>> ';
diff --git a/htdocs/categories/viewcat.php b/htdocs/categories/viewcat.php
index 7f19194a3c3..dedb368202d 100644
--- a/htdocs/categories/viewcat.php
+++ b/htdocs/categories/viewcat.php
@@ -215,18 +215,18 @@ $title = Categorie::$MAP_TYPE_TITLE_AREA[$type];
$head = categories_prepare_head($object, $type);
print dol_get_fiche_head($head, 'card', $langs->trans($title), -1, 'category');
-$backtolist = (GETPOST('backtolist') ? GETPOST('backtolist') : DOL_URL_ROOT.'/categories/index.php?leftmenu=cat&type='.$type);
-$linkback = '
';
+$backtolist = (GETPOST('backtolist') ? GETPOST('backtolist') : DOL_URL_ROOT.'/categories/index.php?leftmenu=cat&type='.urlencode($type));
+$linkback = '
';
$object->next_prev_filter = ' type = '.$object->type;
$object->ref = $object->label;
-$morehtmlref = '
'.$langs->trans("Root").' >> ';
+$morehtmlref = '
'.$langs->trans("Root").' >> ';
$ways = $object->print_all_ways(" >> ", '', 1);
foreach ($ways as $way) {
$morehtmlref .= $way."
\n";
}
$morehtmlref .= '
';
-dol_banner_tab($object, 'label', $linkback, ($user->socid ? 0 : 1), 'label', 'label', $morehtmlref, '&type='.$type, 0, '', '', 1);
+dol_banner_tab($object, 'label', $linkback, ($user->socid ? 0 : 1), 'label', 'label', $morehtmlref, '&type='.urlencode($type), 0, '', '', 1);
/*
diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index 5a7158831d2..4fc283b8082 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -611,7 +611,7 @@ function GETPOST($paramname, $check = 'alphanohtml', $method = 0, $filter = null
}
// Sanitizing for special parameters. There is no reason to allow the backtopage parameter to contains an external URL.
- if ($paramname == 'backtopage') {
+ if ($paramname == 'backtopage' || $paramname == 'backtolist') {
$out = str_replace('\\', '/', $out);
$out = str_replace(array(':', '@'), '', $out);
$out = preg_replace(array('/^[a-z]*\/\/+/i'), '', $out);
@@ -1000,6 +1000,19 @@ function dol_sanitizePathName($str, $newstr = '_', $unaccent = 1)
return dol_string_nospecial($unaccent ? dol_string_unaccent($str) : $str, $newstr, $filesystem_forbidden_chars);
}
+/**
+ * Clean a string to use it as an URL
+ *
+ * @param string $stringtoclean String to clean
+ * @return string Escaped string.
+ */
+function dol_sanitizeUrl($stringtoclean)
+{
+ $stringtoclean = str_replace('javascript', '', $stringtoclean);
+
+ return $stringtoclean;
+}
+
/**
* Clean a string from all accent characters to be used as ref, login or by dol_sanitizeFileName
*
@@ -1098,7 +1111,6 @@ function dol_string_nounprintableascii($str, $removetabcrlf = 1)
}
}
-
/**
* Returns text escaped for inclusion into javascript code
*
diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php
index 0bf28c68d0e..ab33d5cdc3a 100644
--- a/htdocs/main.inc.php
+++ b/htdocs/main.inc.php
@@ -59,12 +59,16 @@ if (!empty($_SERVER['MAIN_SHOW_TUNING_INFO'])) {
*/
function testSqlAndScriptInject($val, $type)
{
- // Decode string first
+ // Decode string first bcause a lot of things are obfuscated by encoding or multiple encoding.
// So