Mirrors/dolibarr
1
0
Fork 0
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-02-20 13:46:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix backtourl

Browse Source
This commit is contained in:
Laurent Destailleur 2021-03-13 12:33:26 +01:00
parent 0bd7d28fd9
commit ff2f93815f
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
htdocs/website/index.php
View File

@ -394,12 +394,12 @@ if ($cancel) {
}
$savbacktopage = $backtopage;
$backtopage = $_SERVER["PHP_SELF"].'?file_manager=1&website='.$websitekey.'&pageid='.$pageid.(GETPOST('section_dir', 'alpha') ? '&section_dir='.urlencode(GETPOST('section_dir', 'alpha')) : ''); // used after a confirm_deletefile into actions_linkedfiles.inc.php
$backtopage = $_SERVER["PHP_SELF"].'?file_manager=1&website='.urlencode($websitekey).'&pageid='.urlencode($pageid).(GETPOST('section_dir', 'alpha') ? '&section_dir='.urlencode(GETPOST('section_dir', 'alpha')) : ''); // used after a confirm_deletefile into actions_linkedfiles.inc.php
if ($sortfield) {
$backtopage .= '&sortfield='.$sortfield;
$backtopage .= '&sortfield='.urlencode($sortfield);
}
if ($sortorder) {
$backtopage .= '&sortorder='.$sortorder;
$backtopage .= '&sortorder='.urlencode($sortorder);
}
include DOL_DOCUMENT_ROOT.'/core/actions_linkedfiles.inc.php';
$backtopage = $savbacktopage;
@ -1511,6 +1511,7 @@ if ($action == 'updatecss') {
if (!GETPOSTISSET('updateandstay')) { // If we click on "Save And Stay", we don not make the redirect
$action = 'preview';
if ($backtopage) {
$backtopage = preg_replace('/searchstring=[^&]*/', '', $backtopage); // Clean backtopage url
header("Location: ".$backtopage);
exit;
}

6
test/phpunit/SecurityTest.php
View File

@ -184,6 +184,12 @@ class SecurityTest extends PHPUnit\Framework\TestCase
// Should be OK
$expectedresult=0;
/*
$test = '';
$result=testSqlAndScriptInject($test, 0);
$this->assertGreaterThanOrEqual(0, $result, 'Error on testSqlAndScriptInject kkk');
*/
$_SERVER["PHP_SELF"]='/DIR WITH SPACE/htdocs/admin/index.php?mainmenu=home&leftmenu=setup&username=weservices';
$result=testSqlAndScriptInject($_SERVER["PHP_SELF"], 2);
$this->assertEquals($expectedresult, $result, 'Error on testSqlAndScriptInject expected 0a');