Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2026-02-13 11:15:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix #huntr88841fe0-e332-49ce-a46b-36d4f091fd89

Browse Source
This commit is contained in:
Laurent Destailleur
2023-02-13 13:29:30 +01:00
parent 9e79e00f10
commit 4a49ca86c9
3 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/core/lib/website.lib.php
View File

@@ -69,7 +69,7 @@ function dolStripPhpCode($str, $replacewith = '')
*
* @param string $str String to clean
* @return string Result string with php code only
* @see dolStripPhpCode()
* @see dolStripPhpCode(), checkPHPCode()
*/
function dolKeepOnlyPhpCode($str)
{

1
htdocs/core/lib/website2.lib.php
View File

@@ -678,6 +678,7 @@ function showWebsiteTemplates(Website $website)
* @param string $phpfullcodestringold PHP old string
* @param string $phpfullcodestring PHP new string
* @return int Error or not
* @see dolKeepOnlyPhpCode()
*/
function checkPHPCode($phpfullcodestringold, $phpfullcodestring)
{

10
htdocs/website/index.php
View File

@@ -806,6 +806,16 @@ if ($action == 'addcontainer' && $usercanedit) {
// Remove comments
$tmp['content'] = removeHtmlComment($tmp['content']);
// Check there is no PHP content into the imported file (must be only HTML + JS)
$phpcontent = dolKeepOnlyPhpCode('', $tmp['content']);
if ($phpcontent) {
$error++;
setEventMessages('Error getting '.$urltograb.': file that include PHP content is not allowed', null, 'errors');
$action = 'createcontainer';
}
}
if (!$error) {
$regs = array();
preg_match('/<head>(.*)<\/head>/ims', $tmp['content'], $regs);