From fed96b7edb0e3a319d1c282d46b0405a9febfacb Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sun, 3 Sep 2023 23:06:48 +0200 Subject: [PATCH 1/9] Update upgrade2.php --- htdocs/install/upgrade2.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/htdocs/install/upgrade2.php b/htdocs/install/upgrade2.php index 0f7b20d3f19..10be86d2411 100644 --- a/htdocs/install/upgrade2.php +++ b/htdocs/install/upgrade2.php @@ -4107,8 +4107,6 @@ function migrate_delete_old_files($db, $langs, $conf) '/core/modules/modCommercial.class.php', '/core/modules/modProduit.class.php', '/core/modules/modSkype.class.php', - '/phenix/inc/triggers/interface_modPhenix_Phenixsynchro.class.php', - '/webcalendar/inc/triggers/interface_modWebcalendar_webcalsynchro.class.php', '/core/triggers/interface_modWebcalendar_Webcalsynchro.class.php', '/core/triggers/interface_modCommande_Ecotax.class.php', '/core/triggers/interface_modCommande_fraisport.class.php', @@ -4138,6 +4136,10 @@ function migrate_delete_old_files($db, $langs, $conf) '/core/modules/mailings/kiwi.modules.php', '/core/boxes/box_members.php', + '/includes/restler/framework/Luracast/Restler/Data/Object.php', + '/phenix/inc/triggers/interface_modPhenix_Phenixsynchro.class.php', + '/webcalendar/inc/triggers/interface_modWebcalendar_webcalsynchro.class.php', + '/api/class/api_generic.class.php', '/asterisk/cidlookup.php', '/categories/class/api_category.class.php', From 6e2962f22c37db51a549ba9e7d8311a3616a4a65 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 4 Sep 2023 20:23:15 +0200 Subject: [PATCH 2/9] Removed not expected line --- htdocs/admin/dict.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php index 408a2008622..fcd0502e9e8 100644 --- a/htdocs/admin/dict.php +++ b/htdocs/admin/dict.php @@ -1370,7 +1370,8 @@ if ($id > 0) { } if ($value == 'country') { if (in_array('region_id', $fieldlist)) { - print ' '; continue; + //print ' '; + continue; } // For region page, we do not show the country input $valuetoshow = $langs->trans("Country"); } From 2cb6b158c1e947031527fbcda7f3ea09e9efd726 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 4 Sep 2023 23:20:25 +0200 Subject: [PATCH 3/9] Fix edit record in state dictionary --- htdocs/admin/dict.php | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php index fcd0502e9e8..c08deb66074 100644 --- a/htdocs/admin/dict.php +++ b/htdocs/admin/dict.php @@ -201,7 +201,7 @@ $tablib[44] = "DictionaryAssetDisposalType"; $tabsql = array(); $tabsql[1] = "SELECT f.rowid as rowid, f.code, f.libelle, c.code as country_code, c.label as country, f.active FROM ".MAIN_DB_PREFIX."c_forme_juridique as f, ".MAIN_DB_PREFIX."c_country as c WHERE f.fk_pays=c.rowid"; $tabsql[2] = "SELECT d.rowid as rowid, d.code_departement as code, d.nom as libelle, d.fk_region as region_id, r.nom as region, c.code as country_code, c.label as country, d.active FROM ".MAIN_DB_PREFIX."c_departements as d, ".MAIN_DB_PREFIX."c_regions as r, ".MAIN_DB_PREFIX."c_country as c WHERE d.fk_region=r.code_region and r.fk_pays=c.rowid and r.active=1 and c.active=1"; -$tabsql[3] = "SELECT r.rowid as rowid, r.code_region as state_code, r.nom as libelle, r.fk_pays as country_id, c.code as country_code, c.label as country, r.active FROM ".MAIN_DB_PREFIX."c_regions as r, ".MAIN_DB_PREFIX."c_country as c WHERE r.fk_pays=c.rowid and c.active=1"; +$tabsql[3] = "SELECT r.rowid as rowid, r.code_region as code, r.nom as libelle, r.fk_pays as country_id, c.code as country_code, c.label as country, r.active FROM ".MAIN_DB_PREFIX."c_regions as r, ".MAIN_DB_PREFIX."c_country as c WHERE r.fk_pays=c.rowid and c.active=1"; $tabsql[4] = "SELECT c.rowid as rowid, c.code, c.label, c.active, c.favorite, c.eec FROM ".MAIN_DB_PREFIX."c_country AS c"; $tabsql[5] = "SELECT c.rowid as rowid, c.code as code, c.label, c.active FROM ".MAIN_DB_PREFIX."c_civility AS c"; $tabsql[6] = "SELECT a.id as rowid, a.code as code, a.libelle AS libelle, a.type, a.active, a.module, a.color, a.position FROM ".MAIN_DB_PREFIX."c_actioncomm AS a"; @@ -823,7 +823,7 @@ if (empty($reshook)) { setEventMessages($langs->transnoentities("ErrorFieldRequired", $langs->transnoentities("Country")), null, 'errors'); } } - if (($id == 3 || $id == 42) && !is_numeric(GETPOST("code"))) { + if (($id == 3 || $id == 42) && !is_numeric(GETPOST("code")) && GETPOST('actionadd')) { $ok = 0; setEventMessages($langs->transnoentities("ErrorFieldMustBeANumeric", $langs->transnoentities("Code")), null, 'errors'); } @@ -1199,7 +1199,7 @@ if (empty($id)) { $param = '&id='.urlencode($id); -if ($search_country_id > 0) { +if ($search_country_id || GETPOSTISSET('page') || GETPOST('button_removefilter', 'alpha') || GETPOST('button_removefilter.x', 'alpha') || GETPOST('button_removefilter_x', 'alpha')) { $param .= '&search_country_id='.urlencode($search_country_id); } if ($search_code != '') { @@ -2010,7 +2010,9 @@ if ($id > 0) { if (empty($rowidcol) || in_array($id, array(6, 7, 8, 13, 17, 19, 27, 32))) { $rowidcol = 'rowid'; } - $url = $_SERVER["PHP_SELF"].'?'.($page ? 'page='.$page.'&' : '').'sortfield='.$sortfield.'&sortorder='.$sortorder.'&rowid='.(isset($obj->{$rowidcol}) ? $obj->{$rowidcol} : (!empty($obj->code) ? urlencode($obj->code) : '')).'&code='.(!empty($obj->code) ?urlencode($obj->code) : ''); + $url = $_SERVER["PHP_SELF"].'?'.($page ? 'page='.$page.'&' : '').'sortfield='.$sortfield.'&sortorder='.$sortorder; + $url .= '&rowid='.(isset($obj->$rowidcol) ? $obj->$rowidcol : (!empty($obj->code) ? urlencode($obj->code) : '')); + $url .= '&code='.(!empty($obj->code) ?urlencode($obj->code) : ''); if (!empty($param)) { $url .= '&'.$param; } @@ -2231,8 +2233,8 @@ if ($id > 0) { $langs->load('other'); $key = $langs->trans($obj->label); $valuetoshow = ($obj->label && $key != strtoupper($obj->label) ? $key : $obj->{$value}); - } elseif ($value == 'code' && $id == 3) { - $valuetoshow = $obj->state_code; + /*} elseif ($value == 'code' && $id == 3) { + $valuetoshow = $obj->state_code; */ } elseif ($value == 'label' && $tabname[$id] == 'c_product_nature') { $langs->load("products"); $valuetoshow = $langs->trans($obj->{$value}); From 119f6b6a7ff696d49376b5e418e99a436130b307 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 4 Sep 2023 23:48:23 +0200 Subject: [PATCH 4/9] Fix missing deletion of an old file --- htdocs/install/upgrade2.php | 1 + 1 file changed, 1 insertion(+) diff --git a/htdocs/install/upgrade2.php b/htdocs/install/upgrade2.php index 10be86d2411..46cff1d2bc6 100644 --- a/htdocs/install/upgrade2.php +++ b/htdocs/install/upgrade2.php @@ -4100,6 +4100,7 @@ function migrate_delete_old_files($db, $langs, $conf) // List of files to delete $filetodeletearray = array( + '/core/ajax/ajaxcompanies.php', '/core/triggers/interface_demo.class.php', '/core/menus/barre_left/default.php', '/core/menus/barre_top/default.php', From 0ed6a63fb06be88be5a4f8bcdee83185eee4087e Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 5 Sep 2023 00:49:01 +0200 Subject: [PATCH 5/9] FIX #CVE-2023-4197 --- htdocs/core/lib/website.lib.php | 3 +++ test/phpunit/WebsiteTest.php | 23 +++++++++++++++++++++++ 2 files changed, 26 insertions(+) diff --git a/htdocs/core/lib/website.lib.php b/htdocs/core/lib/website.lib.php index d27c4dac376..30edeac0d32 100644 --- a/htdocs/core/lib/website.lib.php +++ b/htdocs/core/lib/website.lib.php @@ -76,6 +76,9 @@ function dolStripPhpCode($str, $replacewith = '') function dolKeepOnlyPhpCode($str) { $str = str_replace('assertEquals($result, 1, 'checkPHPCode did not detect the string was dangerous'); } + + /** + * testDolKeepOnlyPhpCode + * + * @return void + */ + public function testDolKeepOnlyPhpCode() + { + $s = 'HTML content and more HTML content'; + $result = dolKeepOnlyPhpCode($s); + print __METHOD__." result dolKeepOnlyPhpCode=".$result."\n"; + $this->assertEquals('', $result, 'dolKeepOnlyPhpCode did extract the correct string'); + + $s = 'HTML content and more HTML content'; + $result = dolKeepOnlyPhpCode($s); + print __METHOD__." result dolKeepOnlyPhpCode=".$result."\n"; + $this->assertEquals('', $result, 'dolKeepOnlyPhpCode did extract the correct string'); + + $s = 'HTML content and more HTML content'; + $result = dolKeepOnlyPhpCode($s); + print __METHOD__." result dolKeepOnlyPhpCode=".$result."\n"; + $this->assertEquals('', $result, 'dolKeepOnlyPhpCode did extract the correct string'); + } } From c437aecb1fc7bb66492ccdefb1feb875c67a51cc Mon Sep 17 00:00:00 2001 From: Regis Houssin Date: Tue, 5 Sep 2023 10:06:30 +0200 Subject: [PATCH 6/9] FIX multicompany compatibility --- htdocs/master.inc.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/master.inc.php b/htdocs/master.inc.php index 50a03e6fdb3..70c35008c8d 100644 --- a/htdocs/master.inc.php +++ b/htdocs/master.inc.php @@ -191,9 +191,9 @@ if (session_id() && !empty($_SESSION["dol_entity"])) { } elseif (!empty($_ENV["dol_entity"])) { // Entity inside a CLI script $conf->entity = $_ENV["dol_entity"]; -} elseif (GETPOSTISSET("loginfunction") && GETPOST("entity", 'int')) { +} elseif (GETPOSTISSET("loginfunction") && (GETPOST("entity", 'int') || GETPOST("switchentity", 'int'))) { // Just after a login page - $conf->entity = GETPOST("entity", 'int'); + $conf->entity = (GETPOSTISSET("entity") ? GETPOST("entity", 'int') : GETPOST("switchentity", 'int')); } elseif (defined('DOLENTITY') && is_numeric(constant('DOLENTITY'))) { // For public page with MultiCompany module $conf->entity = constant('DOLENTITY'); From c557baffc79298b07cfaba53f7b912ec1a7c8041 Mon Sep 17 00:00:00 2001 From: ATM-Sami Date: Tue, 5 Sep 2023 10:31:51 +0200 Subject: [PATCH 7/9] delete useless condition in massaction_pre --- htdocs/core/tpl/massactions_pre.tpl.php | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/htdocs/core/tpl/massactions_pre.tpl.php b/htdocs/core/tpl/massactions_pre.tpl.php index 54557539b26..c5c561c5ec5 100644 --- a/htdocs/core/tpl/massactions_pre.tpl.php +++ b/htdocs/core/tpl/massactions_pre.tpl.php @@ -31,7 +31,6 @@ // $sendto // $withmaindocfilemail - if ($massaction == 'predeletedraft') { print $form->formconfirm($_SERVER["PHP_SELF"], $langs->trans("ConfirmMassDraftDeletion"), $langs->trans("ConfirmMassDeletionQuestion", count($toselect)), "delete", null, '', 0, 200, 500, 1); } @@ -94,7 +93,7 @@ if ($massaction == 'preaffecttag' && isModEnabled('category')) { } } -if ($massaction == 'preupdateprice' && isModEnabled('category')) { +if ($massaction == 'preupdateprice') { $formquestion = array(); $valuefield = '
'; From e922d07a97ddae6a42fe62d4619ee3f0f04479d4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20FRANCE?= Date: Tue, 5 Sep 2023 16:19:21 +0200 Subject: [PATCH 8/9] fix tooltip ajax load langs --- htdocs/product/class/product.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/product/class/product.class.php b/htdocs/product/class/product.class.php index e54ef4ff62b..60dc22c5bb2 100644 --- a/htdocs/product/class/product.class.php +++ b/htdocs/product/class/product.class.php @@ -5058,7 +5058,7 @@ class Product extends CommonObject { global $conf, $langs; - $langs->load('products', 'other'); + $langs->loadLangs(array('products', 'other')); $datas = array(); $nofetch = !empty($params['nofetch']); From 36c1c6be6a3b9b2011e53fa4c8dbb51442e7cf61 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 5 Sep 2023 16:33:37 +0200 Subject: [PATCH 9/9] Fix test on entity for project --- htdocs/core/lib/functions.lib.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 4407eae01f3..3508fa865a5 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -274,6 +274,9 @@ function getEntity($element, $shared = 1, $currentobject = null) // fix different element names (France to English) switch ($element) { + case 'projet': + $element = 'project'; + break; case 'contrat': $element = 'contract'; break; // "/contrat/class/contrat.class.php"