Skip to content

Commit

Permalink
FIX Dolibarr#2857, Dolibarr#4291 & Dolibarr#4341 Escape GETPOST alpha…
Browse files Browse the repository at this point in the history
… data by default

This should mitigate most HTML injections allowing XSS.
  • Loading branch information
rdoursenaud committed Jan 8, 2016
1 parent 0cad938 commit 0d31813
Showing 1 changed file with 16 additions and 15 deletions.
31 changes: 16 additions & 15 deletions htdocs/core/lib/functions.lib.php
Original file line number Diff line number Diff line change
@@ -1,16 +1,17 @@
<?php
/* Copyright (C) 2000-2007 Rodolphe Quiedeville <rodolphe@quiedeville.org>
* Copyright (C) 2003 Jean-Louis Bergamo <jlb@j1b.org>
* Copyright (C) 2004-2013 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2004 Sebastien Di Cintio <sdicintio@ressource-toi.org>
* Copyright (C) 2004 Benoit Mortier <benoit.mortier@opensides.be>
* Copyright (C) 2004 Christophe Combelles <ccomb@free.fr>
* Copyright (C) 2005-2012 Regis Houssin <regis.houssin@capnetworks.com>
* Copyright (C) 2008 Raphael Bertrand (Resultic) <raphael.bertrand@resultic.fr>
* Copyright (C) 2010-2011 Juanjo Menent <jmenent@2byte.es>
* Copyright (C) 2013 Cédric Salvador <csalvador@gpcsolutions.fr>
* Copyright (C) 2013 Alexandre Spangaro <alexandre.spangaro@gmail.com>
* Copyright (C) 2014-2015 Marcos García <marcosgdf@gmail.com>
/* Copyright (C) 2000-2007 Rodolphe Quiedeville <rodolphe@quiedeville.org>
* Copyright (C) 2003 Jean-Louis Bergamo <jlb@j1b.org>
* Copyright (C) 2004-2013 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2004 Sebastien Di Cintio <sdicintio@ressource-toi.org>
* Copyright (C) 2004 Benoit Mortier <benoit.mortier@opensides.be>
* Copyright (C) 2004 Christophe Combelles <ccomb@free.fr>
* Copyright (C) 2005-2012 Regis Houssin <regis.houssin@capnetworks.com>
* Copyright (C) 2008 Raphael Bertrand (Resultic) <raphael.bertrand@resultic.fr>
* Copyright (C) 2010-2011 Juanjo Menent <jmenent@2byte.es>
* Copyright (C) 2013 Cédric Salvador <csalvador@gpcsolutions.fr>
* Copyright (C) 2013 Alexandre Spangaro <alexandre.spangaro@gmail.com>
* Copyright (C) 2014-2015 Marcos García <marcosgdf@gmail.com>
* Copyright (C) 2016 Raphaël Doursenaud <rdoursenaud@gpcsolutions.fr>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
Expand Down Expand Up @@ -194,10 +195,10 @@ function GETPOST($paramname,$check='',$method=0)
elseif ($check == 'alpha')
{
$out=trim($out);
// '"' is dangerous because param in url can close the href= or src= and add javascript functions.
// '../' is dangerous because it allows dir transversals
if (preg_match('/"/',$out)) $out='';
else if (preg_match('/\.\.\//',$out)) $out='';
if (preg_match('/\.\.\//',$out)) $out='';
// Quotes are dangerous because param in url can close the href= or src= and add javascript functions.
$out = htmlspecialchars($out, ENT_QUOTES);

This comment has been minimized.

Copy link
@eldy

eldy Jan 8, 2016

This break a lot of thing.
If you want to submit a last name like
maison de l'ile
it would fails.

If goal is to fix Dolibarr#4341, i provide another fix that does not introduce this regression.

}
elseif ($check == 'aZ')
{
Expand Down

0 comments on commit 0d31813

Please sign in to comment.