From ecc3b531a8a62f48700e0e63060c159b5bc219b9 Mon Sep 17 00:00:00 2001 From: Dany De Bontridder Date: Fri, 1 Jun 2018 23:02:22 +0200 Subject: [PATCH] Fix : security fixes see rapport exakat (Damien Seguy) --- html/fid.php | 9 +++++---- html/index.php | 2 +- include/action.common.inc.php | 10 +++++----- include/ajax/ajax_history.php | 9 +++++---- include/ajax/ajax_todo_list.php | 6 ++++-- include/anc_od.inc.php | 6 +++--- include/category_card.inc.php | 4 +++- 7 files changed, 26 insertions(+), 20 deletions(-) diff --git a/html/fid.php b/html/fid.php index d8be46521..124860ca7 100644 --- a/html/fid.php +++ b/html/fid.php @@ -48,13 +48,14 @@ $g_user=new User($cn); $g_user->check(); $g_user->check_dossier(dossier::id()); set_language(); -$fLabel=(isset($_REQUEST['l']))?$_REQUEST['l']:'none'; -$fTva_id=(isset($_REQUEST['t']))?$_REQUEST['t']:'none'; -$fPrice_sale=(isset($_REQUEST['p']))?$_REQUEST['p']:'none'; -$fPrice_purchase=(isset($_REQUEST['b']))?$_REQUEST['b']:'none'; $hi=new HttpInput(); +$fLabel=$hi->request("l","string","none"); +$fTva_id=$hi->request("t","string","none"); +$fPrice_sale=$hi->request("p","string","none"); +$fPrice_purchase=$hi->request("b","string","none"); + if ( isset($_SESSION['isValid']) && $_SESSION['isValid'] == 1) { $jrn=$hi->get('j', "number",'-1'); diff --git a/html/index.php b/html/index.php index 9f6eb665a..e69f47ba3 100644 --- a/html/index.php +++ b/html/index.php @@ -187,7 +187,7 @@ if (defined("RECOVER") && isset ($_REQUEST['recover']) ) // reconnect , create a variable to reconnect properly in login.php $goto=""; if (isset ($_REQUEST['reconnect']) && isset ($_REQUEST['backurl'])) { - $goto=''; + $goto=''; } echo ' diff --git a/include/action.common.inc.php b/include/action.common.inc.php index 3ed4cdcbd..eb6ff979b 100644 --- a/include/action.common.inc.php +++ b/include/action.common.inc.php @@ -186,7 +186,7 @@ if ($sub_action == "update") $act->qcode_dest = $_REQUEST['qcode_dest']; echo $act->Display('NEW', false, $base, $retour); - echo ''; + echo ''; echo ''; echo ''; echo '

'; @@ -243,9 +243,9 @@ if ($sub_action == 'delete') // confirmed $cn->start(); $act = new Follow_Up($cn); - $act->ag_id = $_REQUEST['ag_id']; + $act->ag_id =$http->request("ag_id","number") ; $act->get(); - if ($g_user->can_write_action($_REQUEST['ag_id'])==true) $act->remove(); + if ($g_user->can_write_action($act->ag_id)==true) $act->remove(); $sub_action = "list"; $cn->commit(); Follow_Up::show_action_list($cn, $base); @@ -314,12 +314,12 @@ if ($sub_action == "add_action") echo dossier::hidden(); - $act->ag_comment = (isset($_POST['ag_comment'])) ? Decode($_POST['ag_comment']) : ""; + $act->ag_comment =Decode($http->post("ag_comment","string","")); if (isset($_REQUEST['qcode'])) $act->qcode_dest = $_REQUEST['qcode']; echo $act->Display('NEW', false, $base, $retour); - echo ''; + echo ''; echo ''; echo ''; echo ''; diff --git a/include/ajax/ajax_history.php b/include/ajax/ajax_history.php index f3fb23bc7..904b71fe9 100644 --- a/include/ajax/ajax_history.php +++ b/include/ajax/ajax_history.php @@ -32,7 +32,7 @@ require_once NOALYSS_INCLUDE.'/class/periode.class.php'; require_once NOALYSS_INCLUDE.'/lib/html_input.class.php'; require_once NOALYSS_INCLUDE.'/class/acc_account.class.php'; require_once NOALYSS_INCLUDE.'/class/exercice.class.php'; -$div=$_REQUEST['div']; +$div=$http->request('div'); mb_internal_encoding("UTF-8"); $http=new HttpInput(); /** @@ -86,7 +86,7 @@ if ( isset($_GET['f_id'])) $dossier=dossier::id(); if ( $div != 'popup') { - $obj="{op:'history',div:'$div',f_id:'".$_GET['f_id']."',gDossier:'$dossier',select:this,exercice:{$year}}"; + $obj="{op:'history',div:'$div',f_id:'".$f_id."',gDossier:'$dossier',select:this,exercice:{$year}}"; $is=$exercice->select('p_exercice',$default,' onchange="update_history_card('.$obj.');"'); $old=_("Autre exercice")." ".$is->input(); } @@ -137,7 +137,8 @@ if ( isset($_GET['f_id'])) /////////////////////////////////////////////////////////////////////////// if ( isset($_REQUEST['pcm_val'])) { - $poste=new Acc_Account_Ledger($cn,$_REQUEST['pcm_val']); + $pcm_val=$http->request("pcm_val"); + $poste=new Acc_Account_Ledger($cn,$pcm_val); $poste->load(); $year=$http->get("exercice","string",""); if ( $year == "") $year=$g_user->get_exercice(); @@ -172,7 +173,7 @@ if ( isset($_REQUEST['pcm_val'])) $dossier=dossier::id(); if ( $div != 'popup') { - $obj="{op:'history',div:'$div',pcm_val:'".$_GET['pcm_val']."',gDossier:'$dossier',select:this,exercice:{$year}}"; + $obj="{op:'history',div:'$div',pcm_val:'".$pcm_val."',gDossier:'$dossier',select:this,exercice:{$year}}"; $is=$exercice->select('p_exercice',$default,' onchange="update_history_account('.$obj.');"'); $old=_("Autre exercice")." ".$is->input(); } diff --git a/include/ajax/ajax_todo_list.php b/include/ajax/ajax_todo_list.php index 4c95df88f..430014b9a 100644 --- a/include/ajax/ajax_todo_list.php +++ b/include/ajax/ajax_todo_list.php @@ -56,7 +56,8 @@ if (isset($_REQUEST['show'])) { $cn=Dossier::connect(); $todo=new Todo_list($cn); - $todo->set_parameter('id',$_REQUEST['id']); + $id=$http->request("id"); + $todo->set_parameter('id',$id); $todo->load(); $content=$todo->display(); header('Content-type: text/xml; charset=UTF-8'); @@ -79,9 +80,10 @@ if (isset($_REQUEST['show'])) //////////////////////////////////////////////////////////////////////////////// if (isset($_REQUEST['del'])) { + $id=$http->request("id"); $cn=Dossier::connect(); $todo=new Todo_list($cn); - $todo->set_parameter('id',$_REQUEST['id']); + $todo->set_parameter('id',$id); $todo->delete(); exit(); } diff --git a/include/anc_od.inc.php b/include/anc_od.inc.php index fec76187f..65e789824 100644 --- a/include/anc_od.inc.php +++ b/include/anc_od.inc.php @@ -55,10 +55,10 @@ echo '
- '._('Nouveau').' + '._('Nouveau').' -'._('Liste opérations').' '._('Liste opérations').'
@@ -87,7 +87,7 @@ if ( isset($_GET['see'])) $hid=new IHidden(); $hid->name="ac"; - $hid->value=$_REQUEST['ac']; + $hid->value=$http->request("ac"); echo $hid->input(); $hid->name="see"; diff --git a/include/category_card.inc.php b/include/category_card.inc.php index 4ba5274b5..4e1b993c6 100644 --- a/include/category_card.inc.php +++ b/include/category_card.inc.php @@ -33,7 +33,9 @@ require_once NOALYSS_INCLUDE.'/class/contact.class.php'; global $http; $str_dossier=Dossier::get(); -$root='?ac='.$_REQUEST['ac']."&sb=detail&f_id=".$_REQUEST["f_id"].'&'.$str_dossier; + +$root="?".http_build_query(["ac"=>$http->request("ac"),"sb"=>"detail","f_id"=>$http->request("f_id")]); +$root.="&".$str_dossier; $ss_action=$http->request("sc", "string", "dc");