Skip to content
Snippets Groups Projects
Commit 455a9ed4 authored by Laurent Destailleur's avatar Laurent Destailleur
Browse files

FIX security in import of files

parent f9ef6f52
Branches
Tags
No related merge requests found
......@@ -140,10 +140,8 @@ class FormFile
if ($perm)
{
$langs->load('other');
//$out .= ' ('.$langs->trans("MaxSize").': '.$max.' '.$langs->trans("Kb");
$out .= ' ';
$out .= info_admin($langs->trans("ThisLimitIsDefinedInSetup",$max,$maxphp),1);
//$out .= ')';
}
}
else
......
......@@ -372,7 +372,7 @@ class ImportCsv extends ModeleImports
if ($isidorref == 'ref') // If value into input import file is a ref, we apply the function defined into descriptor
{
$file=$objimport->array_import_convertvalue[0][$val]['classfile'];
$file=(empty($objimport->array_import_convertvalue[0][$val]['classfile'])?$objimport->array_import_convertvalue[0][$val]['file']:$objimport->array_import_convertvalue[0][$val]['classfile']);
$class=$objimport->array_import_convertvalue[0][$val]['class'];
$method=$objimport->array_import_convertvalue[0][$val]['method'];
if ($this->cacheconvert[$file.'_'.$class.'_'.$method.'_'][$newval] != '')
......
......@@ -530,6 +530,14 @@ if ($step == 3 && $datatoimport)
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="max_file_size" value="'.$conf->maxfilesize.'">';
print '<input type="hidden" value="'.$step.'" name="step">';
print '<input type="hidden" value="'.$format.'" name="format">';
print '<input type="hidden" value="'.$excludefirstline.'" name="excludefirstline">';
print '<input type="hidden" value="'.$endatlinenb.'" name="endatlinenb">';
print '<input type="hidden" value="'.$separator.'" name="separator">';
print '<input type="hidden" value="'.$enclosure.'" name="enclosure">';
print '<input type="hidden" value="'.$datatoimport.'" name="datatoimport">';
print '<table class="noborder" width="100%" cellspacing="0" cellpadding="4">';
$filetoimport='';
......@@ -543,14 +551,30 @@ if ($step == 3 && $datatoimport)
$var=false;
print '<tr '.$bc[$var].'><td colspan="6">';
print '<input type="file" name="userfile" size="20" maxlength="80"> &nbsp; &nbsp; ';
print '<input type="submit" class="button" value="'.$langs->trans("AddFile").'" name="sendit">';
print '<input type="hidden" value="'.$step.'" name="step">';
print '<input type="hidden" value="'.$format.'" name="format">';
print '<input type="hidden" value="'.$excludefirstline.'" name="excludefirstline">';
print '<input type="hidden" value="'.$endatlinenb.'" name="endatlinenb">';
print '<input type="hidden" value="'.$separator.'" name="separator">';
print '<input type="hidden" value="'.$enclosure.'" name="enclosure">';
print '<input type="hidden" value="'.$datatoimport.'" name="datatoimport">';
$out = (empty($conf->global->MAIN_UPLOAD_DOC)?' disabled':'');
print '<input type="submit" class="button" value="'.$langs->trans("AddFile").'"'.$out.' name="sendit">';
$out='';
if (! empty($conf->global->MAIN_UPLOAD_DOC))
{
$max=$conf->global->MAIN_UPLOAD_DOC; // En Kb
$maxphp=@ini_get('upload_max_filesize'); // En inconnu
if (preg_match('/k$/i',$maxphp)) $maxphp=$maxphp*1;
if (preg_match('/m$/i',$maxphp)) $maxphp=$maxphp*1024;
if (preg_match('/g$/i',$maxphp)) $maxphp=$maxphp*1024*1024;
if (preg_match('/t$/i',$maxphp)) $maxphp=$maxphp*1024*1024*1024;
// Now $max and $maxphp are in Kb
if ($maxphp > 0) $max=min($max,$maxphp);
$langs->load('other');
$out .= ' ';
$out.=info_admin($langs->trans("ThisLimitIsDefinedInSetup",$max,$maxphp),1);
}
else
{
$out .= ' ('.$langs->trans("UploadDisabled").')';
}
print $out;
print '</td>';
print "</tr>\n";
// Search available imports
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment