From 41dfccfc1429cc2f07c1cb33de7dbd9aebe457bc Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Sat, 15 Aug 2026 16:53:30 +0200
Subject: [PATCH] Complete #39546 and #39547

---
 htdocs/core/lib/functions.lib.php | 12 ++++++------
 test/phpunit/SecurityTest.php     | 17 +++++++++++++----
 2 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index 50096ad8d3f..269761ac776 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -12143,7 +12143,7 @@ function dol_eval_new($s)
 
 	$forbiddenphpmethods = array_merge($forbiddenphpmethods, array('invoke', 'invokeArgs'));	// Methods of ReflectionFunction to execute a function
 
-	$prohibited_functions = array($forbiddenphpfunctions, $forbiddenphpfunctions);
+	$prohibited_functions = array_merge($forbiddenphpfunctions, $forbiddenphpmethods);
 
 	$prohibited_token_arrangements = [
 		// Variable functions "$a(", '"$a"(', "'FN_NAME'(", ('FN_NAME')()
@@ -12182,7 +12182,7 @@ function dol_eval_new($s)
 			T_VARIABLE === $token_id
 			&& in_array($token_value, $prohibited_variables, true)
 		) {
-			return "« {$token_value} » is prohibited in « {$s} »";
+			return "Bad string syntax to evaluate. « {$token_value} » is prohibited in « {$s} »";
 		}
 
 		// Prohibited Functions
@@ -12190,7 +12190,7 @@ function dol_eval_new($s)
 			T_STRING === $token_id
 			&& in_array($token_value, $prohibited_functions, true)
 		) {
-			return "« {$token_value} » is prohibited in « {$s} »";
+			return "Bad string syntax to evaluate. « {$token_value} » is prohibited in « {$s} »";
 		}
 	}
 
@@ -12198,7 +12198,7 @@ function dol_eval_new($s)
 	$maxi = count($prohibited_token_ids);
 	for ($i = 0; $i < $maxi; ++$i) {
 		if (false !== strpos($tokens_arrangement, " {$prohibited_token_ids[$i]} ")) {
-			return "« {$prohibited_token_ids[$i]} » is prohibited in « {$s} »";
+			return "Bad string syntax to evaluate. « {$prohibited_token_ids[$i]} » is prohibited in « {$s} »";
 		}
 	}
 
@@ -12206,7 +12206,7 @@ function dol_eval_new($s)
 	$maxi = count($prohibited_token_arrangements);
 	for ($i = 0; $i < $maxi; ++$i) {
 		if (false !== strpos($tokens_arrangement, $prohibited_token_arrangements[$i])) {
-			return "« {$prohibited_token_arrangements[$i]} » is prohibited in « {$s} »";
+			return "Bad string syntax to evaluate. « {$prohibited_token_arrangements[$i]} » is prohibited in « {$s} »";
 		}
 	}
 
@@ -12214,7 +12214,7 @@ function dol_eval_new($s)
 	try {
 		return @eval("return {$s};") ?? '';
 	} catch (Throwable $ex) {
-		return "Exception during evaluation: " . $s . " - " . $ex->getMessage();
+		return "Bad string syntax to evaluate. Exception during evaluation: " . $s . " - " . $ex->getMessage();
 	}
 }
 
diff --git a/test/phpunit/SecurityTest.php b/test/phpunit/SecurityTest.php
index 3a81ac607c2..a27be25e919 100644
--- a/test/phpunit/SecurityTest.php
+++ b/test/phpunit/SecurityTest.php
@@ -578,7 +578,11 @@ class SecurityTest extends CommonClassTest
 		include_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php';
 		include_once DOL_DOCUMENT_ROOT.'/projet/class/task.class.php';
 
-		$conf->global->MAIN_USE_DOL_EVAL_NEW = 0;
+
+		global $dolibarr_main_use_dol_eval_new;
+		$dolibarr_main_use_dol_eval_new = 0;
+
+
 		//$conf->global->MAIN_USE_DOL_EVAL_NEW = 1;
 		$conf->global->MAIN_ALLOW_DOUBLE_COLON_IN_DOL_EVAL = 0;
 		$conf->global->MAIN_ALLOW_OBFUSCATION_METHODS_IN_DOL_EVAL = 1;
@@ -886,6 +890,7 @@ class SecurityTest extends CommonClassTest
 	 * name reached indirectly by a PHP callable-dispatch function like array_map/usort/...
 	 * instead of a direct call.
 	 *
+	 * @depends	testDolEval
 	 * @return void
 	 */
 	public function testDolEvalNew()
@@ -896,11 +901,15 @@ class SecurityTest extends CommonClassTest
 		$langs = $this->savlangs;
 		$db = $this->savdb;
 
-		$conf->global->MAIN_USE_DOL_EVAL_NEW = 1;
 
-		$result = (string) dol_eval("array_map('sys'.'tem', array('id'))", 1, 1, '0');
+		global $dolibarr_main_use_dol_eval_new;
+		$dolibarr_main_use_dol_eval_new = 1;
+
+
+		$s = "array_map('sys'.'tem', array('id'))";
+		$result = (string) dol_eval($s, 1, 1, '0');
 		print "resultnew1 = ".$result."\n";
-		$this->assertStringContainsString('is prohibited', $result, 'The string was not detected as evil - array_map bypass');
+		$this->assertStringContainsString('is prohibited', $result, 'The string '.$s.' returned '.$result.', so was not detected as evil - array_map bypass');
 
 		$result = (string) dol_eval("usort(\$a, 'system')", 1, 1, '0');
 		print "resultnew2 = ".$result."\n";