From c5c0b85498acd9d39b5f79e49382ee3698f74a90 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 25 Nov 2025 18:18:02 +0100 Subject: [PATCH] Debug v23 --- README.md | 2 +- htdocs/admin/system/security.php | 14 ++++++++++++++ htdocs/conf/conf.php.example | 6 +++--- htdocs/core/lib/functions.lib.php | 4 ++-- 4 files changed, 20 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 3c2b2e0ac43..8577be43b8b 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ ![Downloads per day](https://img.shields.io/sourceforge/dw/dolibarr.svg) ![Docker hub pulls](https://img.shields.io/docker/pulls/dolibarr/dolibarr.svg) -[![Minimum PHP Version](https://img.shields.io/badge/php-%3E%3D%207.1-8892BF.svg?style=flat-square)](https://php.net/) +[![Minimum PHP Version](https://img.shields.io/badge/php-%3E%3D%207.2-8892BF.svg?style=flat-square)](https://php.net/) [![GitHub release](https://img.shields.io/github/v/release/Dolibarr/dolibarr)](https://github.com/Dolibarr/dolibarr) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/5521/badge)](https://bestpractices.coreinfrastructure.org/projects/5521) diff --git a/htdocs/admin/system/security.php b/htdocs/admin/system/security.php index 3d1b5995ed7..1d4a3c12d2c 100644 --- a/htdocs/admin/system/security.php +++ b/htdocs/admin/system/security.php @@ -35,6 +35,11 @@ require '../../main.inc.php'; * @var string $conffile // $conffile is defined into filefunc.inc.php * @var string $dolibarr_main_prod * @var string $dolibarr_main_document_root + * @var string $dolibarr_main_restrict_os_commands + * @var string $dolibarr_main_restrict_eval_methods + * @var string $dolibarr_main_restrict_ip + * @var string $dolibarr_main_db_pass + * @var string $dolibarr_main_db_encrypted_pass */ require_once DOL_DOCUMENT_ROOT.'/core/lib/memory.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php'; @@ -387,6 +392,15 @@ if (empty($dolibarr_main_restrict_os_commands)) { print '     ('.$langs->trans("RecommendedValueIs", 'mysqldump, mysql, pg_dump, pg_restore, mariadb, mariadb-dump, clamdscan').')'; print '
'; +print '$dolibarr_main_restrict_eval_methods: '; +if (empty($dolibarr_main_restrict_eval_methods)) { + print $langs->trans("None"); +} else { + print $dolibarr_main_restrict_eval_methods; +} +print '     ('.$langs->trans("RecommendedValueIs", 'getDolGlobalString,getDolGlobalInt,getDolCurrency,fetchNoCompute,hasRight,isModEnabled,isStringVarMatching,abs,min,max,round,dol_now,dol_concat,preg_match').')'; +print '
'; + if (!getDolGlobalString('SECURITY_DISABLE_TEST_ON_OBFUSCATED_CONF')) { print '$dolibarr_main_db_pass: '; if (!empty($dolibarr_main_db_pass) && empty($dolibarr_main_db_encrypted_pass)) { diff --git a/htdocs/conf/conf.php.example b/htdocs/conf/conf.php.example index b6a041f1032..66b79e84ccf 100644 --- a/htdocs/conf/conf.php.example +++ b/htdocs/conf/conf.php.example @@ -316,11 +316,11 @@ $dolibarr_main_restrict_os_commands='mariadb-dump, mariadb, mysqldump, mysql, pg // ================================== // A whitelist of functions and methods to restrict the commands you can execute in a custom calculated fields, like "computed fields" of // extrafields or string conditions of extrafields. -// Default value: 'getDolGlobalString,getDolGlobalInt,getDolCurrency,fetchNoCompute,hasRight,isModEnabled,isStringVarMatching,abs,round,dol_now,preg_match' +// Default value: 'getDolGlobalString, getDolGlobalInt, getDolCurrency, fetchNoCompute, hasRight, isModEnabled, isStringVarMatching, abs, round, dol_now, preg_match' // Examples: -// $dolibarr_main_restrict_eval_methods='getDolGlobalString,getDolGlobalInt,getDolCurrency,fetchNoCompute,hasRight,isModEnabled,isStringVarMatching,abs,min,max,round,dol_now,dol_concat,preg_match'; +// $dolibarr_main_restrict_eval_methods='getDolGlobalString, getDolGlobalInt, getDolCurrency, fetchNoCompute, hasRight, isModEnabled, isStringVarMatching, abs, min, max, round, dol_now, dol_concat, preg_match'; // -$dolibarr_main_restrict_eval_methods='getDolGlobalString,getDolGlobalInt,getDolCurrency,fetchNoCompute,hasRight,isModEnabled,isStringVarMatching,abs,min,max,round,dol_now,preg_match'; +$dolibarr_main_restrict_eval_methods='getDolGlobalString, getDolGlobalInt, getDolCurrency, fetchNoCompute, hasRight, isModEnabled, isStringVarMatching, abs, min, max, round, dol_now, preg_match'; // dolibarr_main_disabled_modules // ================================== diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 87ef0d8acec..b3c9839cfcc 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -11935,10 +11935,10 @@ function dol_eval_standard($s, $hideerrors = 1, $onlysimplestring = '1') // Set $dolibarr_main_restrict_eval_methods_array if (!isset($dolibarr_main_restrict_eval_methods)) { - $dolibarr_main_restrict_eval_methods = 'getDolGlobalString,getDolGlobalInt,getDolCurrency,fetchNoCompute,hasRight,isModEnabled,isStringVarMatching,abs,min,max,round,dol_now,preg_match'; + $dolibarr_main_restrict_eval_methods = 'getDolGlobalString, getDolGlobalInt, getDolCurrency, fetchNoCompute, hasRight, isModEnabled, isStringVarMatching, abs, min, max, round, dol_now, preg_match'; } //print '$dolibarr_main_restrict_eval_methods = '.$dolibarr_main_restrict_eval_methods."\n"; - $dolibarr_main_restrict_eval_methods_array = explode(',', $dolibarr_main_restrict_eval_methods); + $dolibarr_main_restrict_eval_methods_array = explode(',', str_replace(" ", "", $dolibarr_main_restrict_eval_methods)); // Test on dangerous char (used for RCE), we allow only characters to make PHP variable testing // We must accept with 1: '1 && getDolGlobalInt("doesnotexist1") && getDolGlobalString("MAIN_FEATURES_LEVEL")'