vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Qual: Use dol_include_once() to load the registry's headfile

Browse source 
require_once DOL_DOCUMENT_ROOT.'/'.$pagedef['headfile'] bypassed
Dolibarr's standard mechanism for a core file loading a module file
(dol_include_once(), via dol_buildpath()): no custom/ alternate-root
resolution, no '..' path-traversal guard, no graceful failure/logging
if the path were ever wrong. headfile values are plain relative paths
(e.g. 'core/lib/company.lib.php') so no registry changes needed.
This commit is contained in:
Frédéric FRANCE 2026-08-12 07:43:16 +02:00
parent 6ba794c353
commit 6cdd8e27b8
No known key found for this signature in database
GPG key ID: C06E4A9656127239
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
htdocs/admin/extrafields.php
View file

@ -108,7 +108,7 @@ $linkback = '<a href="'.dolBuildUrl(DOL_URL_ROOT.'/admin/modules.php', ['restore
print load_fiche_titre($title, $linkback, 'title_setup');
require_once DOL_DOCUMENT_ROOT.'/'.$pagedef['headfile'];
dol_include_once($pagedef['headfile']);
$head = call_user_func($pagedef['headfunction']);
print dol_get_fiche_head($head, $pagedef['tabid'], $headlabel, -1, $pagedef['headpicto']);