_email', 'class="pictofixedwidth"').'<input type="text" name="member_email" class="minwidth300" maxlength="255" value="'.(GETPOSTISSET("member_email") ? GETPOST("member_email", 'alphanohtml', 2) : $object->email).'"></td></tr>';
|
||||
|
||||
// Website
|
||||
print '<tr><td>'.$form->editfieldkey('Web', 'member_url', GETPOST('member_url', 'alpha'), $object, 0).'</td>';
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
* Copyright (C) 2011 Remy Younes <ryounes@gmail.com>
|
||||
* Copyright (C) 2012-2015 Marcos García <marcosgdf@gmail.com>
|
||||
* Copyright (C) 2012 Christophe Battarel <christophe.battarel@ltairis.fr>
|
||||
* Copyright (C) 2011-2023 Alexandre Spangaro <aspangaro@open-dsi.fr>
|
||||
* Copyright (C) 2011-2024 Alexandre Spangaro <alexandre@inovea-conseil.com>
|
||||
* Copyright (C) 2015 Ferran Marcet <fmarcet@2byte.es>
|
||||
* Copyright (C) 2016 Raphaël Doursenaud <rdoursenaud@gpcsolutions.fr>
|
||||
* Copyright (C) 2019-2024 Frédéric France <frederic.france@free.fr>
|
||||
@@ -723,10 +723,8 @@ if ($id == DICT_TYPE_CONTACT) {
|
||||
'supplier_proposal' => img_picto('', 'supplier_proposal', 'class="pictofixedwidth"').$langs->trans('SupplierProposal'),
|
||||
'order_supplier' => img_picto('', 'supplier_order', 'class="pictofixedwidth"').$langs->trans('SupplierOrder'),
|
||||
'invoice_supplier' => img_picto('', 'supplier_invoice', 'class="pictofixedwidth"').$langs->trans('SupplierBill'),
|
||||
'conferenceorbooth' => img_picto('', 'eventorganization', 'class="pictofixedwidth"').$langs->trans('ConferenceOrBooth'),
|
||||
);
|
||||
if (getDolGlobalString('MAIN_FEATURES_LEVEL') && getDolGlobalInt('MAIN_FEATURES_LEVEL') >= 2) {
|
||||
$elementList['conferenceorbooth'] = img_picto('', 'eventorganization', 'class="pictofixedwidth"').$langs->trans('ConferenceOrBooth');
|
||||
}
|
||||
|
||||
complete_elementList_with_modules($elementList);
|
||||
|
||||
|
||||
@@ -10524,7 +10524,7 @@ function verifCond($strToEvaluate, $onlysimplestring = '1')
|
||||
* @param int<0,1> $hideerrors 1=Hide errors
|
||||
* @param string $onlysimplestring '0' (deprecated, do not use it anymore)=Accept all chars,
|
||||
* '1' (most common use)=Accept only simple string with char 'a-z0-9\s^$_+-.*>&|=!?():"\',/@';',
|
||||
* '2' (used for example for the compute property of extrafields)=Accept also '[]'
|
||||
* '2' (used for example for the compute property of extrafields)=Accept also '<[]'
|
||||
* @return void|string Nothing or return result of eval (even if type can be int, it is safer to assume string and find all potential typing issues as abs(dol_eval(...)).
|
||||
* @see verifCond(), checkPHPCode() to see sanitizing rules that should be very close.
|
||||
* @phan-suppress PhanPluginUnsafeEval
|
||||
@@ -10552,21 +10552,31 @@ function dol_eval($s, $returnvalue = 1, $hideerrors = 1, $onlysimplestring = '1'
|
||||
if ($onlysimplestring == '1' || $onlysimplestring == '2') {
|
||||
// We must accept with 1: '1 && getDolGlobalInt("doesnotexist1") && getDolGlobalString("MAIN_FEATURES_LEVEL")'
|
||||
// We must accept with 1: '$user->hasRight("cabinetmed", "read") && !$object->canvas=="patient@cabinetmed"'
|
||||
// We must accept with 2: (($reloadedobj = new Task($db)) && ($reloadedobj->fetchNoCompute($object->id) > 0) && ($secondloadedobj = new Project($db)) && ($secondloadedobj->fetchNoCompute($reloadedobj->fk_project) > 0)) ? $secondloadedobj->ref : "Parent project not found"
|
||||
// We must accept with 2: (($reloadedobj = new Task($db)) && ($reloadedobj->fetchNoCompute($object->id) <= 99) && ($secondloadedobj = new Project($db)) && ($secondloadedobj->fetchNoCompute($reloadedobj->fk_project) > 0)) ? $secondloadedobj->ref : "Parent project not found"
|
||||
|
||||
// Check if there is dynamic call (first we check chars are all into use a whitelist chars)
|
||||
// Check if there is dynamic call (first we check chars are all into a whitelist chars)
|
||||
$specialcharsallowed = '^$_+-.*>&|=!?():"\',/@';
|
||||
if ($onlysimplestring == '2') {
|
||||
$specialcharsallowed .= '[]';
|
||||
$specialcharsallowed .= '<[]';
|
||||
}
|
||||
if (getDolGlobalString('MAIN_ALLOW_UNSECURED_SPECIAL_CHARS_IN_DOL_EVAL')) {
|
||||
$specialcharsallowed .= getDolGlobalString('MAIN_ALLOW_UNSECURED_SPECIAL_CHARS_IN_DOL_EVAL');
|
||||
}
|
||||
if (preg_match('/[^a-z0-9\s'.preg_quote($specialcharsallowed, '/').']/i', $s)) {
|
||||
if ($returnvalue) {
|
||||
return 'Bad string syntax to evaluate (found chars that are not chars for a simple clean eval string): '.$s;
|
||||
return 'Bad string syntax to evaluate (found chars that are not chars for a simple one line clean eval string): '.$s;
|
||||
} else {
|
||||
dol_syslog('Bad string syntax to evaluate (found chars that are not chars for a simple clean eval string): '.$s, LOG_WARNING);
|
||||
dol_syslog('Bad string syntax to evaluate (found chars that are not chars for a simple one line clean eval string): '.$s, LOG_WARNING);
|
||||
return '';
|
||||
}
|
||||
}
|
||||
|
||||
// Check if there is a < or <= without spaces before/after
|
||||
if (preg_match('/<=?[^\s]/', $s)) {
|
||||
if ($returnvalue) {
|
||||
return 'Bad string syntax to evaluate (mode '.$onlysimplestring.', found a < or <= without space before and after): '.$s;
|
||||
} else {
|
||||
dol_syslog('Bad string syntax to evaluate (mode '.$onlysimplestring.', found a < or <= without space before and after): '.$s, LOG_WARNING);
|
||||
return '';
|
||||
}
|
||||
}
|
||||
@@ -10581,15 +10591,17 @@ function dol_eval($s, $returnvalue = 1, $hideerrors = 1, $onlysimplestring = '1'
|
||||
}
|
||||
}
|
||||
|
||||
// Now we check if we try dynamic call (by removing white list pattern of using parenthesis then testing if a parenthesis exists)
|
||||
// Now we check if we try dynamic call
|
||||
// First we remove white list pattern of using parenthesis then testing if one open parenthesis exists
|
||||
$savescheck = '';
|
||||
$scheck = $s;
|
||||
while ($scheck && $savescheck != $scheck) {
|
||||
$savescheck = $scheck;
|
||||
$scheck = preg_replace('/->[a-zA-Z0-9_]+\(/', '->__METHOD__', $scheck); // accept parenthesis in '...->method(...'
|
||||
$scheck = preg_replace('/::[a-zA-Z0-9_]+\(/', '->__METHOD__', $scheck); // accept parenthesis in '...::method(...'
|
||||
$scheck = preg_replace('/^\(/', '__PARENTHESIS__ ', $scheck); // accept parenthesis in '(...'. Must replace with __PARENTHESIS__ with a space after to allow following substitutions
|
||||
$scheck = preg_replace('/\s\(/', '__PARENTHESIS__ ', $scheck); // accept parenthesis in '... (' like in 'if ($a == 1)'. Must replace with __PARENTHESIS__ with a space after to allow following substitutions
|
||||
$scheck = preg_replace('/^\(+/', '__PARENTHESIS__ ', $scheck); // accept parenthesis in '(...'. Must replace with "__PARENTHESIS__ with a space after "to allow following substitutions
|
||||
$scheck = preg_replace('/\&\&\s+\(/', '__ANDPARENTHESIS__ ', $scheck); // accept parenthesis in '... (' like in '&& (...'. Must replace with "__PARENTHESIS__ with a space after" to allow following substitutions
|
||||
$scheck = preg_replace('/\|\|\s+\(/', '__ORPARENTHESIS__ ', $scheck); // accept parenthesis in '... (' like in '|| (...'. Must replace with "__PARENTHESIS__ with a space after" to allow following substitutions
|
||||
$scheck = preg_replace('/^!?[a-zA-Z0-9_]+\(/', '__FUNCTION__', $scheck); // accept parenthesis in 'function(' and '!function('
|
||||
$scheck = preg_replace('/\s!?[a-zA-Z0-9_]+\(/', '__FUNCTION__', $scheck); // accept parenthesis in '... function(' and '... !function('
|
||||
$scheck = preg_replace('/^!\(/', '__NOTANDPARENTHESIS__', $scheck); // accept parenthesis in '!('
|
||||
@@ -10598,6 +10610,7 @@ function dol_eval($s, $returnvalue = 1, $hideerrors = 1, $onlysimplestring = '1'
|
||||
}
|
||||
//print 'scheck='.$scheck." : ".strpos($scheck, '(')."<br>\n";
|
||||
|
||||
// Now test if it remains 1 one parenthesis.
|
||||
if (strpos($scheck, '(') !== false) {
|
||||
if ($returnvalue) {
|
||||
return 'Bad string syntax to evaluate (mode '.$onlysimplestring.', found call of a function or method without using the direct name of the function): '.$s;
|
||||
|
||||
@@ -720,10 +720,19 @@ function checkPHPCode(&$phpfullcodestringold, &$phpfullcodestring)
|
||||
}
|
||||
}
|
||||
|
||||
$phpfullcodestringnew = $phpfullcodestring;
|
||||
|
||||
// Then check forbidden commands
|
||||
if (!$error) {
|
||||
$forbiddenphpstrings = array('$$', '$_', '}[');
|
||||
//$forbiddenphpstrings = array_merge($forbiddenphpstrings, array('_ENV', '_SESSION', '_COOKIE', '_GET', '_POST', '_REQUEST', 'ReflectionFunction'));
|
||||
if (getDolGlobalString("WEBSITE_DISALLOW_DOLLAR_UNDERSCORE")) {
|
||||
$phpfullcodestring = preg_replace('/\$_COOKIE\[/', '__DOLLARCOOKIE__', $phpfullcodestring);
|
||||
$phpfullcodestring = preg_replace('/\$_FILES\[/', '__DOLLARFILES__', $phpfullcodestring);
|
||||
$phpfullcodestring = preg_replace('/\$_SESSION\[/', '__DOLLARSESSION__', $phpfullcodestring);
|
||||
$forbiddenphpstrings = array('$$', '$_', '}[');
|
||||
} else {
|
||||
$forbiddenphpstrings = array('$$', '}[');
|
||||
}
|
||||
//$forbiddenphpstrings = array_merge($forbiddenphpstrings, array('_ENV', '_FILES', '_SESSION', '_COOKIE', '_GET', '_POST', '_REQUEST', 'ReflectionFunction'));
|
||||
$forbiddenphpstrings = array_merge($forbiddenphpstrings, array('_ENV', 'ReflectionFunction'));
|
||||
|
||||
$forbiddenphpfunctions = array();
|
||||
@@ -818,8 +827,8 @@ function checkPHPCode(&$phpfullcodestringold, &$phpfullcodestring)
|
||||
|
||||
// No need to block $conf->global->aaa() because PHP try to run the method aaa of $conf->global and not the function into $conf->global->aaa.
|
||||
|
||||
// Then check if installmodules does not block dynamic PHP code change.
|
||||
if ($phpfullcodestringold != $phpfullcodestring) {
|
||||
// Then check if installmodules.lock does not block dynamic PHP code change.
|
||||
if ($phpfullcodestringold != $phpfullcodestringnew) {
|
||||
if (!$error) {
|
||||
$dolibarrdataroot = preg_replace('/([\\/]+)$/i', '', DOL_DATA_ROOT);
|
||||
$allowimportsite = true;
|
||||
|
||||
@@ -1317,7 +1317,7 @@ if (!empty($usemargins) && $user->hasRight('margins', 'creer')) {
|
||||
|
||||
jQuery("#select_type").val(-1);
|
||||
jQuery("#select_type").addClass("placeholder");
|
||||
jQuery("#select_type").trigger("change");
|
||||
/* jQuery("#select_type").trigger("change"); // Disabled. This create troubles. Never mind if the rester of combo is not done when using an ajax select_type combo. We don't use it because we are not able to call a focus on a change event of this combo. */
|
||||
|
||||
jQuery("#prod_entry_mode_free").prop('checked',false).change();
|
||||
jQuery("#prod_entry_mode_predef").prop('checked',true).change();
|
||||
|
||||
@@ -52,6 +52,8 @@
|
||||
* @var Translate $langs
|
||||
* @var User $user
|
||||
*
|
||||
* @var string $action
|
||||
* @var int $i
|
||||
* @var 0|1 $forceall
|
||||
* @var int $num
|
||||
* @var 0|1 $senderissupplier
|
||||
|
||||
@@ -129,7 +129,7 @@ $original_file = GETPOST('file', 'alphanohtml');
|
||||
$hashp = GETPOST('hashp', 'aZ09');
|
||||
$modulepart = GETPOST('modulepart', 'alpha');
|
||||
$urlsource = GETPOST('urlsource', 'alpha');
|
||||
$entity = GETPOSTINT('entity') ? GETPOSTINT('entity') : $conf->entity;
|
||||
$entity = GETPOSTINT('entity');
|
||||
|
||||
// Security check
|
||||
if (empty($modulepart) && empty($hashp)) {
|
||||
|
||||
@@ -125,4 +125,4 @@ insert into llx_c_type_contact (element, source, code, libelle, active ) values
|
||||
insert into llx_c_type_contact (element, source, code, libelle, active ) values ('conferenceorbooth', 'external', 'RESPONSIBLE', 'Booth responsible', 1);
|
||||
|
||||
-- Thirdparty
|
||||
insert into llx_c_type_contact (element, source, code, libelle, active ) values ('societe', 'internal', 'SALESREPTHIRD', 'Sales Representative', 1);
|
||||
insert into llx_c_type_contact (element, source, code, libelle, active ) values ('societe', 'external', 'SALESREPTHIRD', 'Sales Representative', 1);
|
||||
|
||||
23
htdocs/install/pgsql/functions/functions-bom.sql
Normal file
23
htdocs/install/pgsql/functions/functions-bom.sql
Normal file
@@ -0,0 +1,23 @@
|
||||
-- ============================================================================
|
||||
-- Copyright (C) 2024 Laurent Destailleur <eldy@users.sourceforge.net>
|
||||
--
|
||||
-- This program is free software; you can redistribute it and/or modify
|
||||
-- it under the terms of the GNU General Public License as published by
|
||||
-- the Free Software Foundation; either version 3 of the License, or
|
||||
-- (at your option) any later version.
|
||||
--
|
||||
-- This program is distributed in the hope that it will be useful,
|
||||
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
-- GNU General Public License for more details.
|
||||
--
|
||||
-- You should have received a copy of the GNU General Public License
|
||||
-- along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
--
|
||||
-- ============================================================================
|
||||
|
||||
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_bom_bom FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_bom_bom_extrafields FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_bom_bomline FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_bom_bomline_extrafields FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
23
htdocs/install/pgsql/functions/functions-mo.sql
Normal file
23
htdocs/install/pgsql/functions/functions-mo.sql
Normal file
@@ -0,0 +1,23 @@
|
||||
-- ============================================================================
|
||||
-- Copyright (C) 2024 Laurent Destailleur <eldy@users.sourceforge.net>
|
||||
--
|
||||
-- This program is free software; you can redistribute it and/or modify
|
||||
-- it under the terms of the GNU General Public License as published by
|
||||
-- the Free Software Foundation; either version 3 of the License, or
|
||||
-- (at your option) any later version.
|
||||
--
|
||||
-- This program is distributed in the hope that it will be useful,
|
||||
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
-- GNU General Public License for more details.
|
||||
--
|
||||
-- You should have received a copy of the GNU General Public License
|
||||
-- along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
--
|
||||
-- ============================================================================
|
||||
|
||||
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_mrp_mo FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_mrp_mo_extrafields FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_mrp_production FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_mrp_production_extrafields FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
@@ -75,10 +75,6 @@ CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_bank_account FOR EAC
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_bank_account_extrafields FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_blockedlog FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_blockedlog_authority FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_bom_bom FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_bom_bom_extrafields FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_bom_bomline FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_bom_bomline_extrafields FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_bordereau_cheque FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_boxes_def FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_c_email_templates FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
@@ -127,10 +123,6 @@ CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_fichinterdet_extrafi
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_delivery FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_localtax FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_menu FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_mrp_mo FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_mrp_mo_extrafields FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_mrp_production FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_mrp_production_extrafields FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_notify FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_notify_def FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
CREATE TRIGGER update_customer_modtime BEFORE UPDATE ON llx_paiement FOR EACH ROW EXECUTE PROCEDURE update_modified_column_tms();
|
||||
|
||||
@@ -33,8 +33,8 @@ CountryIsInEEC=Country is inside the European Economic Community
|
||||
PriceFormatInCurrentLanguage=Price display format in the current language and currency
|
||||
ThirdPartyName=Third-party name
|
||||
ThirdPartyEmail=Third-party email
|
||||
ThirdParty=Third-party
|
||||
ThirdParties=Third-parties
|
||||
ThirdParty=Third party
|
||||
ThirdParties=Third parties
|
||||
ThirdPartyProspects=Prospects
|
||||
ThirdPartyProspectsStats=Prospects
|
||||
ThirdPartyCustomers=Customers
|
||||
|
||||
@@ -1155,6 +1155,7 @@ ContactDefault_project_task=Task
|
||||
ContactDefault_propal=Proposal
|
||||
ContactDefault_supplier_proposal=Supplier Proposal
|
||||
ContactDefault_ticket=Ticket
|
||||
ContactDefault_societe=Third party
|
||||
ContactAddedAutomatically=Contact added from third-party contact roles
|
||||
More=More
|
||||
ShowDetails=Show details
|
||||
|
||||
@@ -119,7 +119,7 @@ $search_accountancy_code_buy_intra = GETPOST("search_accountancy_code_buy_intra"
|
||||
$search_accountancy_code_buy_export = GETPOST("search_accountancy_code_buy_export", 'alpha');
|
||||
$search_import_key = GETPOST("search_import_key", 'alpha');
|
||||
$search_finished = GETPOST("search_finished");
|
||||
$search_units = GETPOST('search_units', 'alpha');
|
||||
$search_units = GETPOST('search_units', 'int');
|
||||
$type = GETPOST("type", 'alpha');
|
||||
|
||||
// Show/hide child product variants
|
||||
|
||||
@@ -1324,10 +1324,11 @@ foreach ($listofreferent as $key => $value) {
|
||||
print "</td>\n";
|
||||
|
||||
// Ref
|
||||
print '<td class="left nowraponall tdoverflowmax250">';
|
||||
print '<td class="left nowraponall">';
|
||||
if ($tablename == 'expensereport_det') {
|
||||
print $expensereport->getNomUrl(1);
|
||||
} else {
|
||||
print '<table><tr><td style="border-bottom: none;">';
|
||||
// Show ref with link
|
||||
if ($element instanceof Task) {
|
||||
print $element->getNomUrl(1, 'withproject', 'time');
|
||||
@@ -1363,6 +1364,10 @@ foreach ($listofreferent as $key => $value) {
|
||||
}
|
||||
print '</div>';
|
||||
|
||||
print '</td>';
|
||||
|
||||
print '<td class="tdoverflowmax250" style="border-bottom: none;">';
|
||||
|
||||
// Show supplier ref
|
||||
if (!empty($element->ref_supplier)) {
|
||||
print ' - '.$element->ref_supplier;
|
||||
@@ -1375,6 +1380,8 @@ foreach ($listofreferent as $key => $value) {
|
||||
if (empty($element->ref_customer) && !empty($element->ref_client)) {
|
||||
print ' - '.$element->ref_client;
|
||||
}
|
||||
|
||||
print '</td></tr></table>';
|
||||
}
|
||||
print "</td>\n";
|
||||
// Product and qty on stock movement
|
||||
|
||||
@@ -256,12 +256,12 @@ foreach ($object->fields as $key => $val) {
|
||||
include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_array_fields.tpl.php';
|
||||
|
||||
// Add non object fields to fields for list
|
||||
$arrayfields['s.nom'] = array('label' => $langs->trans("ThirdParty"), 'checked' => 1, 'position' => 21, 'enabled' => (!isModEnabled('societe') ? 0 : 1));
|
||||
$arrayfields['s.nom'] = array('label' => "ThirdParty", 'checked' => 1, 'position' => 21, 'enabled' => (!isModEnabled('societe') ? 0 : 1));
|
||||
$arrayfields['s.name_alias'] = array('label' => "AliasNameShort", 'checked' => 0, 'position' => 22);
|
||||
$arrayfields['co.country_code'] = array('label' => "Country", 'checked' => -1, 'position' => 23);
|
||||
$arrayfields['commercial'] = array('label' => $langs->trans("SaleRepresentativesOfThirdParty"), 'checked' => 0, 'position' => 25);
|
||||
$arrayfields['c.assigned'] = array('label' => $langs->trans("AssignedTo"), 'checked' => 1, 'position' => 120);
|
||||
$arrayfields['opp_weighted_amount'] = array('label' => $langs->trans('OpportunityWeightedAmountShort'), 'checked' => 0, 'enabled' => (!getDolGlobalString('PROJECT_USE_OPPORTUNITIES') ? 0 : 1), 'position' => 106);
|
||||
$arrayfields['commercial'] = array('label' => "SaleRepresentativesOfThirdParty", 'checked' => 0, 'position' => 25);
|
||||
$arrayfields['c.assigned'] = array('label' => "AssignedTo", 'checked' => 1, 'position' => 120);
|
||||
$arrayfields['opp_weighted_amount'] = array('label' => 'OpportunityWeightedAmountShort', 'checked' => 0, 'enabled' => (!getDolGlobalString('PROJECT_USE_OPPORTUNITIES') ? 0 : 1), 'position' => 106);
|
||||
$arrayfields['u.login'] = array('label' => "Author", 'checked' => -1, 'position' => 165);
|
||||
// Force some fields according to search_usage filter...
|
||||
if (GETPOST('search_usage_opportunity')) {
|
||||
|
||||
@@ -623,54 +623,83 @@ class SecurityTest extends CommonClassTest
|
||||
$s = '(($reloadedobj = new Task($db)) && ($reloadedobj->fetchNoCompute($object->id) > 0) && ($secondloadedobj = new Project($db)) && ($secondloadedobj->fetchNoCompute($reloadedobj->fk_project) > 0)) ? $secondloadedobj->ref : \'Parent project not found\'';
|
||||
$result = (string) dol_eval($s, 1, 1, '2');
|
||||
print "result4 = ".$result."\n";
|
||||
$this->assertEquals('Parent project not found', $result);
|
||||
$this->assertEquals('Parent project not found', $result, 'Test 4');
|
||||
|
||||
$s = '4 < 5';
|
||||
$result = (string) dol_eval($s, 1, 1, '2');
|
||||
print "result5 = ".$result."\n";
|
||||
$this->assertEquals('1', $result, 'Test 5');
|
||||
|
||||
|
||||
/* not allowed. Not a one line eval string
|
||||
$result = (string) dol_eval('if ($a == 1) { }', 1, 1);
|
||||
print "result4b = ".$result."\n";
|
||||
$this->assertEquals('aaa', $result);
|
||||
*/
|
||||
|
||||
// Now string not allowed
|
||||
|
||||
$s = '4 <5';
|
||||
$result = (string) dol_eval($s, 1, 1, '2'); // in mode 2, char < is allowed only if followed by a space
|
||||
print "result = ".$result."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'Test 4 <5 - The string was not detected as evil');
|
||||
|
||||
$s = '4 < 5';
|
||||
$result = (string) dol_eval($s, 1, 1, '1'); // in mode 1, char < is always forbidden
|
||||
print "result = ".$result."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'Test 4 < 5 - The string was not detected as evil');
|
||||
|
||||
$s = 'new abc->invoke(\'whoami\')';
|
||||
$result = (string) dol_eval($s, 1, 1, '2');
|
||||
print "result = ".$result."\n";
|
||||
$this->assertEquals('Bad string syntax to evaluate: new abc__forbiddenstring__(\'whoami\')', $result);
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'The string was not detected as evil');
|
||||
|
||||
$s = 'new ReflectionFunction(\'abc\')';
|
||||
$result = (string) dol_eval($s, 1, 1, '2');
|
||||
print "result = ".$result."\n";
|
||||
$this->assertEquals('Bad string syntax to evaluate: new __forbiddenstring__(\'abc\')', $result);
|
||||
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'The string was not detected as evil');
|
||||
|
||||
$result = dol_eval('$a=function() { }; $a', 1, 1, '0'); // result of dol_eval may be an object Closure
|
||||
print "result5 = ".json_encode($result)."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', json_encode($result));
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', json_encode($result), 'The string was not detected as evil');
|
||||
|
||||
$result = dol_eval('$a=function() { }; $a();', 1, 1, '1');
|
||||
print "result6 = ".json_encode($result)."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', json_encode($result));
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', json_encode($result), 'The string was not detected as evil');
|
||||
|
||||
$result = (string) dol_eval('$a=exec("ls");', 1, 1);
|
||||
print "result7 = ".$result."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result);
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'The string was not detected as evil');
|
||||
|
||||
$result = (string) dol_eval('$a=exec ("ls")', 1, 1);
|
||||
print "result8 = ".$result."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result);
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'The string was not detected as evil');
|
||||
|
||||
$result = (string) dol_eval("strrev('metsys') ('whoami')", 1, 1);
|
||||
print "result8b = ".$result."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'The string was not detected as evil');
|
||||
|
||||
$result = (string) dol_eval('$a="test"; $$a;', 1, 0);
|
||||
print "result9 = ".$result."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result);
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'The string was not detected as evil');
|
||||
|
||||
$result = (string) dol_eval('`ls`', 1, 0);
|
||||
print "result10 = ".$result."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result);
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'The string was not detected as evil');
|
||||
|
||||
$result = (string) dol_eval("('ex'.'ec')('echo abc')", 1, 0);
|
||||
print "result11 = ".$result."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result);
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'The string was not detected as evil');
|
||||
|
||||
$result = (string) dol_eval("sprintf(\"%s%s\", \"ex\", \"ec\")('echo abc')", 1, 0);
|
||||
print "result12 = ".$result."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result);
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'The string was not detected as evil');
|
||||
|
||||
$result = dol_eval("90402.38+267678+0", 1, 1, 1);
|
||||
print "result13 = ".$result."\n";
|
||||
$this->assertEquals('358080.38', $result);
|
||||
$this->assertEquals('358080.38', $result, 'The string was not detected as evil');
|
||||
|
||||
// Must be allowed
|
||||
|
||||
global $leftmenu; // Used into strings to eval
|
||||
|
||||
@@ -706,28 +735,29 @@ class SecurityTest extends CommonClassTest
|
||||
print "result18 = ".$result."\n";
|
||||
$this->assertFalse($result);
|
||||
|
||||
// Not allowed
|
||||
|
||||
$a = 'ab';
|
||||
$result = (string) dol_eval("(\$a.'s')", 1, 0);
|
||||
print "result19 = ".$result."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'Test 19');
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'Test 19 - The string was not detected as evil');
|
||||
|
||||
$leftmenu = 'abs';
|
||||
$result = (string) dol_eval('$leftmenu(-5)', 1, 0);
|
||||
print "result20 = ".$result."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'Test 20');
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'Test 20 - The string was not detected as evil');
|
||||
|
||||
$result = (string) dol_eval('str_replace("z","e","zxzc")("whoami");', 1, 0);
|
||||
print "result21 = ".$result."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'Test 21');
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'Test 21 - The string was not detected as evil');
|
||||
|
||||
$result = (string) dol_eval('($a = "ex") && ($b = "ec") && ($cmd = "$a$b") && $cmd ("curl localhost:5555")', 1, 0);
|
||||
print "result22 = ".$result."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'Test 22');
|
||||
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'Test 22 - The string was not detected as evil');
|
||||
|
||||
$result = (string) dol_eval('\'exec\'("aaa")', 1, 0);
|
||||
print "result1 = ".$result."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', json_encode($result), 'Cant find the string Bad string syntaxwhen i should');
|
||||
print "result23 = ".$result."\n";
|
||||
$this->assertStringContainsString('Bad string syntax to evaluate', json_encode($result), 'Test 23 - The string was not detected as evil - Can\'t find the string Bad string syntax when i should');
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@@ -145,6 +145,12 @@ class WebsiteTest extends CommonClassTest
|
||||
print __METHOD__." result checkPHPCode=".$result."\n";
|
||||
$this->assertEquals($result, 0, 'checkPHPCode detect string as dangerous when it is legitimate');
|
||||
|
||||
$t = '';
|
||||
$s = '<?php echo $_SESSION["eee"] ?>';
|
||||
$result = checkPHPCode($t, $s);
|
||||
print __METHOD__." result checkPHPCode=".$result."\n";
|
||||
$this->assertEquals($result, 0, 'checkPHPCode detect string as dangerous when it is legitimate');
|
||||
|
||||
|
||||
// Dangerous
|
||||
|
||||
|
||||
Reference in New Issue
Block a user