vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FIX #GHSA-39vm-9q4p-6jjg - force disabling module possible on demo only

Browse source
This commit is contained in:
Laurent Destailleur 2026-03-25 23:46:45 +01:00
parent b565d497f9
commit 1072e090ec
1 changed files with 25 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

47
htdocs/main.inc.php
View file

@ -77,6 +77,7 @@ require_once 'filefunc.inc.php';
* @var ?string $dolibarr_main_force_https
* @var ?string $dolibarr_main_restrict_ip
* @var ?string $dolibarr_nocsrfcheck
* @var ?string $dolibarr_main_demo
*/
// If there is a POST parameter to tell to save automatically some POST parameters into cookies, we do it.
@ -437,31 +438,33 @@ if ((!defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && getDolGlobalInt(
// Note: There is another CSRF protection into the filefunc.inc.php
}
// Disable modules (this must be after session_start and after conf has been loaded)
if (GETPOSTISSET('disablemodules')) {
$_SESSION["disablemodules"] = GETPOST('disablemodules', 'alpha');
}
if (!empty($_SESSION["disablemodules"])) {
$modulepartkeys = array('css', 'js', 'tabs', 'triggers', 'login', 'substitutions', 'menus', 'theme', 'sms', 'tpl', 'barcode', 'models', 'societe', 'hooks', 'dir', 'syslog', 'tpllinkable', 'contactelement', 'moduleforexternal', 'websitetemplates');
if (!empty($dolibarr_main_demo)) {
// Disable modules (this must be after session_start and after conf has been loaded)
if (GETPOSTISSET('disablemodules')) {
$_SESSION["disablemodules"] = GETPOST('disablemodules', 'alpha');
}
if (!empty($_SESSION["disablemodules"])) {
$modulepartkeys = array('css', 'js', 'tabs', 'triggers', 'login', 'substitutions', 'menus', 'theme', 'sms', 'tpl', 'barcode', 'models', 'societe', 'hooks', 'dir', 'syslog', 'tpllinkable', 'contactelement', 'moduleforexternal', 'websitetemplates');
$disabled_modules = explode(',', $_SESSION["disablemodules"]);
foreach ($disabled_modules as $module) {
if ($module) {
if (empty($conf->$module)) {
$conf->$module = new stdClass(); // To avoid warnings
}
$disabled_modules = explode(',', $_SESSION["disablemodules"]);
foreach ($disabled_modules as $module) {
if ($module) {
if (empty($conf->$module)) {
$conf->$module = new stdClass(); // To avoid warnings
}
$conf->$module->enabled = false; // Old usage
unset($conf->modules[$module]);
$conf->$module->enabled = false; // Old usage
unset($conf->modules[$module]);
foreach ($modulepartkeys as $modulepartkey) {
unset($conf->modules_parts[$modulepartkey][$module]);
}
if ($module == 'fournisseur') { // Special case
$conf->supplier_order->enabled = 0; // Old usage
$conf->supplier_invoice->enabled = 0; // Old usage
unset($conf->modules['supplier_order']);
unset($conf->modules['supplier_invoice']);
foreach ($modulepartkeys as $modulepartkey) {
unset($conf->modules_parts[$modulepartkey][$module]);
}
if ($module == 'fournisseur') { // Special case
$conf->supplier_order->enabled = 0; // Old usage
$conf->supplier_invoice->enabled = 0; // Old usage
unset($conf->modules['supplier_order']);
unset($conf->modules['supplier_invoice']);
}
}
}
}