Mirrors/dolibarr
1
0
Fork 0
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-02-20 13:46:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix CSRF protection for all massactions

Browse Source
This commit is contained in:
Laurent Destailleur 2021-09-18 22:38:25 +02:00
parent bc63c624ef
commit 89e8f24e15
5 changed files with 14 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
htdocs/comm/propal/list.php
View File

@ -316,13 +316,14 @@ if ($action == 'validate' && $permissiontovalidate) {
if ($tmpproposal->fetch($checked)) {
if ($tmpproposal->statut == 0) {
if ($tmpproposal->valid($user)) {
setEventMessage($tmpproposal->ref." ".$langs->trans('PassedInOpenStatus'), 'mesgs');
setEventMessage($langs->trans('hasBeenValidated', $tmpproposal->ref), 'mesgs');
} else {
setEventMessage($langs->trans('CantBeValidated'), 'errors');
$error++;
}
} else {
setEventMessage($tmpproposal->ref." ".$langs->trans('IsNotADraft'), 'errors');
$langs->load("errors");
setEventMessage($langs->trans('ErrorIsNotADraft', $tmpproposal->ref), 'errors');
$error++;
}
} else {

12
htdocs/commande/list.php
View File

@ -309,13 +309,14 @@ if ($action == 'validate' && $permissiontoadd) {
$idwarehouse = 0;
}
if ($objecttmp->valid($user, $idwarehouse)) {
setEventMessage($objecttmp->ref." ".$langs->trans('PassedInOpenStatus'), 'mesgs');
setEventMessage($langs->trans('hasBeenValidated', $objecttmp->ref), 'mesgs');
} else {
setEventMessage($langs->trans('CantBeValidated'), 'errors');
$error++;
}
} else {
setEventMessage($objecttmp->ref." ".$langs->trans('IsNotADraft'), 'errors');
$langs->load("errors");
setEventMessage($langs->trans('ErrorIsNotADraft', $objecttmp->ref), 'errors');
$error++;
}
} else {
@ -339,13 +340,14 @@ if ($action == 'shipped' && $permissiontoadd) {
if ($objecttmp->fetch($checked)) {
if ($objecttmp->statut == 1) {
if ($objecttmp->cloture($user)) {
setEventMessage($objecttmp->ref." ".$langs->trans('PassedInOpenStatus'), 'mesgs');
setEventMessage($langs->trans('PassedInClosedStatus', $objecttmp->ref), 'mesgs');
} else {
setEventMessage($langs->trans('CantBeValidated'), 'errors');
setEventMessage($langs->trans('CantBeClosed'), 'errors');
$error++;
}
} else {
setEventMessage($objecttmp->ref." ".$langs->trans('IsNotADraft'), 'errors');
$langs->load("errors");
setEventMessage($langs->trans('ErrorIsNotADraft', $objecttmp->ref), 'errors');
$error++;
}
} else {

1
htdocs/langs/en_US/errors.lang
View File

@ -270,6 +270,7 @@ ErrorActionCommBadType=Selected event type (id: %n, code: %s) do not exist in Ev
CheckVersionFail=Version check fail
ErrorWrongFileName=Name of the file cannot have __SOMETHING__ in it
ErrorNotInDictionaryPaymentConditions=Not in Payment Terms Dictionary, please modify.
ErrorIsNotADraft=%s is not a draft
# Warnings
WarningParamUploadMaxFileSizeHigherThanPostMaxSize=Your PHP parameter upload_max_filesize (%s) is higher than PHP parameter post_max_size (%s). This is not a consistent setup.

1
htdocs/langs/en_US/main.lang
View File

@ -1155,3 +1155,4 @@ ConfirmMassLeaveApproval=Mass leave approval confirmation
RecordAproved=Record approved
RecordsApproved=%s Record(s) approved
Properties=Properties
hasBeenValidated=%s has been validated

3
htdocs/main.inc.php
View File

@ -482,7 +482,8 @@ if ((!defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && !empty($conf->gl
if (
$_SERVER['REQUEST_METHOD'] == 'POST' ||
$sensitiveget ||
((GETPOSTISSET('actionlogin') || GETPOSTISSET('action') || GETPOSTISSET('massaction')) && defined('CSRFCHECK_WITH_TOKEN'))
GETPOSTISSET('massaction') ||
((GETPOSTISSET('actionlogin') || GETPOSTISSET('action')) && defined('CSRFCHECK_WITH_TOKEN'))
) {
// If token is not provided or empty, error (we are in case it is mandatory)
if (!GETPOST('token', 'alpha') || GETPOST('token', 'alpha') == 'notrequired') {