vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete fix of MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER

Browse source
This commit is contained in:
Laurent Destailleur 2026-03-02 03:17:24 +01:00
parent 7c2e2f4c82
commit 29aceee503
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
htdocs/core/customreports.php
View file

@ -114,6 +114,9 @@ if (!defined('USE_CUSTOM_REPORT_AS_INCLUDE')) {
}
}
// In customreport context, we force the protection to avoid forging of criteria including bind SQL injection
$conf->global->MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER = 1;
if (empty($mode)) {
$mode = 'graph';
}