admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Task #4402 : Security Problem

Browse source 
Problème est resolu grace à une procedure de check
Avantage : la validité des formules est directement vérifiée
This commit is contained in:
sparkyx 2005-07-08 18:18:34 +00:00
parent 637af759f0
commit 86b2ec3a46
5 changed files with 71 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

BIN
doc/bnb.sxw
View file

Binary file not shown.

8
html/form.php
View file

@ -18,7 +18,6 @@
*/
/* $Revision$ */
// Copyright Author Dany De Bontridder ddebontridder@yahoo.fr
/* $Revision$ */
include_once ("ac_common.php");
include_once ("user_menu.php");
@ -53,6 +52,11 @@ if ( isset ($_POST["record"] )) {
AddForm($cn,$HTTP_POST_VARS);
echo "</DIV>";
}
if ( isset ($_POST["del_form"]) ) {
echo '<DIV class="ccontent">';
DeleteForm($cn,$_POST['fr_id']);
echo "</DIV>";
}
ShowMenuComptaForm($_SESSION['g_dossier']);
@ -94,6 +98,8 @@ if ( isset ($_POST["add_line"]) ) {
if ( isset ($_POST["update"]) ) {
echo '<DIV class="ccontent">';
UpdateForm($cn,$HTTP_POST_VARS);
ViewForm($cn,$sessid,$_POST["fr_id"]);
echo "</DIV>";
}

12
include/class_form.php
View file

@ -50,12 +50,12 @@ class formulaire {
$col=array();
for ($i=0;$i<$Max;$i++) {
$l_line=pg_fetch_array($Res,$i);
$col[]=ParseFormula($this->db,
$l_line['fo_label'],
$l_line['fo_formula'],
$p_start,
$p_end
);
$col[]=ParseFormula($this->db,
$l_line['fo_label'],
$l_line['fo_formula'],
$p_start,
$p_end
);
} //for ($i
$this->row=$col;

36
include/form_inc.php
View file

@ -20,7 +20,7 @@
// Copyright Author Dany De Bontridder ddebontridder@yahoo.fr
//$Revision$
include_once("impress_inc.php");
/* function EncodeForm
* Purpose :
* Encoding Form
@ -104,6 +104,8 @@ if ( isset ($fr_id)) printf ('<INPUT TYPE="HIDDEN" NAME="fr_id" value="%s"',
echo '<INPUT TYPE="submit" value="Enregistre" name="record">';
}
echo '<INPUT TYPE="submit" value="Ajoute une ligne" name="add_line">';
echo '<INPUT TYPE="submit" value="Efface ce formulaire" name="del_form">';
echo "</FORM>";
}
@ -129,6 +131,23 @@ function ViewForm($p_cn,$p_sessid,$p_id) {
EncodeForm($l_line,$p_sessid,$array);
}
/* function ViewForm
* Purpose : Show the details of a form
*
* parm :
* - $p_cn connection
* - $p_id gives the formdef.fr_id
* - sessid for the search window
* gen :
* - none
* return:
* - none
*
*/
function DeleteForm($p_cn,$p_id) {
ExecSql($p_cn,"delete from form where fo_fr_id=$p_id");
ExecSql($p_cn,"delete from formdef where fr_id=$p_id");
}
/* function GetDataForm
* Purpose :
* Get data from a form
@ -218,7 +237,7 @@ function UpdateForm($p_cn,$p_array) {
echo_debug ("UpdateForm $key = $element");
${"$key"}=$element;
}
$Res=ExecSql($p_cn,"update formdef set fr_label='".$form_nom."' where fr_id=".$fr_id);
$Res=ExecSql($p_cn,"update formdef set fr_label='".FormatString($form_nom)."' where fr_id=".$fr_id);
$Res=ExecSql($p_cn,"delete from form where fo_fr_id=".$fr_id);
// Test les positions
for ($i =0; $i <$line;$i++) {
@ -243,6 +262,9 @@ function UpdateForm($p_cn,$p_array) {
${"text$i"}=FormatString(${"text$i"});
${"form$i"}=FormatString(${"form$i"});
if ( ${"text$i"} != null ) {
if ( CheckFormula(${"form$i"}) == false )
${"form$i"}="!!!!!!! FORMULE INVALIDE ".${"form$i"};
${"form$i"}=(${"form$i"}==null)?"null":"'".${"form$i"}."'";
$sql=sprintf("insert into form (fo_fr_id,
fo_pos,
@ -252,7 +274,9 @@ function UpdateForm($p_cn,$p_array) {
%d,
'%s',
%s)",
$fr_id,${"pos$i"},${"text$i"},${"form$i"}
$fr_id,${"pos$i"},
${"text$i"},
${"form$i"}
);
$Res=ExecSql($p_cn,$sql);
}
@ -283,7 +307,7 @@ function AddForm($p_cn,$p_array) {
echo_error("Nom ou ligne non défini");
return;
}
$sql="insert into formdef (fr_label) values ('".$form_nom."')";
$sql="insert into formdef (fr_label) values ('".FormatString($form_nom)."')";
$Res=ExecSql($p_cn,$sql);
$n=GetSequence($p_cn,"s_formdef");
@ -291,7 +315,9 @@ function AddForm($p_cn,$p_array) {
${"text$i"}=FormatString(${"text$i"});
${"form$i"}=FormatString(${"form$i"});
if ( ${"text$i"} != null ) {
${"form$i"}=(${"form$i"}==null)?${"form$i"}:"'".${"form$i"}."'";
// ${"form$i"}=(${"form$i"}==null)?${"form$i"}:"'".${"form$i"}."'";
${"form$i"}=(${"form$i"}==null)?"null":"'".${"form$i"}."'";
CheckFormula(${"form$i"});
$sql=sprintf("insert into form (fo_fr_id,
fo_pos,
fo_label,

29
include/impress_inc.php
View file

@ -718,10 +718,15 @@ function GetRappel($p_cn,$p_jrnx_id,$p_jrn_id,$p_exercice,$which,$p_type,$p_cent
* - array
*
*
* NOTE: problem: the formulas don't take date range parameters into account....TODO.
* --> I would like to get the sum of operations between two specified dates.
*/
function ParseFormula($p_cn,$p_label,$p_formula,$p_start,$p_end) {
if ( CheckFormula($p_formula) == false) {
$aret=array('desc'=>$p_label.' Erreur Formule!',
'montant'=>0);
return $aret;
}
if ( $p_start == $p_end )
$cond=" j_tech_per = $p_start ";
else
@ -822,4 +827,24 @@ function GetFormulaValue($p_cn,$p_label,$p_formula,$p_cond)
}
return $aret;
}
/* function CheckFormula
**************************************************
* Purpose : Check if formula doesn't contain
* php injection
*
* parm :
* - string
* gen :
* -
* return: none : stop on error
*/
function CheckFormula($p_string) {
if ( ereg ("^((\[{0,1}[0-9]+\.*[0-9]*%{0,1}\]{0,1})+ *([+-\*/])* *(\[{0,1}[0-9]+\.*[0-9]*%{0,1}\]{0,1})*)*( *FROM=[0-9][0-0].20[0-9][0-9]){0,1}$",$p_string) == false)
{
return false;
} else {
return true;
}
}
?>