diff --git a/htdocs/admin/system/security.php b/htdocs/admin/system/security.php
index cf8d89740d2..7f6b39fef35 100644
--- a/htdocs/admin/system/security.php
+++ b/htdocs/admin/system/security.php
@@ -1036,11 +1036,6 @@ print 'MAIN_ALLOW_OBFUSCATION_METHODS_IN_DOL_EVAL = '.getDolGlo
print ' ('.$langs->trans("Recommended").": ".$langs->trans("Undefined").' '.$langs->trans("or")." 0 - The value 1 allows the use of concatenation functions like . or dol_concat into extra fields conditions or formula but is not secured)
";
print '
';
-print 'MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER = '.getDolGlobalString('MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER', ''.$langs->trans("Undefined").'');
-print ' ('.$langs->trans("Recommended").": 1 - The value 0 allows the use of subrequests into extrafields conditions. It remains not possible in API filters to avoid bind SQL injections whatever is this value)
";
-print '
';
-
-
// MAIN_ALLOW_LOCAL_LINKS_AS_EXTERNAL_LINKS
print 'MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL = '.getDolGlobalString('MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL', ''.$langs->trans("Undefined").' ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 0)')."
";
diff --git a/htdocs/api/index.php b/htdocs/api/index.php
index a2e43a37df4..45b4bd7bf9e 100644
--- a/htdocs/api/index.php
+++ b/htdocs/api/index.php
@@ -119,7 +119,8 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php';
// In API context, we force the protection to avoid forging of criteria including bind SQL injection
-$conf->global->MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER = 1;
+global $dolibarr_allow_unsecured_select_in_extrafields_filter;
+$dolibarr_allow_unsecured_select_in_extrafields_filter = 0;
$url = $_SERVER['PHP_SELF'];
diff --git a/htdocs/core/ajax/ajaxextrafield.php b/htdocs/core/ajax/ajaxextrafield.php
index 3ec67801286..0e8bf9c9df2 100644
--- a/htdocs/core/ajax/ajaxextrafield.php
+++ b/htdocs/core/ajax/ajaxextrafield.php
@@ -196,8 +196,9 @@ if ($object instanceof CommonObject) {
if (strpos($InfoFieldList[4], '$ENTITY$') !== false) {
$InfoFieldList[4] = str_replace('$ENTITY$', (string) $conf->entity, $InfoFieldList[4]);
}
- // can use SELECT request
- if (!getDolGlobalString("MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER")) {
+ // can use SELECT sub request
+ global $dolibarr_allow_unsecured_select_in_extrafields_filter;
+ if (!empty($dolibarr_allow_unsecured_select_in_extrafields_filter)) {
if (strpos($InfoFieldList[4], '$SEL$') !== false) {
$InfoFieldList[4] = str_replace('$SEL$', 'SELECT', $InfoFieldList[4]);
}
diff --git a/htdocs/core/class/conf.class.php b/htdocs/core/class/conf.class.php
index 53741add837..de4990b11e8 100644
--- a/htdocs/core/class/conf.class.php
+++ b/htdocs/core/class/conf.class.php
@@ -1383,11 +1383,6 @@ class Conf extends stdClass
$this->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1;
}
- if (!isset($this->global->MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER)) {
- // Note value is always forced to 1 in API and customreport context to avoid bind SQL injection into user input filters.
- $this->global->MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER = 1;
- }
-
if (getDolGlobalString('PRODUIT_MULTIPRICES') || getDolGlobalString('PRODUIT_CUSTOMER_PRICES_BY_QTY_MULTIPRICES') || getDolGlobalString('PRODUIT_CUSTOMER_PRICES_AND_MULTIPRICES')) {
// In on of this customer price modes, option PRODUCT_USE_CUSTOMER_PACKAGING is not implemented/supported, so we disable it
$this->global->PRODUCT_USE_CUSTOMER_PACKAGING = 0;
diff --git a/htdocs/core/class/extrafields.class.php b/htdocs/core/class/extrafields.class.php
index 1727c308559..0a6cb981d55 100644
--- a/htdocs/core/class/extrafields.class.php
+++ b/htdocs/core/class/extrafields.class.php
@@ -1593,7 +1593,8 @@ class ExtraFields
$InfoFieldList[4] = str_replace('$ENTITY$', (string) $conf->entity, $InfoFieldList[4]);
}
// can use SELECT request
- if (!getDolGlobalString("MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER")) {
+ global $dolibarr_allow_unsecured_select_in_extrafields_filter;
+ if (!empty($dolibarr_allow_unsecured_select_in_extrafields_filter)) {
if (strpos($InfoFieldList[4], '$SEL$') !== false) {
$InfoFieldList[4] = str_replace('$SEL$', 'SELECT', $InfoFieldList[4]);
}
diff --git a/htdocs/core/class/fields/commonsellistfield.class.php b/htdocs/core/class/fields/commonsellistfield.class.php
index b67805db073..436298962f6 100644
--- a/htdocs/core/class/fields/commonsellistfield.class.php
+++ b/htdocs/core/class/fields/commonsellistfield.class.php
@@ -247,7 +247,8 @@ class CommonSellistField extends CommonField
$filter = str_replace('$ENTITY$', (string) $conf->entity, $filter);
}
// can use SELECT request
- if (strpos($filter, '$SEL$') !== false && !getDolGlobalString("MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER")) {
+ global $dolibarr_allow_unsecured_select_in_extrafields_filter;
+ if (strpos($filter, '$SEL$') !== false && !empty($dolibarr_allow_unsecured_select_in_extrafields_filter)) {
$filter = str_replace('$SEL$', 'SELECT', $filter);
}
// can use MODE parameter (list or view)
diff --git a/htdocs/core/customreports.php b/htdocs/core/customreports.php
index c2c9fa2e7ce..b8f3785aed8 100644
--- a/htdocs/core/customreports.php
+++ b/htdocs/core/customreports.php
@@ -123,7 +123,8 @@ if (!defined('USE_CUSTOM_REPORT_AS_INCLUDE')) {
}
// In customreport context, we force the protection to avoid forging of criteria including bind SQL injection
-$conf->global->MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER = 1;
+global $dolibarr_allow_unsecured_select_in_extrafields_filter;
+$dolibarr_allow_unsecured_select_in_extrafields_filter = 0;
if (empty($mode)) {
$mode = 'graph';
diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index 72120399f5f..3cde4612423 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -16146,7 +16146,9 @@ function dolForgeSQLCriteriaCallback($matches)
$regbis = array();
- if ($operator == 'IN' || $operator == 'NOT IN') { // IN is allowed for list of ID/code/field only (or subrequest if MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTERnot enabled)
+ if ($operator == 'IN' || $operator == 'NOT IN') { // IN is allowed for list of ID/code/field only (or subrequest if $dolibarr_allow_unsecured_select_in_extrafields_filter not enabled)
+ global $dolibarr_allow_unsecured_select_in_extrafields_filter;
+
//if (!preg_match('/^\(.*\)$/', $tmpescaped)) {
$tmpescaped2 = '(';
// Explode and sanitize each element in list
@@ -16160,7 +16162,7 @@ function dolForgeSQLCriteriaCallback($matches)
$tmpelemarray[$tmpkey] = (int) $tmpelem;
} elseif (is_numeric((string) $tmpelem)) { // it can be a float with a .
$tmpelemarray[$tmpkey] = (float) $tmpelem;
- } elseif (!getDolGlobalString("MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER")) {
+ } elseif (!empty($dolibarr_allow_unsecured_select_in_extrafields_filter)) {
$tmpelemarray[$tmpkey] = preg_replace('/[^a-z0-9_<>=!\s]/i', '', $tmpelem); // it can be a full subrequest (should be removed in a future as it allows blind SQL injection)
} else {
$tmpelemarray[$tmpkey] = preg_replace('/[^a-z0-9_]/i', '', $tmpelem); // it can be a name of field or a substitution variable like '__NOW__'
diff --git a/htdocs/filefunc.inc.php b/htdocs/filefunc.inc.php
index 7ec2803862a..5b1409d12d1 100644
--- a/htdocs/filefunc.inc.php
+++ b/htdocs/filefunc.inc.php
@@ -158,6 +158,7 @@ $result = @include_once $conffile; // Keep @ because with some error reporting m
* @var ?string $dolibarr_mailing_limit_sendbyweb
* @var ?string $dolibarr_mailing_limit_sendbycli
* @var ?string $dolibarr_mailing_limit_sendbyday
+ * @var ?string $dolibarr_allow_unsecured_select_in_extrafields_filter;
* @var ?string $dolibarr_nocsrfcheck
*
* @var ?string $dolibarr_font_DOL_DEFAULT_TTF
diff --git a/htdocs/master.inc.php b/htdocs/master.inc.php
index 92242de7d79..eff2c682bae 100644
--- a/htdocs/master.inc.php
+++ b/htdocs/master.inc.php
@@ -62,6 +62,7 @@ require_once 'filefunc.inc.php';
* @var string $dolibarr_main_url_root
* @var string $dolibarr_main_url_root_alt
* @var string $dolibarr_main_document_root_alt
+ * @var string $dolibarr_allow_unsecured_select_in_extrafields_filter;
* @var string|string[] $dolibarr_main_stream_to_disable
*/
'