diff --git a/htdocs/core/lib/website.lib.php b/htdocs/core/lib/website.lib.php index c258e3198ce..d900b7718cf 100644 --- a/htdocs/core/lib/website.lib.php +++ b/htdocs/core/lib/website.lib.php @@ -69,7 +69,7 @@ function dolStripPhpCode($str, $replacewith = '') * * @param string $str String to clean * @return string Result string with php code only - * @see dolStripPhpCode() + * @see dolStripPhpCode(), checkPHPCode() */ function dolKeepOnlyPhpCode($str) { diff --git a/htdocs/core/lib/website2.lib.php b/htdocs/core/lib/website2.lib.php index e03f711c9c0..e619ab17a76 100644 --- a/htdocs/core/lib/website2.lib.php +++ b/htdocs/core/lib/website2.lib.php @@ -678,6 +678,7 @@ function showWebsiteTemplates(Website $website) * @param string $phpfullcodestringold PHP old string * @param string $phpfullcodestring PHP new string * @return int Error or not + * @see dolKeepOnlyPhpCode() */ function checkPHPCode($phpfullcodestringold, $phpfullcodestring) { diff --git a/htdocs/website/index.php b/htdocs/website/index.php index 3a625818ba4..22e692ad824 100644 --- a/htdocs/website/index.php +++ b/htdocs/website/index.php @@ -806,6 +806,16 @@ if ($action == 'addcontainer' && $usercanedit) { // Remove comments $tmp['content'] = removeHtmlComment($tmp['content']); + // Check there is no PHP content into the imported file (must be only HTML + JS) + $phpcontent = dolKeepOnlyPhpCode('', $tmp['content']); + if ($phpcontent) { + $error++; + setEventMessages('Error getting '.$urltograb.': file that include PHP content is not allowed', null, 'errors'); + $action = 'createcontainer'; + } + } + + if (!$error) { $regs = array(); preg_match('/(.*)<\/head>/ims', $tmp['content'], $regs);