diff --git a/htdocs/admin/system/security.php b/htdocs/admin/system/security.php index cf8d89740d2..7f6b39fef35 100644 --- a/htdocs/admin/system/security.php +++ b/htdocs/admin/system/security.php @@ -1036,11 +1036,6 @@ print 'MAIN_ALLOW_OBFUSCATION_METHODS_IN_DOL_EVAL = '.getDolGlo print '   ('.$langs->trans("Recommended").": ".$langs->trans("Undefined").' '.$langs->trans("or")." 0 - The value 1 allows the use of concatenation functions like . or dol_concat into extra fields conditions or formula but is not secured)
"; print '
'; -print 'MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER = '.getDolGlobalString('MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER', ''.$langs->trans("Undefined").''); -print '   ('.$langs->trans("Recommended").": 1 - The value 0 allows the use of subrequests into extrafields conditions. It remains not possible in API filters to avoid bind SQL injections whatever is this value)
"; -print '
'; - - // MAIN_ALLOW_LOCAL_LINKS_AS_EXTERNAL_LINKS print 'MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL = '.getDolGlobalString('MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL', ''.$langs->trans("Undefined").'   ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 0)')."
"; diff --git a/htdocs/api/index.php b/htdocs/api/index.php index a2e43a37df4..45b4bd7bf9e 100644 --- a/htdocs/api/index.php +++ b/htdocs/api/index.php @@ -119,7 +119,8 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php'; // In API context, we force the protection to avoid forging of criteria including bind SQL injection -$conf->global->MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER = 1; +global $dolibarr_allow_unsecured_select_in_extrafields_filter; +$dolibarr_allow_unsecured_select_in_extrafields_filter = 0; $url = $_SERVER['PHP_SELF']; diff --git a/htdocs/core/ajax/ajaxextrafield.php b/htdocs/core/ajax/ajaxextrafield.php index 3ec67801286..0e8bf9c9df2 100644 --- a/htdocs/core/ajax/ajaxextrafield.php +++ b/htdocs/core/ajax/ajaxextrafield.php @@ -196,8 +196,9 @@ if ($object instanceof CommonObject) { if (strpos($InfoFieldList[4], '$ENTITY$') !== false) { $InfoFieldList[4] = str_replace('$ENTITY$', (string) $conf->entity, $InfoFieldList[4]); } - // can use SELECT request - if (!getDolGlobalString("MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER")) { + // can use SELECT sub request + global $dolibarr_allow_unsecured_select_in_extrafields_filter; + if (!empty($dolibarr_allow_unsecured_select_in_extrafields_filter)) { if (strpos($InfoFieldList[4], '$SEL$') !== false) { $InfoFieldList[4] = str_replace('$SEL$', 'SELECT', $InfoFieldList[4]); } diff --git a/htdocs/core/class/conf.class.php b/htdocs/core/class/conf.class.php index 53741add837..de4990b11e8 100644 --- a/htdocs/core/class/conf.class.php +++ b/htdocs/core/class/conf.class.php @@ -1383,11 +1383,6 @@ class Conf extends stdClass $this->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1; } - if (!isset($this->global->MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER)) { - // Note value is always forced to 1 in API and customreport context to avoid bind SQL injection into user input filters. - $this->global->MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER = 1; - } - if (getDolGlobalString('PRODUIT_MULTIPRICES') || getDolGlobalString('PRODUIT_CUSTOMER_PRICES_BY_QTY_MULTIPRICES') || getDolGlobalString('PRODUIT_CUSTOMER_PRICES_AND_MULTIPRICES')) { // In on of this customer price modes, option PRODUCT_USE_CUSTOMER_PACKAGING is not implemented/supported, so we disable it $this->global->PRODUCT_USE_CUSTOMER_PACKAGING = 0; diff --git a/htdocs/core/class/extrafields.class.php b/htdocs/core/class/extrafields.class.php index 1727c308559..0a6cb981d55 100644 --- a/htdocs/core/class/extrafields.class.php +++ b/htdocs/core/class/extrafields.class.php @@ -1593,7 +1593,8 @@ class ExtraFields $InfoFieldList[4] = str_replace('$ENTITY$', (string) $conf->entity, $InfoFieldList[4]); } // can use SELECT request - if (!getDolGlobalString("MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER")) { + global $dolibarr_allow_unsecured_select_in_extrafields_filter; + if (!empty($dolibarr_allow_unsecured_select_in_extrafields_filter)) { if (strpos($InfoFieldList[4], '$SEL$') !== false) { $InfoFieldList[4] = str_replace('$SEL$', 'SELECT', $InfoFieldList[4]); } diff --git a/htdocs/core/class/fields/commonsellistfield.class.php b/htdocs/core/class/fields/commonsellistfield.class.php index b67805db073..436298962f6 100644 --- a/htdocs/core/class/fields/commonsellistfield.class.php +++ b/htdocs/core/class/fields/commonsellistfield.class.php @@ -247,7 +247,8 @@ class CommonSellistField extends CommonField $filter = str_replace('$ENTITY$', (string) $conf->entity, $filter); } // can use SELECT request - if (strpos($filter, '$SEL$') !== false && !getDolGlobalString("MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER")) { + global $dolibarr_allow_unsecured_select_in_extrafields_filter; + if (strpos($filter, '$SEL$') !== false && !empty($dolibarr_allow_unsecured_select_in_extrafields_filter)) { $filter = str_replace('$SEL$', 'SELECT', $filter); } // can use MODE parameter (list or view) diff --git a/htdocs/core/customreports.php b/htdocs/core/customreports.php index c2c9fa2e7ce..b8f3785aed8 100644 --- a/htdocs/core/customreports.php +++ b/htdocs/core/customreports.php @@ -123,7 +123,8 @@ if (!defined('USE_CUSTOM_REPORT_AS_INCLUDE')) { } // In customreport context, we force the protection to avoid forging of criteria including bind SQL injection -$conf->global->MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER = 1; +global $dolibarr_allow_unsecured_select_in_extrafields_filter; +$dolibarr_allow_unsecured_select_in_extrafields_filter = 0; if (empty($mode)) { $mode = 'graph'; diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 72120399f5f..3cde4612423 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -16146,7 +16146,9 @@ function dolForgeSQLCriteriaCallback($matches) $regbis = array(); - if ($operator == 'IN' || $operator == 'NOT IN') { // IN is allowed for list of ID/code/field only (or subrequest if MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTERnot enabled) + if ($operator == 'IN' || $operator == 'NOT IN') { // IN is allowed for list of ID/code/field only (or subrequest if $dolibarr_allow_unsecured_select_in_extrafields_filter not enabled) + global $dolibarr_allow_unsecured_select_in_extrafields_filter; + //if (!preg_match('/^\(.*\)$/', $tmpescaped)) { $tmpescaped2 = '('; // Explode and sanitize each element in list @@ -16160,7 +16162,7 @@ function dolForgeSQLCriteriaCallback($matches) $tmpelemarray[$tmpkey] = (int) $tmpelem; } elseif (is_numeric((string) $tmpelem)) { // it can be a float with a . $tmpelemarray[$tmpkey] = (float) $tmpelem; - } elseif (!getDolGlobalString("MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER")) { + } elseif (!empty($dolibarr_allow_unsecured_select_in_extrafields_filter)) { $tmpelemarray[$tmpkey] = preg_replace('/[^a-z0-9_<>=!\s]/i', '', $tmpelem); // it can be a full subrequest (should be removed in a future as it allows blind SQL injection) } else { $tmpelemarray[$tmpkey] = preg_replace('/[^a-z0-9_]/i', '', $tmpelem); // it can be a name of field or a substitution variable like '__NOW__' diff --git a/htdocs/filefunc.inc.php b/htdocs/filefunc.inc.php index 7ec2803862a..5b1409d12d1 100644 --- a/htdocs/filefunc.inc.php +++ b/htdocs/filefunc.inc.php @@ -158,6 +158,7 @@ $result = @include_once $conffile; // Keep @ because with some error reporting m * @var ?string $dolibarr_mailing_limit_sendbyweb * @var ?string $dolibarr_mailing_limit_sendbycli * @var ?string $dolibarr_mailing_limit_sendbyday + * @var ?string $dolibarr_allow_unsecured_select_in_extrafields_filter; * @var ?string $dolibarr_nocsrfcheck * * @var ?string $dolibarr_font_DOL_DEFAULT_TTF diff --git a/htdocs/master.inc.php b/htdocs/master.inc.php index 92242de7d79..eff2c682bae 100644 --- a/htdocs/master.inc.php +++ b/htdocs/master.inc.php @@ -62,6 +62,7 @@ require_once 'filefunc.inc.php'; * @var string $dolibarr_main_url_root * @var string $dolibarr_main_url_root_alt * @var string $dolibarr_main_document_root_alt + * @var string $dolibarr_allow_unsecured_select_in_extrafields_filter; * @var string|string[] $dolibarr_main_stream_to_disable */ '