Fix for Self XSS vuln in dolibarr

[spooky360]

📊 Metadata *

Please enter the direct URL for this bounty on huntr.dev. This is compulsory and will help us process your bounty submission quicker.

Bounty URL: https://www.huntr.dev/bounties/2-packagist-dolibarr

⚙️ Description *

A lack of escaping exists in the dol_print_error (in htdocs/core/lib/functions.lib.php file).
This could lead to XSS.

💻 Technical Description *

The fix simply html-entity encodes the var before printing it.

🐛 Proof of Concept (PoC) *

1. Log into your dolibarr instance
2. Change your browser user-agent by appending something like <script>alert(document.domain);</script>
3. Modify the URL in order to throw an error (for example: http://dolibarr/document.php?modulepart=.&attachment=0&file=dddd&&entity=10&&entity=1000&&entity=101&mainmenu=home)
4. No more XSS, the payload string is displayed instead of being executed

🔥 Proof of Fix (PoF) *

👍 User Acceptance Testing (UAT)

[mufeedvh]

Nice one! 👏🎉

[Mik317]

LGTM 😄 🎉

Cheers,
Mik

[toufik-airane]

[huntr-helper]

Congratulations spooky360 - your fix has been selected! 🎉

Thanks for being part of the community & helping secure the world's open source code.
If you have any questions, please respond in the comments section. Your bounty is on its way - keep hunting!