vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix the http header must reuse the secured one into top_htmlhead()

Browse source
This commit is contained in:
Laurent Destailleur 2024-05-03 03:25:41 +02:00
parent 3edcaf97fc
commit 584e54c130
3 changed files with 43 additions and 43 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
htdocs/filefunc.inc.php
View file

@ -299,7 +299,7 @@ if (!defined('NOCSRFCHECK') && isset($dolibarr_nocsrfcheck) && $dolibarr_nocsrfc
//print 'NOCSRFCHECK='.defined('NOCSRFCHECK').' REQUEST_METHOD='.$_SERVER['REQUEST_METHOD'].' HTTP_HOST='.$_SERVER['HTTP_HOST'].' HTTP_REFERER='.$_SERVER['HTTP_REFERER'];
// Note: We can't use dol_escape_htmltag here to escape output because lib functions.lib.ph is not yet loaded.
dol_syslog("--- Access to ".(empty($_SERVER["REQUEST_METHOD"]) ? '' : $_SERVER["REQUEST_METHOD"].' ').$_SERVER["PHP_SELF"]." refused by CSRF protection (Bad referrer).", LOG_WARNING);
print "Access refused by CSRF protection in main.inc.php. Referrer of form (".htmlentities($_SERVER['HTTP_REFERER'], ENT_COMPAT, 'UTF-8').") is outside the server that serve this page (with method = ".htmlentities($_SERVER['REQUEST_METHOD'], ENT_COMPAT, 'UTF-8').").\n";
print "Access refused by CSRF protection in main.inc.php. Referrer of form (".htmlentities(empty($_SERVER['HTTP_REFERER']) ? '' : $_SERVER['HTTP_REFERER'], ENT_COMPAT, 'UTF-8').") is outside the server that serve this page (with method = ".htmlentities($_SERVER['REQUEST_METHOD'], ENT_COMPAT, 'UTF-8').").\n";
print "If you access your server behind a proxy using url rewriting, you might check that all HTTP headers are propagated (or add the line \$dolibarr_nocsrfcheck=1 into your conf.php file to remove this security check).\n";
die;
}

82
htdocs/public/webportal/tpl/header.tpl.php
View file

@ -1,52 +1,52 @@
<!-- file header.tpl.php -->
<?php
/* Copyright (C) 2024 Laurent Destailleur <eldy@users.sourceforge.net>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
// Protection to avoid direct call of template
if (empty($context) || !is_object($context)) {
print "Error, template page can't be called as URL";
exit(1);
}
global $langs;
?>
<!DOCTYPE html>
<?php print '<html lang="'.substr($langs->defaultlang, 0, 2).'">'."\n"; ?>
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="ie=edge">
<title>
<?php
if (!empty($context->title)) {
print $context->title;
} else {
print 'WebPortal';
}
?>
</title>
<link rel="stylesheet" href="<?php print $context->rootUrl.'css/global.css'; ?>">
<?php
// JNotify
//$jNotifyCSSUrl = $context->rootUrl.'includes/jquery/plugins/jnotify/jquery.jnotify.css';
$jNotifyCSSUrl = dol_buildpath('/includes/jquery/plugins/jnotify/jquery.jnotify.css', 2);
print '<link rel="stylesheet" href="'.$jNotifyCSSUrl.' ">';
?>
<?php
if (getDolGlobalString('WEBPORTAL_CUSTOM_CSS')) {
print '<link rel="stylesheet" type="text/css" href="'.$context->rootUrl.'css/themes/custom.css.php?revision='.getDolGlobalInt('WEBPORTAL_PARAMS_REV').'">'."\n";
}
?>
<?php
// JQuery
//$jQueryJSUrl = $context->rootUrl.'includes/jquery/js/jquery.js';
$jQueryJSUrl = dol_buildpath('/includes/jquery/js/jquery.js', 2);
print '<script src="'.$jQueryJSUrl.'"></script>';
if (!empty($context->title)) {
$title = $context->title;
} else {
$title = 'WebPortal';
}
// JNotify
//$jNotifyJSUrl = $context->rootUrl.'includes/jquery/plugins/jnotify/jquery.jnotify.js';
$jNotifyJSUrl = dol_buildpath('/includes/jquery/plugins/jnotify/jquery.jnotify.js', 2);
print '<script src="'.$jNotifyJSUrl.'"></script>';
?>
</head>
$head = '<link rel="stylesheet" href="'.$context->rootUrl.'css/global.css">'."\n";
//$jNotifyCSSUrl = dol_buildpath('/includes/jquery/plugins/jnotify/jquery.jnotify.css', 2);
//$head .= '<link rel="stylesheet" href="'.$jNotifyCSSUrl.' ">'."\n";
if (getDolGlobalString('WEBPORTAL_CUSTOM_CSS')) {
$head .= '<link rel="stylesheet" type="text/css" href="'.$context->rootUrl.'css/themes/custom.css.php?revision='.getDolGlobalInt('WEBPORTAL_PARAMS_REV').'">'."\n";
}
// JQuery
//$jQueryJSUrl = $context->rootUrl.'includes/jquery/js/jquery.js';
//$jQueryJSUrl = dol_buildpath('/includes/jquery/js/jquery.js', 2);
//$head .= '<script src="'.$jQueryJSUrl.'"></script>'."\n";
// JNotify
//$jNotifyJSUrl = $context->rootUrl.'includes/jquery/plugins/jnotify/jquery.jnotify.js';
//$jNotifyJSUrl = dol_buildpath('/includes/jquery/plugins/jnotify/jquery.jnotify.js', 2);
//$head .= '<script src="'.$jNotifyJSUrl.'"></script>'."\n";
top_htmlhead($head, $title);
?>
<body
data-theme="custom"
data-controller="<?php print dol_escape_htmltag($context->controller); ?>"

2
htdocs/webportal/class/html.formcardwebportal.class.php
View file

@ -370,7 +370,7 @@ class FormCardWebPortal
}
$object->$key = $value;
if ($val['notnull'] > 0 && $object->$key == '' && is_null($val['default'])) {
if (!empty($val['notnull']) && $val['notnull'] > 0 && $object->$key == '' && is_null($val['default'])) {
$error++;
$context->setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv($val['label'])), null, 'errors');
}