Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
D
dolibarr
Manage
Activity
Members
Code
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Deploy
Releases
Container registry
Model registry
Analyze
Contributor analytics
Repository analytics
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
GitLab community forum
Contribute to GitLab
Provide feedback
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
Software_Artifact_Infrastructure_Repository
dolibarr
Commits
7125e40f
Commit
7125e40f
authored
May 17, 2009
by
Laurent Destailleur
Browse files
Options
Downloads
Patches
Plain Diff
Another try to make the CSRF test before the master.inc.php
parent
c704146c
No related branches found
No related tags found
No related merge requests found
Changes
1
Show whitespace changes
Inline
Side-by-side
Showing
1 changed file
htdocs/main.inc.php
+12
-11
12 additions, 11 deletions
htdocs/main.inc.php
with
12 additions
and
11 deletions
htdocs/main.inc.php
+
12
−
11
View file @
7125e40f
...
...
@@ -56,13 +56,13 @@ if (function_exists('get_magic_quotes_gpc')) // magic_quotes_* removed in PHP6
{
$_GET
=
array_map
(
'stripslashes_deep'
,
$_GET
);
$_POST
=
array_map
(
'stripslashes_deep'
,
$_POST
);
$_COOKIE
=
array_map
(
'stripslashes_deep'
,
$_COOKIE
);
$_REQUEST
=
array_map
(
'stripslashes_deep'
,
$_REQUEST
);
$_COOKIE
=
array_map
(
'stripslashes_deep'
,
$_COOKIE
);
}
@
set_magic_quotes_runtime
(
0
);
}
// Security: SQL Injection protection (Filters on GET
and
POST)
// Security: SQL Injection protection (Filters on GET
,
POST
, REQUEST, COOKIE
)
function
test_sql_inject
(
$val
)
{
$sql_inj
=
0
;
...
...
@@ -107,6 +107,16 @@ function analyse_sql_injection(&$var)
analyse_sql_injection
(
$_GET
);
analyse_sql_injection
(
$_POST
);
// Security: CSRF protection
// The test to do is to check if referrer ($_SERVER['HTTP_REFERER']) is same web site than Dolibarr ($_SERVER['HTTP_HOST']).
if
(
!
defined
(
'NOCSRFCHECK'
)
&&
!
empty
(
$_SERVER
[
'HTTP_HOST'
])
&&
!
empty
(
$_SERVER
[
'HTTP_REFERER'
])
&&
!
eregi
(
$_SERVER
[
'HTTP_HOST'
],
$_SERVER
[
'HTTP_REFERER'
]))
{
// exit; Why not using simply an exit ?
unset
(
$_GET
);
unset
(
$_POST
);
unset
(
$_REQUEST
);
}
// This is to make Dolibarr working with Plesk
set_include_path
(
$_SERVER
[
'DOCUMENT_ROOT'
]
.
'/htdocs'
);
...
...
@@ -114,15 +124,6 @@ set_include_path($_SERVER['DOCUMENT_ROOT'].'/htdocs');
// This include will set: $conf, $langs and $mysoc objects
require_once
(
"master.inc.php"
);
// Security: CSRF protection
//print 'HTTP_REFERER='.$_SERVER['HTTP_REFERER'].'<br>';
//print 'DOL_MAIN_URL_ROOT='.DOL_MAIN_URL_ROOT.'<br>';
if
(
!
defined
(
'NOCSRFCHECK'
)
&&
!
empty
(
$_SERVER
[
'HTTP_REFERER'
])
&&
!
eregi
(
DOL_MAIN_URL_ROOT
,
$_SERVER
[
'HTTP_REFERER'
]))
{
unset
(
$_GET
);
unset
(
$_POST
);
}
// Check if HTTPS
if
(
$conf
->
file
->
main_force_https
)
{
...
...
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment