From 621da6eb0d5f248cd677e39afc6437e1109bb789 Mon Sep 17 00:00:00 2001 From: Lucas Marcouiller Date: Fri, 28 Nov 2025 11:19:16 +0100 Subject: [PATCH 1/4] Fix prevent use of TRACE method in waf --- htdocs/waf.inc.php | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/htdocs/waf.inc.php b/htdocs/waf.inc.php index f514b46af26..60fc4e9c453 100644 --- a/htdocs/waf.inc.php +++ b/htdocs/waf.inc.php @@ -309,6 +309,13 @@ function analyseVarsForSqlAndScriptsInjection(&$var, $type, $stopcode = 1) } } +// Prevent the use of method TRACE +if ($_SERVER["REQUEST_METHOD"] == "TRACE") { + print 'Access refused with request method TRACE'; + http_response_code(405); + exit(); +} + // Sanity check on URL if (!defined('NOSCANPHPSELFFORINJECTION') && !empty($_SERVER["PHP_SELF"])) { $morevaltochecklikepost = array($_SERVER["PHP_SELF"]); From d43e697a10bfe542fbc3b56fe45d2b6af7b20c11 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9mi=20Champlon?= Date: Fri, 28 Nov 2025 15:14:29 +0100 Subject: [PATCH 2/4] implem --- .../societe/class/api_thirdparties.class.php | 33 +++++++++++++------ 1 file changed, 23 insertions(+), 10 deletions(-) diff --git a/htdocs/societe/class/api_thirdparties.class.php b/htdocs/societe/class/api_thirdparties.class.php index 4e83728ff7d..1f516b98798 100644 --- a/htdocs/societe/class/api_thirdparties.class.php +++ b/htdocs/societe/class/api_thirdparties.class.php @@ -1094,6 +1094,7 @@ class Thirdparties extends DolibarrApi * @since 7.0.0 Initial implementation * * @param int $id ID of the third party + * @param string $mode 'customer' or 'supplier' * @param string $filter Filter exceptional discount. "none" will return every discount, "available" returns unapplied discounts, "used" returns applied discounts {@choice none,available,used} * @param string $sortfield Sort field * @param string $sortorder Sort order @@ -1109,7 +1110,7 @@ class Thirdparties extends DolibarrApi * @throws RestException 404 * @throws RestException 503 */ - public function getFixedAmountDiscounts($id, $filter = "none", $sortfield = "f.type", $sortorder = 'ASC') + public function getFixedAmountDiscounts($id, $mode = 'customer', $filter = "none", $sortfield = "f.type", $sortorder = 'ASC') { $obj_ret = array(); @@ -1130,15 +1131,27 @@ class Thirdparties extends DolibarrApi throw new RestException(404, 'Thirdparty not found'); } - - $sql = "SELECT f.ref, f.type as factype, re.fk_facture_source, re.rowid, re.amount_ht, re.amount_tva, re.amount_ttc, re.description, re.fk_facture, re.fk_facture_line"; - $sql .= " FROM ".MAIN_DB_PREFIX."societe_remise_except as re, ".MAIN_DB_PREFIX."facture as f"; - $sql .= " WHERE f.rowid = re.fk_facture_source AND re.fk_soc = ".((int) $id); - if ($filter == "available") { - $sql .= " AND re.fk_facture IS NULL AND re.fk_facture_line IS NULL"; - } - if ($filter == "used") { - $sql .= " AND (re.fk_facture IS NOT NULL OR re.fk_facture_line IS NOT NULL)"; + $sql = ''; + if ($mode === 'customer') { + $sql = "SELECT f.ref, f.type as factype, re.fk_facture_source, re.rowid, re.amount_ht, re.amount_tva, re.amount_ttc, re.description, re.fk_facture, re.fk_facture_line"; + $sql .= " FROM ".MAIN_DB_PREFIX."societe_remise_except as re, ".MAIN_DB_PREFIX."facture as f"; + $sql .= " WHERE f.rowid = re.fk_facture_source AND re.fk_soc = ".((int) $id); + if ($filter == "available") { + $sql .= " AND re.fk_facture IS NULL AND re.fk_facture_line IS NULL"; + } + if ($filter == "used") { + $sql .= " AND (re.fk_facture IS NOT NULL OR re.fk_facture_line IS NOT NULL)"; + } + }elseif ($mode === 'supplier') { + $sql = "SELECT f.ref, f.type as factype, re.fk_invoice_supplier_source, re.rowid, re.amount_ht, re.amount_tva, re.amount_ttc, re.description, re.fk_invoice_supplier, re.fk_invoice_supplier_line"; + $sql .= " FROM ".MAIN_DB_PREFIX."societe_remise_except as re, ".MAIN_DB_PREFIX."facture_fourn as f"; + $sql .= " WHERE f.rowid = re.fk_invoice_supplier_source AND re.fk_soc = ".((int) $id); + if ($filter == "available") { + $sql .= " AND re.fk_invoice_supplier IS NULL AND re.fk_invoice_supplier_line IS NULL"; + } + if ($filter == "used") { + $sql .= " AND (re.fk_invoice_supplier IS NOT NULL OR re.fk_invoice_supplier_line IS NOT NULL)"; + } } $sql .= $this->db->order($sortfield, $sortorder); From 7ffb16abef16f3b37776ce7119f482314c53e508 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9mi=20Champlon?= Date: Fri, 28 Nov 2025 15:25:15 +0100 Subject: [PATCH 3/4] fix space --- htdocs/societe/class/api_thirdparties.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/societe/class/api_thirdparties.class.php b/htdocs/societe/class/api_thirdparties.class.php index 1f516b98798..35f9a619546 100644 --- a/htdocs/societe/class/api_thirdparties.class.php +++ b/htdocs/societe/class/api_thirdparties.class.php @@ -1110,7 +1110,7 @@ class Thirdparties extends DolibarrApi * @throws RestException 404 * @throws RestException 503 */ - public function getFixedAmountDiscounts($id, $mode = 'customer', $filter = "none", $sortfield = "f.type", $sortorder = 'ASC') + public function getFixedAmountDiscounts($id, $mode = 'customer', $filter = "none", $sortfield = "f.type", $sortorder = 'ASC') { $obj_ret = array(); From e3fbe0943e6af271269d7bf879760ed588d8a069 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9mi=20Champlon?= Date: Fri, 28 Nov 2025 15:40:57 +0100 Subject: [PATCH 4/4] fix space --- htdocs/societe/class/api_thirdparties.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/societe/class/api_thirdparties.class.php b/htdocs/societe/class/api_thirdparties.class.php index 35f9a619546..136add22e74 100644 --- a/htdocs/societe/class/api_thirdparties.class.php +++ b/htdocs/societe/class/api_thirdparties.class.php @@ -1142,7 +1142,7 @@ class Thirdparties extends DolibarrApi if ($filter == "used") { $sql .= " AND (re.fk_facture IS NOT NULL OR re.fk_facture_line IS NOT NULL)"; } - }elseif ($mode === 'supplier') { + } elseif ($mode === 'supplier') { $sql = "SELECT f.ref, f.type as factype, re.fk_invoice_supplier_source, re.rowid, re.amount_ht, re.amount_tva, re.amount_ttc, re.description, re.fk_invoice_supplier, re.fk_invoice_supplier_line"; $sql .= " FROM ".MAIN_DB_PREFIX."societe_remise_except as re, ".MAIN_DB_PREFIX."facture_fourn as f"; $sql .= " WHERE f.rowid = re.fk_invoice_supplier_source AND re.fk_soc = ".((int) $id);