vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix refuse use of .. into PHP_SELF - reported by Wenhao Wu

Browse source
This commit is contained in:
Laurent Destailleur 2026-08-18 12:01:01 +02:00
parent 6acce68070
commit 5391c3e313
2 changed files with 9 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
htdocs/dav/fileserver.php
View file

@ -47,14 +47,6 @@ if (!defined('NOCSRFCHECK')) {
} }
require "../main.inc.php"; require "../main.inc.php";
require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php';
require_once DOL_DOCUMENT_ROOT.'/dav/dav.class.php';
require_once DOL_DOCUMENT_ROOT.'/dav/dav.lib.php';
require_once DOL_DOCUMENT_ROOT.'/includes/sabre/autoload.php';
//require_once DOL_DOCUMENT_ROOT.'/includes/autoload.php';
/** /**
* @var Conf $conf * @var Conf $conf
* @var DoliDB $db * @var DoliDB $db
@ -62,6 +54,13 @@ require_once DOL_DOCUMENT_ROOT.'/includes/sabre/autoload.php';
* @var Translate $langs * @var Translate $langs
* @var User $user * @var User $user
*/ */
require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php';
require_once DOL_DOCUMENT_ROOT.'/dav/dav.class.php';
require_once DOL_DOCUMENT_ROOT.'/dav/dav.lib.php';
require_once DOL_DOCUMENT_ROOT.'/includes/sabre/autoload.php';
//require_once DOL_DOCUMENT_ROOT.'/includes/autoload.php';
$user = new User($db); $user = new User($db);
if (isset($_SERVER['PHP_AUTH_USER']) && $_SERVER['PHP_AUTH_USER'] != '') { if (isset($_SERVER['PHP_AUTH_USER']) && $_SERVER['PHP_AUTH_USER'] != '') {
@ -233,7 +232,7 @@ if (isset($baseUri)) {
// Add authentication function // Add authentication function
if ((!getDolGlobalString('DAV_ALLOW_PUBLIC_DIR') if ((!getDolGlobalString('DAV_ALLOW_PUBLIC_DIR')
|| !preg_match('/'.preg_quote(DOL_URL_ROOT.'/dav/fileserver.php/public', '/').'/', $_SERVER["PHP_SELF"])) || !preg_match('/'.preg_quote(DOL_URL_ROOT.'/dav/fileserver.php/public', '/').'/', Sabre\Uri\normalize($_SERVER["PHP_SELF"])))
&& !preg_match('/^sabreAction=asset&assetName=[a-zA-Z0-9%\-\/]+\.(png|css|woff|ico|ttf)$/', $_SERVER["QUERY_STRING"]) // URL for Sabre browser resources && !preg_match('/^sabreAction=asset&assetName=[a-zA-Z0-9%\-\/]+\.(png|css|woff|ico|ttf)$/', $_SERVER["QUERY_STRING"]) // URL for Sabre browser resources
) { ) {
//var_dump($_SERVER["QUERY_STRING"]);exit; //var_dump($_SERVER["QUERY_STRING"]);exit;

1
htdocs/waf.inc.php
View file

@ -239,6 +239,7 @@ function testSqlAndScriptInject($val, $type)
} }
if ($type == 2) { if ($type == 2) {
$inj += preg_match('/[:;"\'<>\?\(\){}\$%#]/', $val); // PHP_SELF is a file system (or url path without parameters). It can contains spaces. $inj += preg_match('/[:;"\'<>\?\(\){}\$%#]/', $val); // PHP_SELF is a file system (or url path without parameters). It can contains spaces.
$inj += preg_match('/\.\./', $val); // PHP_SELF is a file system (or url path without parameters). It must not contains '..'
} }
return $inj; return $inj;