Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-12-10 11:31:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

NEW Introduce value 'password' formode of sanitization in GETPOST.

Browse Source
This commit is contained in:
Laurent Destailleur
2024-07-21 14:44:14 +02:00
parent 93d96f37cd
commit 6ac589b0a9
12 changed files with 35 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
htdocs/adherents/card.php
View File

@@ -300,7 +300,7 @@ if (empty($reshook)) {
$object->gender = trim(GETPOST("gender", 'alphanohtml'));
$object->login = trim(GETPOST("login", 'alphanohtml'));
if (GETPOSTISSET('pass')) {
$object->pass = trim(GETPOST("pass", 'none')); // For password, we must use 'none'
$object->pass = trim(GETPOST("pass", 'password')); // For password, we must use 'none'
}
$object->societe = trim(GETPOST("societe", 'alphanohtml')); // deprecated
@@ -465,10 +465,10 @@ if (empty($reshook)) {
$phone = GETPOST("phone", 'alpha');
$phone_perso = GETPOST("phone_perso", 'alpha');
$phone_mobile = GETPOST("phone_mobile", 'alpha');
$email = preg_replace('/\s+/', '', GETPOST("member_email", 'alpha'));
$email = preg_replace('/\s+/', '', GETPOST("member_email", 'aZ09arobase'));
$url = trim(GETPOST('url', 'custom', 0, FILTER_SANITIZE_URL));
$login = GETPOST("member_login", 'alphanohtml');
$pass = GETPOST("password", 'none'); // For password, we use 'none'
$pass = GETPOST("password", 'password'); // For password, we use 'none'
$photo = GETPOST("photo", 'alphanohtml');
$morphy = GETPOST("morphy", 'alphanohtml');
$public = GETPOST("public", 'alphanohtml');
@@ -1230,7 +1230,7 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action)) {
// Password
if (!getDolGlobalString('ADHERENT_LOGIN_NOT_REQUIRED')) {
print '<tr><td class="fieldrequired">'.$langs->trans("Password").'</td><td><input type="password" name="pass" class="minwidth300" maxlength="50" value="'.dol_escape_htmltag(GETPOSTISSET("pass") ? GETPOST("pass", 'none', 2) : '').'"></td></tr>';
print '<tr><td class="fieldrequired">'.$langs->trans("Password").'</td><td><input type="password" name="pass" class="minwidth300" maxlength="50" value="'.dol_escape_htmltag(GETPOSTISSET("pass") ? GETPOST("pass", 'password', 2) : '').'"></td></tr>';
}
// Type

2
htdocs/asterisk/wrapper.php
View File

@@ -131,7 +131,7 @@ if (!getDolGlobalString('ASTERISK_MAX_RETRY')) {
$login = GETPOST('login', 'alphanohtml');
$password = GETPOST('password', 'none');
$password = GETPOST('password', 'password');
$caller = GETPOST('caller', 'alphanohtml');
$called = GETPOST('called', 'alphanohtml');

2
htdocs/core/actions_addupdatedelete.inc.php
View File

@@ -156,7 +156,7 @@ if ($action == 'add' && !empty($permissiontoadd)) {
$object->$key = '(PROV)';
}
if ($key == 'pass_crypted') {
$object->pass = GETPOST("pass", "none");
$object->pass = GETPOST("pass", "password");
// TODO Manadatory for password not yet managed
} else {
if (!empty($val['notnull']) && $val['notnull'] > 0 && $object->$key == '' && !isset($val['default'])) {

2
htdocs/core/ajax/editinline.php
View File

@@ -44,7 +44,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/website2.lib.php';
$action = GETPOST('action', 'alpha');
$website_ref = GETPOST('website_ref');
$page_id = GETPOST('page_id');
$content = GETPOST('content', 'none');
$content = GETPOST('content', 'restricthtml');
$element_id = GETPOST('element_id');
$element_type = GETPOST('element_type');

5
htdocs/core/lib/functions.lib.php
View File

@@ -729,8 +729,8 @@ function GETPOSTISARRAY($paramname, $method = 0)
*
* @param string $paramname Name of parameter to found
* @param string $check Type of check
* ''=no check (deprecated)
* 'none'=no check (only for param that should have very rich content like passwords)
* '' or 'none'=no check (deprecated)
* 'password'=allow characters for a password
* 'array', 'array:restricthtml' or 'array:aZ09' to check it's an array
* 'int'=check it's numeric (integer or float)
* 'intcomma'=check it's integer+comma ('1,2,3,4...')
@@ -1157,6 +1157,7 @@ function sanitizeVal($out = '', $check = 'alphanohtml', $filter = null, $options
// Check is done after replacement
switch ($check) {
case 'none':
case 'password':
break;
case 'int': // Check param is a numeric value (integer but also float or hexadecimal)
if (!is_numeric($out)) {

4
htdocs/install/step1.php
View File

@@ -47,13 +47,13 @@ $main_data_dir = GETPOST('main_data_dir') ? GETPOST('main_data_dir') : (empty($a
$main_url = GETPOST('main_url') ? GETPOST('main_url') : (empty($argv[5]) ? '' : $argv[5]);
// Database login information
$userroot = GETPOST('db_user_root', 'alpha') ? GETPOST('db_user_root', 'alpha') : (empty($argv[6]) ? '' : $argv[6]);
$passroot = GETPOST('db_pass_root', 'none') ? GETPOST('db_pass_root', 'none') : (empty($argv[7]) ? '' : $argv[7]);
$passroot = GETPOST('db_pass_root', 'password') ? GETPOST('db_pass_root', 'password') : (empty($argv[7]) ? '' : $argv[7]);
// Database server
$db_type = GETPOST('db_type', 'aZ09') ? GETPOST('db_type', 'aZ09') : (empty($argv[8]) ? '' : $argv[8]);
$db_host = GETPOST('db_host', 'alpha') ? GETPOST('db_host', 'alpha') : (empty($argv[9]) ? '' : $argv[9]);
$db_name = GETPOST('db_name', 'aZ09') ? GETPOST('db_name', 'aZ09') : (empty($argv[10]) ? '' : $argv[10]);
$db_user = GETPOST('db_user', 'alpha') ? GETPOST('db_user', 'alpha') : (empty($argv[11]) ? '' : $argv[11]);
$db_pass = GETPOST('db_pass', 'none') ? GETPOST('db_pass', 'none') : (empty($argv[12]) ? '' : $argv[12]);
$db_pass = GETPOST('db_pass', 'password') ? GETPOST('db_pass', 'password') : (empty($argv[12]) ? '' : $argv[12]);
$db_port = GETPOSTINT('db_port') ? GETPOSTINT('db_port') : (empty($argv[13]) ? '' : $argv[13]);
$db_prefix = GETPOST('db_prefix', 'aZ09') ? GETPOST('db_prefix', 'aZ09') : (empty($argv[14]) ? '' : $argv[14]);
$db_create_database = GETPOST('db_create_database', 'alpha') ? GETPOST('db_create_database', 'alpha') : (empty($argv[15]) ? '' : $argv[15]);

2
htdocs/main.inc.php
View File

@@ -873,7 +873,7 @@ if (!defined('NOLOGIN')) {
}
// TODO Remove use of $_COOKIE['login_dolibarr'] ? Replace $usertotest = with $usertotest = GETPOST("username", "alpha", $allowedmethodtopostusername);
$usertotest = (!empty($_COOKIE['login_dolibarr']) ? preg_replace('/[^a-zA-Z0-9_@\-\.]/', '', $_COOKIE['login_dolibarr']) : GETPOST("username", "alpha", $allowedmethodtopostusername));
$passwordtotest = GETPOST('password', 'none', $allowedmethodtopostusername);
$passwordtotest = GETPOST('password', 'password', $allowedmethodtopostusername);
$entitytotest = (GETPOSTINT('entity') ? GETPOSTINT('entity') : (!empty($conf->entity) ? $conf->entity : 1));
// Define if we received the correct data to go into the test of the login with the checkLoginPassEntity().

13
htdocs/public/members/new.php
View File

@@ -243,10 +243,10 @@ if (empty($reshook) && $action == 'add') {
if (getDolGlobalString('ADHERENT_MAIL_REQUIRED') && empty(GETPOST('email'))) {
$error++;
$errmsg .= $langs->trans('ErrorFieldRequired', $langs->transnoentitiesnoconv('Email'))."<br>\n";
} elseif (GETPOST("email") && !isValidEmail(GETPOST("email"))) {
} elseif (GETPOST("email", "aZ09arobase") && !isValidEmail(GETPOST("email", "aZ09arobase"))) {
$langs->load('errors');
$error++;
$errmsg .= $langs->trans("ErrorBadEMail", GETPOST("email"))."<br>\n";
$errmsg .= $langs->trans("ErrorBadEMail", GETPOST("email", "aZ09arobase"))."<br>\n";
}
$birthday = dol_mktime(GETPOSTINT("birthhour"), GETPOSTINT("birthmin"), GETPOSTINT("birthsec"), GETPOSTINT("birthmonth"), GETPOSTINT("birthday"), GETPOSTINT("birthyear"));
if (GETPOST("birthmonth") && empty($birthday)) {
@@ -278,6 +278,7 @@ if (empty($reshook) && $action == 'add') {
// E-mail looks OK and login does not exist
$adh = new Adherent($db);
$adh->statut = -1;
$adh->status = -1;
$adh->public = $public;
$adh->firstname = GETPOST('firstname');
$adh->lastname = GETPOST('lastname');
@@ -287,10 +288,10 @@ if (empty($reshook) && $action == 'add') {
$adh->address = GETPOST('address');
$adh->zip = GETPOST('zipcode');
$adh->town = GETPOST('town');
$adh->email = GETPOST('email');
$adh->email = GETPOST('email', 'aZ09arobase');
if (!getDolGlobalString('ADHERENT_LOGIN_NOT_REQUIRED')) {
$adh->login = GETPOST('login');
$adh->pass = GETPOST('pass1');
$adh->pass = GETPOST('pass1', 'password');
}
$adh->photo = GETPOST('photo');
$adh->country_id = getDolGlobalInt("MEMBER_NEWFORM_FORCECOUNTRYCODE", GETPOSTINT('country_id'));
@@ -632,7 +633,7 @@ if (getDolGlobalString('MEMBER_SKIP_TABLE') || getDolGlobalString('MEMBER_NEWFOR
// EMail
print '<tr><td class="'.(getDolGlobalString("ADHERENT_MAIL_REQUIRED") ? 'classfortooltip' : '').'" title="'.dol_escape_htmltag($messagemandatory).'">'.$langs->trans("Email").(getDolGlobalString("ADHERENT_MAIL_REQUIRED") ? ' <span class="star">*</span>' : '').'</td><td>';
//print img_picto('', 'email', 'class="pictofixedwidth"');
print '<input type="text" name="email" maxlength="255" class="minwidth200" value="'.dol_escape_htmltag(GETPOST('email')).'"></td></tr>'."\n";
print '<input type="email" name="email" maxlength="255" class="minwidth200" value="'.dol_escape_htmltag(GETPOST('email', "aZ09arobase")).'"></td></tr>'."\n";
// Login
if (!getDolGlobalString('ADHERENT_LOGIN_NOT_REQUIRED')) {
@@ -809,7 +810,7 @@ if (getDolGlobalString('MEMBER_SKIP_TABLE') || getDolGlobalString('MEMBER_NEWFOR
// Display Captcha code if is enabled
if (getDolGlobalString('MAIN_SECURITY_ENABLECAPTCHA')) {
require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php';
print '<tr><td class="titlefield"><label for="email"><span class="fieldrequired">'.$langs->trans("SecurityCode").'</span></label></td><td>';
print '<tr><td class="titlefield"><label><span class="fieldrequired">'.$langs->trans("SecurityCode").'</span></label></td><td>';
print '<span class="span-icon-security inline-block">';
print '<input id="securitycode" placeholder="'.$langs->trans("SecurityCode").'" class="flat input-icon-security width150" type="text" maxlength="5" name="code" tabindex="3" />';
print '</span>';

2
htdocs/public/webportal/webportal.main.inc.php
View File

@@ -136,7 +136,7 @@ if (!defined('WEBPORTAL_NOLOGIN') && !empty($context->controllerInstance->access
if ($action == 'login') {
$login = GETPOST('login', 'alphanohtml');
$password = GETPOST('password', 'none');
$password = GETPOST('password', 'password');
// $security_code = GETPOST('security_code', 'alphanohtml');
if (empty($login)) {

10
htdocs/user/card.php
View File

@@ -349,8 +349,8 @@ if (empty($reshook)) {
$id = $object->create($user);
if ($id > 0) {
$resPass = 0;
if (GETPOST('password', 'none')) {
$resPass = $object->setPassword($user, GETPOST('password', 'none'));
if (GETPOST('password', 'password')) {
$resPass = $object->setPassword($user, GETPOST('password', 'password'));
}
if (is_int($resPass) && $resPass < 0) {
$langs->load("errors");
@@ -438,7 +438,7 @@ if (empty($reshook)) {
}
$object->gender = GETPOST("gender", 'aZ09');
if ($caneditpasswordandsee) {
$object->pass = GETPOST("password", 'none'); // We can keep 'none' for password fields
$object->pass = GETPOST("password", 'password');
}
if ($caneditpasswordandsee || $user->hasRight("api", "apikey", "generate")) {
$object->api_key = (GETPOST("api_key", 'alphanohtml')) ? GETPOST("api_key", 'alphanohtml') : $object->api_key;
@@ -658,10 +658,10 @@ if (empty($reshook)) {
$object->fetch($id);
if (GETPOST("password", "none")) { // If pass is empty, we do not change it.
if (GETPOST("password", "password")) { // If pass is empty, we do not change it.
$object->oldcopy = clone $object;
$ret = $object->setPassword($user, GETPOST("password", "none"));
$ret = $object->setPassword($user, GETPOST("password", "password"));
if (is_int($ret) && $ret < 0) {
setEventMessages($object->error, $object->errors, 'errors');
}

2
htdocs/user/class/user.class.php
View File

@@ -1926,7 +1926,7 @@ class User extends CommonObject
$this->db->commit();
return $this->id;
} else {
// $this->error deja positionne
// $this->error was already set
$this->db->rollback();
return -2;
}

18
htdocs/website/index.php
View File

@@ -1152,7 +1152,7 @@ if ($action == 'addcontainer' && $usercanedit) {
$objectpage->image = GETPOST('WEBSITE_IMAGE', 'alpha');
$objectpage->keywords = str_replace(array('<', '>'), '', GETPOST('WEBSITE_KEYWORDS', 'alphanohtml'));
$objectpage->allowed_in_frames = GETPOST('WEBSITE_ALLOWED_IN_FRAMES', 'aZ09');
$objectpage->htmlheader = GETPOST('htmlheader', 'none');
$objectpage->htmlheader = GETPOST('htmlheader', 'none'); // Must accept tags like '<script>' and '<link>'
$objectpage->author_alias = GETPOST('WEBSITE_AUTHORALIAS', 'alphanohtml');
$objectpage->object_type = GETPOST('WEBSITE_OBJECTCLASS');
$objectpage->fk_object = GETPOST('WEBSITE_OBJECTID');
@@ -1594,7 +1594,7 @@ if ($action == 'updatecss' && $usercanedit) {
}
$dataposted = trim(GETPOST('WEBSITE_HTML_HEADER', 'none'));
$dataposted = trim(GETPOST('WEBSITE_HTML_HEADER', 'restricthtmlallowunvalid'));
$dataposted = preg_replace(array('/<html>\n*/ims', '/<\/html>\n*/ims'), array('', ''), $dataposted);
$dataposted = str_replace('<?=', '<?php', $dataposted);
@@ -1776,7 +1776,7 @@ if ($action == 'updatecss' && $usercanedit) {
}
$dataposted = trim(GETPOST('WEBSITE_MANIFEST_JSON', 'none'));
$dataposted = trim(GETPOST('WEBSITE_MANIFEST_JSON', 'restricthtmlallowunvalid'));
$dataposted = str_replace('<?=', '<?php', $dataposted);
// Manifest.json file
@@ -2038,7 +2038,7 @@ if ($action == 'updatemeta' && $usercanedit) {
$objectpage->image = GETPOST('WEBSITE_IMAGE', 'alpha');
$objectpage->keywords = str_replace(array('<', '>'), '', GETPOST('WEBSITE_KEYWORDS', 'alphanohtml'));
$objectpage->allowed_in_frames = GETPOST('WEBSITE_ALLOWED_IN_FRAMES', 'aZ09');
$objectpage->htmlheader = trim(GETPOST('htmlheader', 'none'));
$objectpage->htmlheader = trim(GETPOST('htmlheader', 'none')); // Must accept tags like '<script>' and '<link>'
$objectpage->fk_page = (GETPOSTINT('pageidfortranslation') > 0 ? GETPOSTINT('pageidfortranslation') : 0);
$objectpage->author_alias = trim(GETPOST('WEBSITE_AUTHORALIAS', 'alphanohtml'));
$objectpage->object_type = GETPOST('WEBSITE_OBJECTCLASS', 'alpha');
@@ -3822,7 +3822,7 @@ if ($action == 'editcss') {
// Clean the php htmlheader file to remove php code and get only html part
$htmlheadercontent = preg_replace('/<\?php \/\/ BEGIN PHP[^\?]*END PHP( \?>)?\n*/ims', '', $htmlheadercontent);
} else {
$htmlheadercontent = GETPOST('WEBSITE_HTML_HEADER', 'none');
$htmlheadercontent = GETPOST('WEBSITE_HTML_HEADER', 'none'); // Must accept tags like '<script>' and '<link>'
}
if (!trim($htmlheadercontent)) {
$htmlheadercontent = "<html>\n";
@@ -3876,7 +3876,7 @@ if ($action == 'editcss') {
// Clean the readme file to remove php code and get only html part
$readmecontent = preg_replace('/<\?php \/\/ BEGIN PHP[^\?]*END PHP( \?>)?\n*/ims', '', $readmecontent);
} else {
$readmecontent = GETPOST('WEBSITE_README', 'none');
$readmecontent = GETPOST('WEBSITE_README', 'restricthtmlallowunvalid');
}
if (!trim($readmecontent)) {
//$readmecontent.="";
@@ -3887,7 +3887,7 @@ if ($action == 'editcss') {
// Clean the readme file to remove php code and get only html part
$licensecontent = preg_replace('/<\?php \/\/ BEGIN PHP[^\?]*END PHP( \?>)?\n*/ims', '', $licensecontent);
} else {
$licensecontent = GETPOST('WEBSITE_LICENSE', 'none');
$licensecontent = GETPOST('WEBSITE_LICENSE', 'restricthtmlallowunvalid');
}
if (!trim($licensecontent)) {
//$readmecontent.="";
@@ -4361,7 +4361,7 @@ if ($action == 'editmeta' || $action == 'createcontainer') { // Edit properties
if (GETPOST('WEBSITE_ALLOWED_IN_FRAMES', 'aZ09')) {
$pageallowedinframes = GETPOST('WEBSITE_ALLOWED_IN_FRAMES', 'aZ09');
}
if (GETPOST('htmlheader', 'none')) {
if (GETPOST('htmlheader', 'none')) { // Must accept tags like '<script>' and '<link>'
$pagehtmlheader = GETPOST('htmlheader', 'none');
}
@@ -4694,9 +4694,7 @@ if ($action == 'editmeta' || $action == 'createcontainer') { // Edit properties
//$doleditor = new DolEditor('content', GETPOST('content', 'restricthtmlallowunvalid'), '', 200, 'dolibarr_mailings', 'In', true, true, true, 40, '90%');
$doleditor = new DolEditor('content', GETPOST('content', 'none'), '', 200, 'dolibarr_mailings', 'In', true, true, true, 40, '90%');
$doleditor->Create();
//print '<div class="websitesample" id="contentpreview" name="contentpreview" style="height: 200px; border: 1px solid #bbb; overflow: scroll">';
print '</div>';
//print '<textarea id="content" name="content" class="hideobject">'.GETPOST('content', 'none').'</textarea>';
print '</td></tr>';
}