vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NEW Move deprecated option

Browse source 
MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER into conf.php
file.
This commit is contained in:
Laurent Destailleur 2026-03-25 22:33:03 +01:00
parent d506dc450f
commit 3fb593e758
10 changed files with 17 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
htdocs/admin/system/security.php
View file

@ -1036,11 +1036,6 @@ print '<strong>MAIN_ALLOW_OBFUSCATION_METHODS_IN_DOL_EVAL</strong> = '.getDolGlo
print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").": ".$langs->trans("Undefined").' '.$langs->trans("or")." 0 - The value 1 allows the use of concatenation functions like . or dol_concat into extra fields conditions or formula but is not secured)</span><br>";
print '<br>';
print '<strong>MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER</strong> = '.getDolGlobalString('MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").": 1 - The value 0 allows the use of subrequests into extrafields conditions. It remains not possible in API filters to avoid bind SQL injections whatever is this value)</span><br>";
print '<br>';
// MAIN_ALLOW_LOCAL_LINKS_AS_EXTERNAL_LINKS
print '<strong>MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL</strong> = '.getDolGlobalString('MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 0)</span>')."<br>";

3
htdocs/api/index.php
View file

@ -119,7 +119,8 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php';
// In API context, we force the protection to avoid forging of criteria including bind SQL injection
$conf->global->MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER = 1;
global $dolibarr_allow_unsecured_select_in_extrafields_filter;
$dolibarr_allow_unsecured_select_in_extrafields_filter = 0;
$url = $_SERVER['PHP_SELF'];

5
htdocs/core/ajax/ajaxextrafield.php
View file

@ -196,8 +196,9 @@ if ($object instanceof CommonObject) {
if (strpos($InfoFieldList[4], '$ENTITY$') !== false) {
$InfoFieldList[4] = str_replace('$ENTITY$', (string) $conf->entity, $InfoFieldList[4]);
}
// can use SELECT request
if (!getDolGlobalString("MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER")) {
// can use SELECT sub request
global $dolibarr_allow_unsecured_select_in_extrafields_filter;
if (!empty($dolibarr_allow_unsecured_select_in_extrafields_filter)) {
if (strpos($InfoFieldList[4], '$SEL$') !== false) {
$InfoFieldList[4] = str_replace('$SEL$', 'SELECT', $InfoFieldList[4]);
}

5
htdocs/core/class/conf.class.php
View file

@ -1383,11 +1383,6 @@ class Conf extends stdClass
$this->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1;
}
if (!isset($this->global->MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER)) {
// Note value is always forced to 1 in API and customreport context to avoid bind SQL injection into user input filters.
$this->global->MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER = 1;
}
if (getDolGlobalString('PRODUIT_MULTIPRICES') || getDolGlobalString('PRODUIT_CUSTOMER_PRICES_BY_QTY_MULTIPRICES') || getDolGlobalString('PRODUIT_CUSTOMER_PRICES_AND_MULTIPRICES')) {
// In on of this customer price modes, option PRODUCT_USE_CUSTOMER_PACKAGING is not implemented/supported, so we disable it
$this->global->PRODUCT_USE_CUSTOMER_PACKAGING = 0;

3
htdocs/core/class/extrafields.class.php
View file

@ -1593,7 +1593,8 @@ class ExtraFields
$InfoFieldList[4] = str_replace('$ENTITY$', (string) $conf->entity, $InfoFieldList[4]);
}
// can use SELECT request
if (!getDolGlobalString("MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER")) {
global $dolibarr_allow_unsecured_select_in_extrafields_filter;
if (!empty($dolibarr_allow_unsecured_select_in_extrafields_filter)) {
if (strpos($InfoFieldList[4], '$SEL$') !== false) {
$InfoFieldList[4] = str_replace('$SEL$', 'SELECT', $InfoFieldList[4]);
}

3
htdocs/core/class/fields/commonsellistfield.class.php
View file

@ -247,7 +247,8 @@ class CommonSellistField extends CommonField
$filter = str_replace('$ENTITY$', (string) $conf->entity, $filter);
}
// can use SELECT request
if (strpos($filter, '$SEL$') !== false && !getDolGlobalString("MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER")) {
global $dolibarr_allow_unsecured_select_in_extrafields_filter;
if (strpos($filter, '$SEL$') !== false && !empty($dolibarr_allow_unsecured_select_in_extrafields_filter)) {
$filter = str_replace('$SEL$', 'SELECT', $filter);
}
// can use MODE parameter (list or view)

3
htdocs/core/customreports.php
View file

@ -123,7 +123,8 @@ if (!defined('USE_CUSTOM_REPORT_AS_INCLUDE')) {
}
// In customreport context, we force the protection to avoid forging of criteria including bind SQL injection
$conf->global->MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER = 1;
global $dolibarr_allow_unsecured_select_in_extrafields_filter;
$dolibarr_allow_unsecured_select_in_extrafields_filter = 0;
if (empty($mode)) {
$mode = 'graph';

6
htdocs/core/lib/functions.lib.php
View file

@ -16146,7 +16146,9 @@ function dolForgeSQLCriteriaCallback($matches)
$regbis = array();
if ($operator == 'IN' || $operator == 'NOT IN') { // IN is allowed for list of ID/code/field only (or subrequest if MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTERnot enabled)
if ($operator == 'IN' || $operator == 'NOT IN') { // IN is allowed for list of ID/code/field only (or subrequest if $dolibarr_allow_unsecured_select_in_extrafields_filter not enabled)
global $dolibarr_allow_unsecured_select_in_extrafields_filter;
//if (!preg_match('/^\(.*\)$/', $tmpescaped)) {
$tmpescaped2 = '(';
// Explode and sanitize each element in list
@ -16160,7 +16162,7 @@ function dolForgeSQLCriteriaCallback($matches)
$tmpelemarray[$tmpkey] = (int) $tmpelem;
} elseif (is_numeric((string) $tmpelem)) { // it can be a float with a .
$tmpelemarray[$tmpkey] = (float) $tmpelem;
} elseif (!getDolGlobalString("MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER")) {
} elseif (!empty($dolibarr_allow_unsecured_select_in_extrafields_filter)) {
$tmpelemarray[$tmpkey] = preg_replace('/[^a-z0-9_<>=!\s]/i', '', $tmpelem); // it can be a full subrequest (should be removed in a future as it allows blind SQL injection)
} else {
$tmpelemarray[$tmpkey] = preg_replace('/[^a-z0-9_]/i', '', $tmpelem); // it can be a name of field or a substitution variable like '__NOW__'

1
htdocs/filefunc.inc.php
View file

@ -158,6 +158,7 @@ $result = @include_once $conffile; // Keep @ because with some error reporting m
* @var ?string $dolibarr_mailing_limit_sendbyweb
* @var ?string $dolibarr_mailing_limit_sendbycli
* @var ?string $dolibarr_mailing_limit_sendbyday
* @var ?string $dolibarr_allow_unsecured_select_in_extrafields_filter;
* @var ?string $dolibarr_nocsrfcheck
*
* @var ?string $dolibarr_font_DOL_DEFAULT_TTF

1
htdocs/master.inc.php
View file

@ -62,6 +62,7 @@ require_once 'filefunc.inc.php';
* @var string $dolibarr_main_url_root
* @var string $dolibarr_main_url_root_alt
* @var string $dolibarr_main_document_root_alt
* @var string $dolibarr_allow_unsecured_select_in_extrafields_filter;
* @var string|string[] $dolibarr_main_stream_to_disable
*/
'