vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
155991 commits 1 branch 0 tags 1.5 GiB
Commit graph

248 commits

Author SHA1 Message Date
Laurent Destailleur
41dfccfc14 Complete #39546 and #39547 2026-08-15 16:53:30 +02:00
Aymeric Cucherousset
954685b729
Fix #39436 Block callable-dispatch bypass of PHP eval-guard blacklists (#39547) 
* Fix #39436 Block callable-dispatch bypass of PHP eval-guard blacklists

dol_eval_new() and checkPHPCode() blacklisted dangerous sink functions
(exec, system, eval...) by name but missed PHP callable-dispatch
functions (array_map, usort, preg_replace_callback, etc). Since these
call a function by name-as-data, a payload like
array_map('sys'.'tem', ['id']) reached system() unblocked, bypassing
WEBSITE_PHP_ALLOW_EXEC=off and the opt-in dol_eval_new engine.

Port the callable-dispatch function list already used by the default
dol_eval_standard() whitelist engine (unaffected) into both guards.

* Revert checkPHPCode() change, move it to a PR targeting develop

As pointed out by @eldy on the PR review: adding the callable-dispatch
function blacklist to checkPHPCode() can break existing legitimate
website custom-PHP snippets that use array_map/usort/etc, since that
feature is admin-only but still user-authored content. That kind of
behavior change belongs on develop, not on a stable maintenance branch.

The dol_eval_new() fix stays here: it's an opt-in engine, off by
default (MAIN_USE_DOL_EVAL_NEW), so the added restrictions carry no
practical regression risk for existing installs.

* Update functions.lib.php

---------

Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
 2026-08-15 16:39:00 +02:00
Laurent Destailleur
ca2c725bb1 Fix use of numeric hostname 2026-07-29 12:16:48 +02:00
Laurent Destailleur
4a36047716 Try to fix bad decoding of encrypted key with accents (utf8 keys) 2026-07-24 16:21:18 +02:00
Laurent Destailleur
47b7b0d695 Replace all str_shuffle functions with a Fisher-Yate 2026-06-06 16:17:23 +02:00
Laurent Destailleur
468645cee8 Doc 2026-05-17 15:25:53 +02:00
Laurent Destailleur
4bf7ed0861 Merge branch '23.0' of git@github.com:Dolibarr/dolibarr.git into develop 2026-03-29 21:32:22 +02:00
Laurent Destailleur
ee8ded7c5e Fix #GHSA-5cfw-655w-vqp8 2026-03-29 20:31:54 +02:00
Laurent Destailleur
983802e990 Fix travis 2026-03-29 19:22:55 +02:00
Braito
a98374a325
[TEST] Make SecurityTest::testDolHtmlWithNoJs robust to libxml formatting (#37643) 
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
 2026-03-29 19:15:21 +02:00
Laurent Destailleur
8d60d0ab82 NEW Start implementation of MAIN_RESTRICTHTML_ONLY_VALID_HTML=2 
for #GHSA-5jmx-352f-p5g3
 2026-03-26 15:46:21 +01:00
Laurent Destailleur
d0b40e7047 Merge branch '23.0' of git@github.com:Dolibarr/dolibarr.git into develop 2026-03-25 16:44:26 +01:00
Laurent Destailleur
6f425521b3 FIx #GHSA-vmvw-qq8w-wqhg 2026-03-25 16:40:45 +01:00
Laurent Destailleur
5d18db5aea Disable remote access in test 2026-01-16 18:15:51 +01:00
Laurent Destailleur
5ebbf9a70f Code comment 2025-12-18 15:07:54 +01:00
Laurent Destailleur
d858764b15 Add config param $dolibarr_main_restrict_eval_methods with whitelist of 
functionsallowed in dol_eval. Advisory GHSA-x3w7-24rq-gvc5
 2025-11-19 03:44:24 +01:00
Laurent Destailleur
9818c76f7f MAIN_DISALLOW_STRING_OBFUSCATION_IN_DOL_EVAL replaced with 
MAIN_ALLOW_OBFUSCATION_METHODS_IN_DOL_EVAL
 2025-11-18 23:34:23 +01:00
Frédéric FRANCE
3a3785c92d
Update SecurityTest.php (#36295) 
* Update SecurityTest.php

* Update SecurityTest.php

* Update SecurityTest.php
 2025-11-17 21:43:53 +01:00
Laurent Destailleur
e54cc9ab28 Fix phpunit 2025-11-17 21:40:36 +01:00
Laurent Destailleur
74455fd391 FIX #35887 2025-10-22 02:21:52 +02:00
ldestailleur
f160e23918 Merge branch '21.0' of git@github.com:Dolibarr/dolibarr.git into 22.0 2025-09-05 17:23:25 +02:00
ldestailleur
6c0873708a Merge branch '20.0' of git@github.com:Dolibarr/dolibarr.git into 21.0 2025-09-05 15:34:13 +02:00
ldestailleur
c2ed4519b1 Merge branch '19.0' of git@github.com:Dolibarr/dolibarr.git into 20.0 2025-09-05 11:38:30 +02:00
ldestailleur
781adf507b Merge branch '18.0' of git@github.com:Dolibarr/dolibarr.git into 19.0 2025-09-04 20:47:13 +02:00
ThomasNgr-OpenDSI
01aa901f93
18.0 fix CVE 2024 40137 (#34762) 
* Sec: Remove all functions that accept callable params - CVE-2024-40137

* FIX #34746 - More complete fix for CVE-2024-40137

---------

Co-authored-by: ldestailleur <eldy@destailleur.fr>
 2025-09-04 14:59:44 +02:00
ldestailleur
96a74c4976 Disable this test where result is not predicable 2025-09-04 14:13:13 +02:00
ldestailleur
b03f30c7e2 Sec: Remove functions accepting callable params - Reported by phdwg1410 2025-07-27 13:54:02 +02:00
ldestailleur
c0a0acf129 FIX #34746 2025-07-17 19:30:58 +02:00
ldestailleur
61dcd176e0 Merge branch '21.0' of git@github.com:Dolibarr/dolibarr.git into 22.0 2025-07-17 19:30:58 +02:00
ldestailleur
a4aa00c498 Sec: Remove all functions that accept callable params - CVE-2024-40137 2025-07-17 19:30:58 +02:00
ldestailleur
a674676ded Merge branch '21.0' of git@github.com:Dolibarr/dolibarr.git into develop 2025-05-10 13:33:53 +02:00
ldestailleur
d76848351c Merge branch '20.0' of git@github.com:Dolibarr/dolibarr.git into 21.0 2025-05-10 13:30:36 +02:00
ldestailleur
ae94c71a10 Merge branch '19.0' of git@github.com:Dolibarr/dolibarr.git into 20.0 2025-05-10 13:25:31 +02:00
ldestailleur
445f089556 Merge branch '18.0' of git@github.com:Dolibarr/dolibarr.git into 19.0 2025-05-10 12:53:37 +02:00
Laurent Destailleur (aka Eldy)
b85bfc40f4 Fix phpunit 2025-05-06 11:59:08 +02:00
ldestailleur
eadc676edf NEW Add option MAIN_ALLOW_DOUBLE_COLON_IN_DOL_EVAL 2025-05-06 11:10:57 +02:00
ldestailleur
9582894136 Add constant SECURITY_WAF_ALLOW_QUOTES_IN_GET in WAF 2025-04-06 18:56:59 +02:00
ldestailleur
3edadbd8b8 Add option MAIN_DISALLOW_STRING_OBFUSCATION_IN_DOL_EVAL. Close #33612 2025-04-01 16:23:50 +02:00
ldestailleur
15f2f4f223 Clean code 2025-04-01 15:21:43 +02:00
ldestailleur
cc8c7b8329 Fix possible remote code execution using dol_concatdesc in dol_eval. To 
allow concat char, you can use
MAIN_ALLOW_UNSECURED_SPECIAL_CHARS_IN_DOL_EVAL='.'
 2025-04-01 13:25:10 +02:00
ldestailleur
bcf0ef0bc0 Test switch in dol_eval function() 2025-04-01 12:31:27 +02:00
ldestailleur
d670d67668 Disable test when libxml not good. 2025-03-09 23:37:36 +01:00
ldestailleur
202ffe732e Enhance phpunit tests 2025-03-09 21:26:51 +01:00
Laurent Destailleur (aka Eldy)
bd9bf8b5a8 FIX #CVE-2024-34051 2025-02-17 12:24:03 +01:00
Laurent Destailleur (aka Eldy)
d223f8a0b9 Merge branch '21.0' of git@github.com:Dolibarr/dolibarr.git into develop 2025-02-13 20:42:23 +01:00
Laurent Destailleur (aka Eldy)
705164cc9f Merge branch '20.0' of git@github.com:Dolibarr/dolibarr.git into 21.0 2025-02-13 20:39:19 +01:00
Laurent Destailleur (aka Eldy)
256e0e0470 Merge branch '19.0' of git@github.com:Dolibarr/dolibarr.git into 20.0 2025-02-13 20:37:12 +01:00
Laurent Destailleur (aka Eldy)
054010f8ec Fix test 2025-02-13 20:34:55 +01:00
Laurent Destailleur (aka Eldy)
36fd5b7b26 FIX #CVE-2024-34051 2025-02-13 20:29:25 +01:00
Laurent Destailleur
ae52d75335 NEW Can add more tags to default tags in dolPrintHTML 2026-01-20 12:30:08 +01:00