Mirrors/dolibarr
1
0
Fork 0
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-02-20 13:46:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix #huntr88841fe0-e332-49ce-a46b-36d4f091fd89

Browse Source
This commit is contained in:
Laurent Destailleur 2023-02-13 13:29:30 +01:00
parent 61c734a6e3
commit cccd7494df
3 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/core/lib/website.lib.php
View File

@ -69,7 +69,7 @@ function dolStripPhpCode($str, $replacewith = '')
*
* @param string $str String to clean
* @return string Result string with php code only
* @see dolStripPhpCode()
* @see dolStripPhpCode(), checkPHPCode()
*/
function dolKeepOnlyPhpCode($str)
{

1
htdocs/core/lib/website2.lib.php
View File

@ -680,6 +680,7 @@ function showWebsiteTemplates(Website $website)
* @param string $phpfullcodestringold PHP old string. For exemple "<?php echo 'a' ?><php echo 'b' ?>"
* @param string $phpfullcodestring PHP new string. For exemple "<?php echo 'a' ?><php echo 'c' ?>"
* @return int Error or not
* @see dolKeepOnlyPhpCode()
*/
function checkPHPCode($phpfullcodestringold, $phpfullcodestring)
{

10
htdocs/website/index.php
View File

@ -806,6 +806,16 @@ if ($action == 'addcontainer' && $usercanedit) {
// Remove comments
$tmp['content'] = removeHtmlComment($tmp['content']);
// Check there is no PHP content into the imported file (must be only HTML + JS)
$phpcontent = dolKeepOnlyPhpCode('', $tmp['content']);
if ($phpcontent) {
$error++;
setEventMessages('Error getting '.$urltograb.': file that include PHP content is not allowed', null, 'errors');
$action = 'createcontainer';
}
}
if (!$error) {
$regs = array();
preg_match('/<head>(.*)<\/head>/ims', $tmp['content'], $regs);