vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FIX Substitution key of default values was not complete.

Browse source
This commit is contained in:
Laurent Destailleur 2026-04-22 23:34:21 +02:00
parent f3506788ff
commit c4cb3f6d6b
1 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
htdocs/core/lib/functions.lib.php
View file

@ -1063,7 +1063,7 @@ function GETPOSTDATE($prefix, $hourTime = '', $gm = 'auto', $saverestore = '')
*/
function GETPOST($paramname, $check = 'alphanohtml', $method = 0, $filter = null, $options = null, $noreplace = 0)
{
global $mysoc, $user, $conf;
global $langs, $mysoc, $user, $conf;
if (empty($paramname)) { // Explicit test for null for phan.
return 'BadFirstParameterForGETPOST';
@ -1253,11 +1253,19 @@ function GETPOST($paramname, $check = 'alphanohtml', $method = 0, $filter = null
}
}
// Substitution variables for GETPOST (used to get final url with variable parameters or final default value, when using variable parameters __XXX__ in the GET URL)
// Replace substitution variables for GETPOST (used to get final url with variable parameters or final default value, when using variable parameters __XXX__ in the GET URL)
// Example of variables: __DAY__, __MONTH__, __YEAR__, __MYCOMPANY_COUNTRY_ID__, __USER_ID__, ...
// We do this only if var is a GET. If it is a POST, may be we want to post the text with vars as the setup text.
'@phan-var-force string $paramname';
if (!is_array($out) && empty($_POST[$paramname]) && empty($noreplace)) {
if (preg_match('/__([A-Z0-9]+(?:_[A-Z0-9]+){0,3})__/i', $out)) { // If there is at least one substitution key, we try to replace all known substitution keys
$substitutionarray = getCommonSubstitutionArray($langs, 0, null, $user, array('mycompany', 'date', 'system', 'user'));
complete_substitutions_array($substitutionarray, $langs, $user);
$out = make_substitutions($out, $substitutionarray, $langs);
}
/* old code
$reg = array();
$regreplace = array();
$maxloop = 20;
@ -1320,6 +1328,7 @@ function GETPOST($paramname, $check = 'alphanohtml', $method = 0, $filter = null
$out = preg_replace('/REGREPLACE_' . $key . '/', $value, $out);
}
}
*/
}
// Check type of variable and make sanitization according to this