* Fix#39436 Block callable-dispatch bypass of PHP eval-guard blacklists
dol_eval_new() and checkPHPCode() blacklisted dangerous sink functions
(exec, system, eval...) by name but missed PHP callable-dispatch
functions (array_map, usort, preg_replace_callback, etc). Since these
call a function by name-as-data, a payload like
array_map('sys'.'tem', ['id']) reached system() unblocked, bypassing
WEBSITE_PHP_ALLOW_EXEC=off and the opt-in dol_eval_new engine.
Port the callable-dispatch function list already used by the default
dol_eval_standard() whitelist engine (unaffected) into both guards.
* Revert checkPHPCode() change, move it to a PR targeting develop
As pointed out by @eldy on the PR review: adding the callable-dispatch
function blacklist to checkPHPCode() can break existing legitimate
website custom-PHP snippets that use array_map/usort/etc, since that
feature is admin-only but still user-authored content. That kind of
behavior change belongs on develop, not on a stable maintenance branch.
The dol_eval_new() fix stays here: it's an opt-in engine, off by
default (MAIN_USE_DOL_EVAL_NEW), so the added restrictions carry no
practical regression risk for existing installs.
* Update functions.lib.php
---------
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
comm/action/index.php (agenda month/week/day view) fires the
printFieldListFrom hook right before the WHERE clause of the event query,
letting external modules add extra JOIN conditions to the agenda SQL
query. comm/action/peruser.php (agenda "per user" view) builds a
structurally identical query but never calls this hook - it only fires
printFieldListSelect, whose output lands before FROM and can't be used to
add a WHERE-equivalent join condition. printFieldListWhere isn't fired in
either file, so printFieldListFrom is the only hook point available
before WHERE.
This adds the same hook call already present in index.php, at the same
relative position (after the FROM/JOIN clauses, right before WHERE), so
modules can extend the agenda query the same way in both views.
Fixes#39506
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* Qual(ci): Fix phan notices (typing)
* Qual: Fix deposit_percent type (escaping)
# Qual: Fix deposit_percent type (escaping)
deposit_percent is a float but was escaped to string resulting in argument mismatch.
Fixed by casting to float.
