Mirrors/dolibarr
1
0
Fork 0
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-02-20 13:46:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix sanitizing dol_openinpopup

Browse Source
This commit is contained in:
Laurent Destailleur 2024-08-22 14:46:10 +02:00
parent fad8cd1159
commit e631ce7475
7 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/accountancy/admin/fiscalyear_card.php
View File

@ -46,7 +46,7 @@ $dol_openinpopup = GETPOST('dol_openinpopup', 'aZ09');
if (!empty($backtopagejsfields)) {
$tmpbacktopagejsfields = explode(':', $backtopagejsfields);
$dol_openinpopup = $tmpbacktopagejsfields[0];
$dol_openinpopup = preg_replace('/[^a-z0-9_]/i', '', $tmpbacktopagejsfields[0]);
}
$error = 0;

2
htdocs/bookcal/calendar_card.php
View File

@ -51,7 +51,7 @@ $dol_openinpopup = GETPOST('dol_openinpopup', 'aZ09');
if (!empty($backtopagejsfields)) {
$tmpbacktopagejsfields = explode(':', $backtopagejsfields);
$dol_openinpopup = $tmpbacktopagejsfields[0];
$dol_openinpopup = preg_replace('/[^a-z0-9_]/i', '', $tmpbacktopagejsfields[0]);
}
// Initialize technical objects

6
htdocs/core/class/html.form.class.php
View File

@ -11113,11 +11113,11 @@ class Form
$retstring .= $withoutdiv ? '' : '</div>';
if ($dol_openinpopup) {
$retstring .= '<!-- buttons are shown into a $dol_openinpopup=' . $dol_openinpopup . ' context, so we enable the close of dialog on cancel -->' . "\n";
$retstring .= '<!-- buttons are shown into a $dol_openinpopup=' . dol_escape_htmltag($dol_openinpopup) . ' context, so we enable the close of dialog on cancel -->' . "\n";
$retstring .= '<script nonce="' . getNonce() . '">';
$retstring .= 'jQuery(".button-cancel").click(function(e) {
e.preventDefault(); console.log(\'We click on cancel in iframe popup ' . $dol_openinpopup . '\');
window.parent.jQuery(\'#idfordialog' . $dol_openinpopup . '\').dialog(\'close\');
e.preventDefault(); console.log(\'We click on cancel in iframe popup ' . dol_escape_js($dol_openinpopup) . '\');
window.parent.jQuery(\'#idfordialog' . dol_escape_js($dol_openinpopup) . '\').dialog(\'close\');
});';
$retstring .= '</script>';
}

2
htdocs/modulebuilder/template/myobject_card.php
View File

@ -102,7 +102,7 @@ $dol_openinpopup = GETPOST('dol_openinpopup', 'aZ09');
if (!empty($backtopagejsfields)) {
$tmpbacktopagejsfields = explode(':', $backtopagejsfields);
$dol_openinpopup = $tmpbacktopagejsfields[0];
$dol_openinpopup = preg_replace('/[^a-z0-9_]/i', '', $tmpbacktopagejsfields[0]);
}
// Initialize technical objects

4
htdocs/projet/card.php
View File

@ -56,10 +56,10 @@ $backtopagejsfields = GETPOST('backtopagejsfields', 'alpha');
$cancel = GETPOST('cancel', 'alpha');
$confirm = GETPOST('confirm', 'aZ09');
$dol_openinpopup = 0;
$dol_openinpopup = '';
if (!empty($backtopagejsfields)) {
$tmpbacktopagejsfields = explode(':', $backtopagejsfields);
$dol_openinpopup = $tmpbacktopagejsfields[0];
$dol_openinpopup = preg_replace('/[^a-z0-9_]/i', '', $tmpbacktopagejsfields[0]);
}
$status = GETPOSTINT('status');

2
htdocs/societe/card.php
View File

@ -109,7 +109,7 @@ $confirm = GETPOST('confirm', 'alpha');
$dol_openinpopup = '';
if (!empty($backtopagejsfields)) {
$tmpbacktopagejsfields = explode(':', $backtopagejsfields);
$dol_openinpopup = $tmpbacktopagejsfields[0];
$dol_openinpopup = preg_replace('/[^a-z0-9_]/i', '', $tmpbacktopagejsfields[0]);
}
$socid = GETPOSTINT('socid') ? GETPOSTINT('socid') : GETPOSTINT('id');

2
htdocs/workstation/workstation_card.php
View File

@ -52,7 +52,7 @@ $dol_openinpopup = GETPOST('dol_openinpopup', 'aZ09');
if (!empty($backtopagejsfields)) {
$tmpbacktopagejsfields = explode(':', $backtopagejsfields);
$dol_openinpopup = $tmpbacktopagejsfields[0];
$dol_openinpopup = preg_replace('/[^a-z0-9_]/i', '', $tmpbacktopagejsfields[0]);
}
$groups = GETPOST('groups', 'array:int');