vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
dolibarr/htdocs
History
VIAL-GOUTEYRON Quentin b35b9cdc3c
QUAL Add the CSP nonce on the drag and drop script tag (#39466) 
The script tag emitted by dragAndDropFileUpload() was the only inline script of
the page without the nonce, so it was blocked by a Content Security Policy that
allows the inline scripts through it, and the drag and drop was then silently
inert on every card that enables it.

Same form as the ~25 other inline script tags of main.inc.php. getNonce() is
stable within a request, and the attribute is ignored by the browser when no
policy is defined.
2026-08-13 02:29:49 +02:00
..
accountancy Merge branch '23.0' of git@github.com:Dolibarr/dolibarr.git into 24.0 2026-08-06 00:35:00 +02:00
adherents 22 report sec (#39235) 2026-07-20 15:29:30 +02:00
admin update css security.php (#39483) 2026-08-12 21:41:40 +02:00
ai Qual/Sec: Use db->sanitize instead of db->escape when not quoted, fix some quoting (#39286) 2026-07-27 13:00:33 +02:00
api Fixed removed property pass_indatabase_crypted in api result - reported 2026-08-09 19:49:05 +02:00
asset Qual: Fix 'SqlInjection' notices (#39229) 2026-07-20 15:26:43 +02:00
asterisk
barcode
blockedlog Revert "/imports/index.php wrongly shows access refused (#39379)" (#39386) 2026-08-04 22:23:57 +02:00
bom Qual/Sec: Use db->sanitize instead of db->escape when not quoted, fix some quoting (#39286) 2026-07-27 13:00:33 +02:00
bookcal Qual/Sec: Use db->sanitize instead of db->escape when not quoted, fix some quoting (#39286) 2026-07-27 13:00:33 +02:00
bookmarks Qual: Fix 'SqlInjection' notices (#39223) 2026-07-20 02:51:42 +02:00
categories Qual: Fix 'SqlInjection' notices (#39213) 2026-07-19 17:32:14 +02:00
collab
comm FIX #37658 - Add unit tests for TTC unit price rounding and add fixes for others objects (proposals, orders, invoices and contracts) (#39055) 2026-08-11 19:48:40 +02:00
commande FIX #37658 - Add unit tests for TTC unit price rounding and add fixes for others objects (proposals, orders, invoices and contracts) (#39055) 2026-08-11 19:48:40 +02:00
compta FIX #37658 - Add unit tests for TTC unit price rounding and add fixes for others objects (proposals, orders, invoices and contracts) (#39055) 2026-08-11 19:48:40 +02:00
conf
contact Qual: Remove SQL injection suppressions from Phan baseline (#39450) 2026-08-11 02:21:54 +02:00
contrat FIX #37658 - Add unit tests for TTC unit price rounding and add fixes for others objects (proposals, orders, invoices and contracts) (#39055) 2026-08-11 19:48:40 +02:00
core QUAL Add the CSP nonce on the drag and drop script tag (#39466) 2026-08-13 02:29:49 +02:00
cron Qual: Fix 'SqlInjection' notices (#39221) 2026-07-20 02:51:11 +02:00
custom
datapolicy Qual: Fix 'SqlInjection' notices (#39213) 2026-07-19 17:32:14 +02:00
dav Revert "/imports/index.php wrongly shows access refused (#39379)" (#39386) 2026-08-04 22:23:57 +02:00
debugbar
delivery Qual: Fix 'SqlInjection' notices (#39219) 2026-07-20 02:50:44 +02:00
don add some call_triggers (#39449) 2026-08-11 02:34:08 +02:00
ecm fix: Replace db->escape with db->sanitize in SQL query construction (#39357) 2026-08-04 18:40:04 +02:00
emailcollector Merge branch '23.0' of git@github.com:Dolibarr/dolibarr.git into 24.0 2026-08-06 00:35:00 +02:00
eventorganization fix: Replace db->escape with db->sanitize in SQL query construction (#39357) 2026-08-04 18:40:04 +02:00
expedition add some call_triggers (#39449) 2026-08-11 02:34:08 +02:00
expensereport Fix must exclude some properties in post/put of expensereport api - 2026-08-09 19:59:33 +02:00
exports Fix deletion must not use the glob by default. 2026-07-29 13:20:28 +02:00
fichinter add some call_triggers (#39449) 2026-08-11 02:34:08 +02:00
fourn FIX #37658 - Add unit tests for TTC unit price rounding and add fixes for others objects (proposals, orders, invoices and contracts) (#39055) 2026-08-11 19:48:40 +02:00
ftp
holiday Qual: Fix 'SqlInjection' notices (#39232) 2026-08-01 23:54:52 +02:00
hrm Fix deletion must not use the glob by default. 2026-07-29 13:20:28 +02:00
imports Redo #39379 2026-08-04 22:46:09 +02:00
includes
install FIX #37658 - Add unit tests for TTC unit price rounding and add fixes for others objects (proposals, orders, invoices and contracts) (#39055) 2026-08-11 19:48:40 +02:00
intracommreport Qual/Sec: Use db->sanitize instead of db->escape when not quoted, fix some quoting (#39286) 2026-07-27 13:00:33 +02:00
knowledgemanagement fix: Replace db->escape with db->sanitize in SQL query construction (#39357) 2026-08-04 18:40:04 +02:00
langs Revert "/imports/index.php wrongly shows access refused (#39379)" (#39386) 2026-08-04 22:23:57 +02:00
loan Qual: Fix 'SqlInjection' notices (#39225) 2026-07-20 02:52:07 +02:00
mailmanspip/class
margin Qual: Update SQL query variables for situation mode in margin reports (#39282) 2026-07-27 13:02:34 +02:00
modulebuilder Merge branch '24.0' of git@github.com:Dolibarr/dolibarr.git into develop 2026-08-06 00:38:13 +02:00
mrp Merge branch '24.0' of git@github.com:Dolibarr/dolibarr.git into develop 2026-08-06 00:38:13 +02:00
multicurrency qual: Update Phan baseline and suppress duplicate array key warnings (#39352) 2026-08-04 18:53:06 +02:00
opensurvey Qual: Fix 'SqlInjection' notices (#39223) 2026-07-20 02:51:42 +02:00
partnership fix: Replace db->escape with db->sanitize in SQL query construction (#39357) 2026-08-04 18:40:04 +02:00
paypal FIX: PayPal API calls set CURLOPT_SSL_VERIFYHOST to a bool instead of 2 (#39155) 2026-07-16 02:23:26 +02:00
printing
product Qual: Remove SQL injection suppressions from Phan baseline (#39450) 2026-08-11 02:21:54 +02:00
projet NEW Add hooks to let modules add columns to the project overview lists (#39459) 2026-08-11 19:45:25 +02:00
public Merge branch '23.0' of git@github.com:Dolibarr/dolibarr.git into 24.0 2026-08-06 00:35:00 +02:00
quickmemo FIX : Require write permission and check owner for unarchive memo (#39344) 2026-07-31 19:04:39 +02:00
reception reception: cache Reception/Entrepot fetches in other-receptions tooltip (#39454) 2026-08-11 19:47:57 +02:00
recruitment Qual/Sec: Use db->sanitize instead of db->escape when not quoted, fix some quoting (#39286) 2026-07-27 13:00:33 +02:00
resource Qual: Fix 'SqlInjection' notices (#39223) 2026-07-20 02:51:42 +02:00
salaries Qual: Remove unnecessary quotes around integer values in SQL queries (#39290) 2026-07-27 12:59:14 +02:00
societe add some call_triggers (#39449) 2026-08-11 02:34:08 +02:00
stripe
subtotals FIX #37658 - Add unit tests for TTC unit price rounding and add fixes for others objects (proposals, orders, invoices and contracts) (#39055) 2026-08-11 19:48:40 +02:00
supplier_invoice/admin
supplier_order/admin
supplier_proposal FIX #37658 - Add unit tests for TTC unit price rounding and add fixes for others objects (proposals, orders, invoices and contracts) (#39055) 2026-08-11 19:48:40 +02:00
takepos Qual: Fix 'SqlInjection' notices (#39232) 2026-08-01 23:54:52 +02:00
theme Merge branch '23.0' of git@github.com:Dolibarr/dolibarr.git into 24.0 2026-08-06 00:35:00 +02:00
ticket Merge branch '24.0' of git@github.com:Dolibarr/dolibarr.git into develop 2026-08-06 00:38:13 +02:00
user NEW - Add substitution for user warehouse (#36670) 2026-08-11 01:33:15 +02:00
variants Qual: Fix 'SqlInjection' notices (#39223) 2026-07-20 02:51:42 +02:00
webhook Qual/Sec: Use db->sanitize instead of db->escape when not quoted, fix some quoting (#39286) 2026-07-27 13:00:33 +02:00
webportal FIX webportal shared documents controller page (#39485) 2026-08-12 23:04:50 +02:00
webservices Qual: Fix 'SqlInjection' notices (#39229) 2026-07-20 15:26:43 +02:00
website Fix a user without perm for dyn content can import dyn templates - 2026-08-06 19:07:48 +02:00
workstation Qual/Sec: Use db->sanitize instead of db->escape when not quoted, fix some quoting (#39286) 2026-07-27 13:00:33 +02:00
zapier
document.php
favicon.ico
filefunc.inc.php
index.php
main.inc.php Clean code 2026-08-07 19:00:27 +02:00
master.inc.php
robots.txt
security.txt
version.inc.php Revert "/imports/index.php wrongly shows access refused (#39379)" (#39386) 2026-08-04 22:23:57 +02:00
viewimage.php
waf.inc.php Fix: more complete blacklist in waf - reported by Paweł Bednarz 2026-08-09 02:01:05 +02:00