Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-12-08 02:28:23 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add protection on upload if file already exists

Browse Source
This commit is contained in:
Laurent Destailleur
2008-05-04 15:19:02 +00:00
parent 37bae6699e
commit 3ab531f65f
21 changed files with 113 additions and 151 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/adherents/fiche.php
View File

@@ -176,7 +176,7 @@ if ($_REQUEST["action"] == 'update' && ! $_POST["cancel"])
if (is_dir($conf->adherent->dir_output))
{
$newfile=$conf->adherent->dir_output . "/" . $adh->id . ".jpg";
if (! dol_move_uploaded_file($_FILES['photo']['tmp_name'],$newfile))
if (! dol_move_uploaded_file($_FILES['photo']['tmp_name'],$newfile,1) > 0)
{
$message .= '<div class="error">'.$langs->trans("ErrorFailedToSaveFile").'</div>';
}

2
htdocs/admin/company.php
View File

@@ -65,7 +65,7 @@ if ( (isset($_POST["action"]) && $_POST["action"] == 'update')
{
create_exdir($conf->societe->dir_logos);
}
if (dol_move_uploaded_file($_FILES["logo"]["tmp_name"],$conf->societe->dir_logos.'/'.$original_file))
if (dol_move_uploaded_file($_FILES["logo"]["tmp_name"],$conf->societe->dir_logos.'/'.$original_file,1) > 0)
{
dolibarr_set_const($db, "MAIN_INFO_SOCIETE_LOGO",$original_file);

2
htdocs/admin/import/import.php
View File

@@ -65,7 +65,7 @@ if ( $_POST["sendit"] && $conf->upload != 0)
{
$imp = new DolibarrImport($db);
$imp->CreateBackupDir();
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $imp->upload_dir . "/" . $_FILES['userfile']['name']))
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $imp->upload_dir . "/" . $_FILES['userfile']['name'],1) > 0)
{
$imp->ImportClients($imp->upload_dir . "/" . $_FILES['userfile']['name']);

2
htdocs/comm/action/document.php
View File

@@ -75,7 +75,7 @@ if ( $_POST["sendit"] && $conf->upload )
if (is_dir($upload_dir))
{
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0) > 0)
{
$mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
//print_r($_FILES);

2
htdocs/comm/propal/document.php
View File

@@ -77,7 +77,7 @@ if ($_POST["sendit"] && $conf->upload)
if (is_dir($upload_dir))
{
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0) > 0)
{
$mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
//print_r($_FILES);

2
htdocs/commande/document.php
View File

@@ -79,7 +79,7 @@ if ($_POST["sendit"] && $conf->upload)
if (is_dir($upload_dir))
{
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0) > 0)
{
$mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
//print_r($_FILES);

2
htdocs/compta/facture/document.php
View File

@@ -79,7 +79,7 @@ if ($_POST["sendit"] && $conf->upload)
if (is_dir($upload_dir))
{
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0) > 0)
{
$mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
//print_r($_FILES);

7
htdocs/compta/prelevement/fiche.php
View File

@@ -57,19 +57,20 @@ if ($_POST["action"] == 'infotrans')
{
$dir = $conf->prelevement->dir_output.'/bon/';
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $dir . "/" . $_FILES['userfile']['name']))
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $dir . "/" . $_FILES['userfile']['name'],1) > 0)
{
$dt = mktime(12,0,0,$_POST["remonth"],$_POST["reday"],$_POST["reyear"]);
$dt = dolibarr_mktime(12,0,0,$_POST["remonth"],$_POST["reday"],$_POST["reyear"]);
$bon->set_infotrans($user, $dt, $_POST["methode"]);
}
}
else
{
dolibarr_syslog("Fichier invalide",LOG_WARN);
dolibarr_syslog("Fichier invalide",LOG_WARNING);
}
Header("Location: fiche.php?id=".$_GET["id"]);
exit;
}
if ($_POST["action"] == 'infocredit')

2
htdocs/contrat/document.php
View File

@@ -80,7 +80,7 @@ if ($_POST["sendit"] && $conf->upload)
if (is_dir($upload_dir))
{
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0) > 0)
{
$mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
//print_r($_FILES);

6
htdocs/ecm/docmine.php
View File

@@ -94,14 +94,14 @@ if ( $_POST["sendit"] && $conf->upload != 0)
if (is_dir($upload_dir))
{
$result = dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']);
if ($result == 1)
$result = dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0);
if ($result > 0)
{
//$mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
//print_r($_FILES);
$result=$ecmdir->changeNbOfFiles('+');
}
else if (!$result)
else if ($result < 0)
{
// Echec transfert (fichier depassant la limite ?)
$mesg = '<div class="error">'.$langs->trans("ErrorFileNotUploaded").'</div>';

6
htdocs/ecm/docother.php
View File

@@ -50,13 +50,13 @@ if ( $_POST["sendit"] && $conf->upload != 0)
if (is_dir($upload_dir))
{
$result = dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']);
if ($result == 1)
$result = dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0);
if ($result > 0)
{
$mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
//print_r($_FILES);
}
else if (!$result)
else if ($result < 0)
{
// Echec transfert (fichier d?passant la limite ?)
$mesg = '<div class="error">'.$langs->trans("ErrorFileNotUploaded").'</div>';

2
htdocs/fourn/facture/document.php
View File

@@ -82,7 +82,7 @@ if ($_POST['sendit'] && $conf->upload)
if (is_dir($upload_dir))
{
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . '/' . $_FILES['userfile']['name']))
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . '/' . $_FILES['userfile']['name'],0) > 0)
{
$mesg = '<div class="ok">'.$langs->trans('FileTransferComplete').'</div>';
//print_r($_FILES);

45
htdocs/lib/functions.lib.php
View File

@@ -1526,17 +1526,19 @@ function dolibarr_print_error($db='',$error='')
/**
\brief Deplacer les fichiers telecharg<72>s, apres quelques controles divers
\param src_file fichier source
\param dest_file fichier de destination
\return int true=Deplacement OK, false=Pas de deplacement ou KO
* \brief Deplacer les fichiers telecharg<72>s, apres quelques controles divers
* \param src_file Source filename
* \param dest_file Target filename
* \param allowoverwrite Overwrite if exists
* \return int >0 if OK, <0 if KO, Name of virus if virus found
*/
function dol_move_uploaded_file($src_file, $dest_file)
function dol_move_uploaded_file($src_file, $dest_file, $allowoverwrite)
{
global $conf;
$file_name = $dest_file;
// If we need to make a virus scan
if ($conf->global->MAIN_USE_AVSCAN)
{
$malware = dol_avscan_file($src_file);
@@ -1544,21 +1546,21 @@ function dol_move_uploaded_file($src_file, $dest_file)
}
// Security:
// On renomme les fichiers avec extention executable car si on a mis le rep
// On renomme les fichiers avec extention script web car si on a mis le rep
// documents dans un rep de la racine web (pas bien), cela permet d'executer
// du code a la demande.
if (eregi('\.htm|\.html|\.php|\.pl|\.cgi$',$file_name))
{
$file_name.= '.txt';
$file_name.= '.noexe';
}
// Security:
// On interdit les remont<6E>es de repertoire ainsi que les pipe dans
// On interdit les remont<6E>es de repertoire ainsi que les pipes dans
// les noms de fichiers.
if (eregi('\.\.',$src_file) || eregi('[<>|]',$src_file))
{
dolibarr_syslog("Refused to deliver file ".$src_file);
return false;
return -1;
}
// Security:
@@ -1567,12 +1569,31 @@ function dol_move_uploaded_file($src_file, $dest_file)
if (eregi('\.\.',$dest_file) || eregi('[<>|]',$dest_file))
{
dolibarr_syslog("Refused to deliver file ".$dest_file);
return false;
return -1;
}
// Check if destination file already exists
if (! $allowoverwrite)
{
if (file_exists($file_name))
{
dolibarr_syslog("Functions.lib::dol_move_uploaded_file File ".$file_name." already exists", LOG_WARNING);
return -2;
}
}
// Move file
$return=move_uploaded_file($src_file, $file_name);
return $return;
if ($return)
{
dolibarr_syslog("Functions.lib::dol_move_uploaded_file Success to move ".$src_file." to ".$file_name, LOG_DEBUG);
return 1;
}
else
{
dolibarr_syslog("Functions.lib::dol_move_uploaded_file Failed to mode ".$src_file." to ".$file_name, LOG_ERR);
return -3;
}
}

2
htdocs/lib/ldap.class.php
View File

@@ -277,7 +277,7 @@ class Ldap
{
$this->error='Failed to connect to LDAP';
$return=-1;
dolibarr_syslog("Ldap::connect_bind return=".$return, LOG_WARN);
dolibarr_syslog("Ldap::connect_bind return=".$return, LOG_WARNING);
}
return $return;
}

2
htdocs/product.class.php
View File

@@ -2226,7 +2226,7 @@ class Product extends CommonObject
$originImage = $dir . $file['name'];
// Cree fichier en taille origine
dol_move_uploaded_file($file['tmp_name'], $originImage);
dol_move_uploaded_file($file['tmp_name'], $originImage, 1);
if (file_exists($originImage))
{

2
htdocs/product/document.php
View File

@@ -86,7 +86,7 @@ if ($_POST["sendit"] && $conf->upload)
if (is_dir($upload_dir))
{
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0) > 0)
{
$mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
//print_r($_FILES);

2
htdocs/product/photos.php
View File

@@ -53,7 +53,7 @@ if ($_FILES['userfile']['size'] > 0 && $_POST["sendit"] && $conf->upload != 0)
$product = new Product($db);
$result = $product->fetch($_GET["id"]);
// if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
// if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],1) > 0)
// var_dump($_FILES);

168
htdocs/societe/docsoc.php
View File

@@ -19,14 +19,15 @@
*/
/**
\file htdocs/societe/docsoc.php
\brief Tab for documents linked to third party
\ingroup societe
\version $Id$
* \file htdocs/societe/docsoc.php
* \brief Tab for documents linked to third party
* \ingroup societe
* \version $Id$
*/
require("./pre.inc.php");
require_once(DOL_DOCUMENT_ROOT."/lib/company.lib.php");
require_once(DOL_DOCUMENT_ROOT."/lib/files.lib.php");
require_once(DOL_DOCUMENT_ROOT."/html.formfile.class.php");
$langs->load("companies");
@@ -34,15 +35,33 @@ $langs->load('other');
$mesg = "";
// Security check
$socid = isset($_GET["socid"])?$_GET["socid"]:(! empty($_GET["id"])?$_GET["id"]:'');
if ($user->societe_id > 0)
{
unset($_GET["action"]);
$action='';
$socid = $user->societe_id;
}
$result = restrictedArea($user, 'societe', $socid);
// Get parameters
$page=$_GET["page"];
$sortorder=$_GET["sortorder"];
$sortfield=$_GET["sortfield"];
if (! $sortorder) $sortorder="ASC";
if (! $sortfield) $sortfield="name";
if ($page == -1) { $page = 0 ; }
$offset = $conf->liste_limit * $page ;
$pageprev = $page - 1;
$pagenext = $page + 1;
$sortorder=$_GET["sortorder"];
$sortfield=$_GET["sortfield"];
if (! $sortorder) $sortorder="ASC";
if (! $sortfield) $sortfield="name";
// Security check
$socid = isset($_GET["socid"])?$_GET["socid"]:'';
if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'societe', $socid);
/*
* Actions
@@ -57,21 +76,21 @@ if ( $_POST["sendit"] && $conf->upload != 0)
if (is_dir($upload_dir))
{
$result = dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']);
if ($result == 1)
$result = dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0);
if ($result > 0)
{
$mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
//print_r($_FILES);
}
else if (!$result)
else if ($result < 0)
{
// Echec transfert (fichier d<EFBFBD>passant la limite ?)
// Echec transfert (fichier depassant la limite ?)
$mesg = '<div class="error">'.$langs->trans("ErrorFileNotUploaded").'</div>';
// print_r($_FILES);
}
else
{
// Fichier infect<EFBFBD> par un virus
// Fichier infecte par un virus
$mesg = '<div class="error">'.$langs->trans("ErrorFileIsInfectedWith",$result).'</div>';
}
}
@@ -106,44 +125,16 @@ if ($socid > 0)
dolibarr_fiche_head($head, 'document', $langs->trans("ThirdParty"));
/*
* Confirmation de la suppression d'une ligne produit
*/
if ($_GET['action'] == 'delete_file')
{
$html->form_confirm($_SERVER["PHP_SELF"].'?socid='.$socid.'&amp;urlfile='.urldecode($_GET["urlfile"]), $langs->trans('DeleteFile'), $langs->trans('ConfirmDeleteFile'), 'confirm_deletefile');
print '<br>';
}
// Construit liste des fichiers
clearstatcache();
$totalsize=0;
$filearray=array();
$errorlevel=error_reporting();
error_reporting(0);
$handle=opendir($upload_dir);
error_reporting($errorlevel);
if ($handle)
{
$i=0;
while (($file = readdir($handle))!==false)
{
if (!is_dir($dir.$file) && substr($file, 0, 1) <> '.' && substr($file, 0, 3) <> 'CVS')
{
$filearray[$i]->name=$file;
$filearray[$i]->size=filesize($upload_dir."/".$file);
$filearray[$i]->date=filemtime($upload_dir."/".$file);
$totalsize+=$filearray[$i]->size;
$i++;
}
}
closedir($handle);
}
else
{
// print '<div class="error">'.$langs->trans("ErrorCanNotReadDir",$upload_dir).'</div>';
}
// Construit liste des fichiers
$filearray=dol_dir_list($upload_dir,"files",0,'','\.meta$',$sortfield,(strtolower($sortorder)=='desc'?SORT_ASC:SORT_DESC),1);
$totalsize=0;
foreach($filearray as $key => $file)
{
$totalsize+=$file['size'];
}
print '<table class="border"width="100%">';
// Ref
@@ -164,75 +155,24 @@ if ($socid > 0)
if ($mesg) { print "$mesg<br>"; }
/*
* Confirmation de la suppression d'une ligne produit
*/
if ($_GET['action'] == 'delete')
{
$html->form_confirm($_SERVER["PHP_SELF"].'?socid='.$_GET["id"].'&amp;urlfile='.urldecode($_GET["urlfile"]), $langs->trans('DeleteFile'), $langs->trans('ConfirmDeleteFile'), 'confirm_deletefile');
print '<br>';
}
// Affiche formulaire upload
$formfile=new FormFile($db);
$formfile->form_attach_new_file(DOL_URL_ROOT.'/societe/docsoc.php?socid='.$socid);
// Affiche liste des documents existant
print_titre($langs->trans("AttachedFiles"));
/**
* TODO Mettre cette section dans une zone AJAX
*/
$prefix=$socid.'/';
$modulepart='societe';
$url=$_SERVER["PHP_SELF"];
print '<table width="100%" class="noborder">';
print '<tr class="liste_titre">';
$param='&amp;socid='.$socid;
print_liste_field_titre($langs->trans("Document"),$_SERVER["PHP_SELF"],"name","",$param,'align="left"',$sortfield,$sortorder);
print_liste_field_titre($langs->trans("Size"),$_SERVER["PHP_SELF"],"size","",$param,'align="right"',$sortfield,$sortorder);
print_liste_field_titre($langs->trans("Date"),$_SERVER["PHP_SELF"],"date","",$param,'align="center"',$sortfield,$sortorder);
print '<td>&nbsp;</td>';
print '</tr>';
function compare_file($a, $b)
{
global $sortorder;
global $sortfield;
$sortorder=strtoupper($sortorder);
if ($sortorder == 'ASC') { $retup=-1; $retdown=1; }
else { $retup=1; $retdown=-1; }
if ($sortfield == 'name')
{
if ($a->name == $b->name) return 0;
return ($a->name < $b->name) ? $retup : $retdown;
}
if ($sortfield == 'date')
{
if ($a->date == $b->date) return 0;
return ($a->date < $b->date) ? $retup : $retdown;
}
if ($sortfield == 'size')
{
if ($a->size == $b->size) return 0;
return ($a->size < $b->size) ? $retup : $retdown;
}
}
usort($filearray,"compare_file");
$var=true;
foreach($filearray as $key => $file)
{
if (!is_dir($dir.$file->name) && substr($file->name, 0, 1) <> '.' && substr($file->name, 0, 3) <> 'CVS')
{
$var=!$var;
print "<tr $bc[$var]><td>";
echo '<a href="'.DOL_URL_ROOT.'/document.php?modulepart='.$modulepart.'&type=application/binary&file='.urlencode($prefix.$file->name).'">'.$file->name.'</a>';
print "</td>\n";
print '<td align="right">'.$file->size.' '.$langs->trans("bytes").'</td>';
print '<td align="center">'.dolibarr_print_date($file->date,"dayhour").'</td>';
print '<td align="center">';
echo '<a href="'.$url.'?socid='.$socid.'&amp;action=delete_file&urlfile='.urlencode($file->name).'">'.img_delete().'</a>';
print "</td></tr>\n";
}
}
print "</table>";
// Fin de zone Ajax
// List of document
$param='&socid='.$societe->id;
$formfile->list_of_documents($filearray,$societe,'societe',$param);
print "<br><br>";

2
htdocs/telephonie/facturation/index.php
View File

@@ -35,7 +35,7 @@ if ( $_POST["sendit"] && $conf->upload != 0)
if (is_dir($upload_dir))
{
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],1) > 0)
{
$mesg = "Le fichier est valide, et a &eacute;t&eacute; t&eacute;l&eacute;charg&eacute; avec succ&egrave;s.\n";
}

2
htdocs/telephonie/ligne/commande/retour/index.php
View File

@@ -42,7 +42,7 @@ if ( $_POST["sendit"] && $conf->upload != 0)
$nextname = $upload_dir .'/backup';
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],1) > 0)
{
$mesg = "Le fichier est valide, et a &eacute;t&eacute; t&eacute;l&eacute;charg&eacute; avec succ&egrave;s.\n";
}

2
htdocs/user/fiche.php
View File

@@ -276,7 +276,7 @@ if ($_POST["action"] == 'update' && ! $_POST["cancel"] && $caneditfield)
if (is_dir($conf->users->dir_output))
{
$newfile=$conf->users->dir_output . "/" . $edituser->id . ".jpg";
if (! dol_move_uploaded_file($_FILES['photo']['tmp_name'],$newfile))
if (! dol_move_uploaded_file($_FILES['photo']['tmp_name'],$newfile,1) > 0)
{
$message .= '<div class="error">'.$langs->trans("ErrorFailedToSaveFile").'</div>';
}