vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Better sanitization param for GETPOST of htmlheader of website page

Browse source
This commit is contained in:
Laurent Destailleur 2026-04-29 02:38:59 +02:00
parent 273e41cbaf
commit bbbbb56c64
2 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
htdocs/website/class/websitepage.class.php
View file

@ -279,6 +279,11 @@ class WebsitePage extends CommonObject
// Remove spaces and be sure we have main language only
$this->lang = preg_replace('/[_-].*$/', '', trim($this->lang)); // en_US or en-US -> en
// Check there is no PHP into HTML header
$dataposted = trim($this->htmlheader); // Must accept tags like '<script>' and '<link>'
$dataposted = preg_replace(array('/<html>\n*/ims', '/<\/html>\n*/ims'), array('', ''), $dataposted);
$dataposted = str_replace('<?=', '<?php', $dataposted);
// Test if page contains dynamic PHP content
if (!$user->hasRight('website', 'writephp')) {
// Check there is no PHP content into the imported file (must be only HTML + JS)

6
htdocs/website/index.php
View file

@ -1181,7 +1181,7 @@ if ($action == 'addcontainer' && $usercanedit) {
$objectpage->image = GETPOST('WEBSITE_IMAGE', 'alpha');
$objectpage->keywords = str_replace(array('<', '>'), '', GETPOST('WEBSITE_KEYWORDS', 'alphanohtml'));
$objectpage->allowed_in_frames = GETPOST('WEBSITE_ALLOWED_IN_FRAMES', 'aZ09') ? 1 : 0;
$objectpage->htmlheader = GETPOST('htmlheader', 'none'); // Must accept tags like '<script>' and '<link>'
$objectpage->htmlheader = GETPOST('htmlheader', 'restricthtmlallowlinkscript'); // Must accept tags like '<script>' and '<link>'
$objectpage->author_alias = GETPOST('WEBSITE_AUTHORALIAS', 'alphanohtml');
$objectpage->object_type = GETPOST('WEBSITE_OBJECTCLASS');
@ -1645,7 +1645,7 @@ if ($action == 'updatecss' && $usercanedit) {
if (!$errorphpcheck) {
$htmlheadercontent = '';
/* We disable php code since htmlheader is never executed as an include but only read by fgets_content.
/* We disable php code since global htmlheader for all website is never executed as an include but only read by fgets_content.
$htmlheadercontent.= "<?php // BEGIN PHP\n";
$htmlheadercontent.= '$websitekey=basename(__DIR__);'."\n";
$htmlheadercontent.= "if (! defined('USEDOLIBARRSERVER') && ! defined('USEDOLIBARREDITOR')) { require_once './master.inc.php'; } // Load env if not already loaded"."\n";
@ -4816,7 +4816,7 @@ if ($action == 'editmeta' || $action == 'createcontainer') { // Edit properties
if (GETPOST('WEBSITE_ALLOWED_IN_FRAMES', 'aZ09')) {
$pageallowedinframes = 1;
}
if (GETPOST('htmlheader', 'none')) { // Must accept tags like '<script>' and '<link>'
if (GETPOST('htmlheader', 'restricthtmlallowlinkscript')) { // Must accept tags like '<script>' and '<link>'
$pagehtmlheader = GETPOST('htmlheader', 'none');
}