vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Removed open redirect - credit Phat Lala

Browse source
This commit is contained in:
Laurent Destailleur 2026-04-09 09:55:05 +02:00
parent 91fef4af83
commit bb56b7c6f3
2 changed files with 7 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
htdocs/core/search.php
View file

@ -20,13 +20,11 @@
*/
/**
* \file htdocs/core/search.php
* \brief Wrapper that receive any search. Depending on input field, make a redirect to correct URL.
* \file htdocs/core/search.php
* \brief Wrapper that receive any search. Depending on input field, make a redirect to correct URL.
* This page is called by search forms when MAIN_SEARCH_FORM_ON_HOME_AREAS is set or from user area.
*/
if (!defined('NOREQUIREUSER')) {
define('NOREQUIREUSER', '1');
}
if (!defined('NOREQUIREDB')) {
define('NOREQUIREDB', '1');
}
@ -42,9 +40,6 @@ if (!defined('NOCSRFCHECK')) {
if (!defined('NOTOKENRENEWAL')) {
define('NOTOKENRENEWAL', 1);
}
if (!defined('NOLOGIN')) {
define('NOLOGIN', 1);
}
if (!defined('NOREQUIREMENU')) {
define('NOREQUIREMENU', 1);
}
@ -146,11 +141,5 @@ if (GETPOST('search_group') != '') {
}
// If we are here, search was called with no supported criteria
if (!empty($_SERVER['HTTP_REFERER'])) {
header("Location: ".$_SERVER['HTTP_REFERER']);
exit;
} else {
print 'The wrapper search.php was called without any search criteria';
}
print 'The wrapper search.php was called without any search criteria';

4
htdocs/core/search_page.php
View file

@ -50,6 +50,8 @@ require_once '../main.inc.php';
* @var HookManager $hookmanager
* @var Translate $langs
* @var User $user
*
* @var string $dolibarr_nocache
*/
if (GETPOST('lang', 'aZ09')) {
@ -176,7 +178,7 @@ $searchform .= '<br>';
// Add search on URL
if ($conf->dol_use_jmobile) {
if (!empty($conf->dol_use_jmobile) || 1) {
$ret = '';
$ret .= '<form action="'.$_SERVER["PHP_SELF"].'" method="POST" class="searchform nowraponall tagtr">';
$ret .= '<input type="hidden" name="token" value="'.newToken().'">';