vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix module param must be sanitized with aZ09arobase - reported by Davide

Browse source 
Saladino
This commit is contained in:
Laurent Destailleur 2026-07-24 07:21:20 +02:00
parent 7660df047a
commit a4d355d24f
7 changed files with 14 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
htdocs/core/js/lib_head.js.php
View file

@ -505,6 +505,9 @@ function getIntegerInString(str,i,minlength,maxlength)
*/
function urlencode(s) {
var news = s;
if (typeof news === "number") {
news = news.toString();
}
news = news.replace(/\+/gi,'%2B');
news = news.replace(/&/gi,'%26');
return news;

2
htdocs/ecm/dir_add_card.php
View file

@ -53,7 +53,7 @@ $cancel = GETPOST('cancel');
$backtopage = GETPOST('backtopage', 'alpha');
$confirm = GETPOST('confirm', 'alpha');
$module = GETPOST('module', 'alpha');
$module = GETPOST('module', 'aZ09arobase');
$website = GETPOST('website', 'alpha');
$pageid = GETPOSTINT('pageid');
if (empty($module)) {

2
htdocs/ecm/dir_card.php
View file

@ -49,7 +49,7 @@ $cancel = GETPOST('cancel');
$backtopage = GETPOST('backtopage', 'alpha');
$confirm = GETPOST('confirm', 'alpha');
$module = GETPOST('module', 'alpha');
$module = GETPOST('module', 'aZ09arobase');
$website = GETPOST('website', 'alpha');
$pageid = GETPOSTINT('pageid');
if (empty($module)) {

2
htdocs/ecm/file_card.php
View file

@ -48,7 +48,7 @@ $langs->loadLangs(array('ecm', 'companies', 'other', 'users', 'orders', 'propal'
$action = GETPOST('action', 'aZ09');
$cancel = GETPOST('cancel', 'alpha');
$backtopage = GETPOST('backtopage', 'alpha');
$module = GETPOST('module', 'alpha');
$module = GETPOST('module', 'aZ09arobase');
// Get parameters
$socid = GETPOSTINT("socid");

13
htdocs/ecm/index_auto.php
View file

@ -28,12 +28,6 @@
// Load Dolibarr environment
require '../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/ecm.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/treeview.lib.php';
require_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmdirectory.class.php';
/**
* @var Conf $conf
* @var DoliDB $db
@ -41,6 +35,11 @@ require_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmdirectory.class.php';
* @var Translate $langs
* @var User $user
*/
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/ecm.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/treeview.lib.php';
require_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmdirectory.class.php';
// Load translation files required by the page
$langs->loadLangs(array("ecm", "companies", "other", "users", "orders", "propal", "bills", "contracts"));
@ -49,7 +48,7 @@ $langs->loadLangs(array("ecm", "companies", "other", "users", "orders", "propal"
$socid = GETPOSTINT('socid');
$action = GETPOST('action', 'aZ09');
$section = GETPOSTINT('section') ? GETPOSTINT('section') : GETPOSTINT('section_id');
$module = GETPOST('module', 'alpha');
$module = GETPOST('module', 'aZ09arobase');
if (!$section) {
$section = 0;
}

2
htdocs/ecm/search.php
View file

@ -60,7 +60,7 @@ if (!$section) {
$section = 0;
}
$module = GETPOST('module', 'alpha');
$module = GETPOST('module', 'aZ09arobase');
$website = GETPOST('website', 'alpha');
$pageid = GETPOSTINT('pageid');
if (empty($module)) {

2
htdocs/ecm/tpl/enablefiletreeajax.tpl.php
View file

@ -115,7 +115,7 @@ function loadandshowpreview(filedirname,section)
$('#ecmfileview').empty();
var url = '<?php echo dol_buildpath('/core/ajax/ajaxdirpreview.php', 1); ?>?action=preview&module=<?php echo $module; ?>&section='+section+'&file='+urlencode(filedirname)<?php echo(empty($paramwithoutsection) ? '' : "+'".$paramwithoutsection."'"); ?>;
var url = '<?php echo dol_escape_js(dol_buildpath('/core/ajax/ajaxdirpreview.php', 1).'?action=preview&module='.urlencode($module)); ?>&section='+urlencode(section)+'&file='+urlencode(filedirname)<?php echo (empty($paramwithoutsection) ? '' : "+'".dol_escape_js($paramwithoutsection)."'"); ?>;
$.get(url, function(data) {
//alert('Load of url '+url+' was performed : '+data);
pos=data.indexOf("TYPE=directory",0);