Skip to content

Commit 64b3538

Browse files
eldyeldy
committed
Merge branch 'develop' of git@github.com:Dolibarr/dolibarr.git into develop
2 parents 84cbf15 + de12a67 commit 64b3538

File tree

66 files changed

+857
-581
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

66 files changed

+857
-581
lines changed

‎SECURITY.md

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -110,8 +110,7 @@ Scope is the web application (backoffice) and the APIs.
110110
* Software or libraries versions, private IP disclosure, Stack traces or path disclosure when logged-in user is admin.
111111
* Vulnerabilities affecting outdated browsers or platforms, or vulnerabilities inside browsers themself.
112112
* Brute force attacks on login page, password forgotten page or any public pages (/public/*) are not qualified if the recommended fail2ban rules were not installed.
113-
* SSL/TLS best practices
113+
* SSL/TLS practices (cypher enabled or not)
114114
* Invalid or missing SPF (Sender Policy Framework) records (Incomplete or missing SPF/DKIM/DMARC)
115115
* Physical or social engineering attempts or issues that require physical access to a victim’s computer/device
116-
* Vulnerabilities of type XSS exploited by using javascript into a website page (with permission to edit website pages) or by using php code into a website page
117-
using the permission to edit php code are not qualified, except if this allow to get higher privileges (being able to set javascript or php code is the expected behaviour).
116+
* Vulnerabilities of type XSS exploited by using javascript into a website page of the website module or by using php code into a website page (being able to set javascript or php code is the expected behaviour in the website module), except if the user does not have the permission to edit page or php code.

‎dev/build/phpstan/phpstan-baseline.neon

Lines changed: 2 additions & 170 deletions
Original file line numberDiff line numberDiff line change
@@ -54,12 +54,6 @@ parameters:
5454
count: 1
5555
path: ../../../htdocs/accountancy/admin/categories_list.php
5656

57-
-
58-
message: '#^Parameter \#12 \$tabcomplete of function complete_dictionary_with_modules expects array\<string, array\<string, array\<string, string\>\>\>, array\<int, array\> given\.$#'
59-
identifier: argument.type
60-
count: 1
61-
path: ../../../htdocs/accountancy/admin/categories_list.php
62-
6357
-
6458
message: '#^Right side of && is always true\.$#'
6559
identifier: booleanAnd.rightAlwaysTrue
@@ -102,12 +96,6 @@ parameters:
10296
count: 1
10397
path: ../../../htdocs/accountancy/admin/journals_list.php
10498

105-
-
106-
message: '#^Parameter \#12 \$tabcomplete of function complete_dictionary_with_modules expects array\<string, array\<string, array\<string, string\>\>\>, array\<int, array\> given\.$#'
107-
identifier: argument.type
108-
count: 1
109-
path: ../../../htdocs/accountancy/admin/journals_list.php
110-
11199
-
112100
message: '#^Ternary operator condition is always true\.$#'
113101
identifier: ternary.alwaysTrue
@@ -144,12 +132,6 @@ parameters:
144132
count: 1
145133
path: ../../../htdocs/accountancy/admin/report_list.php
146134

147-
-
148-
message: '#^Parameter \#12 \$tabcomplete of function complete_dictionary_with_modules expects array\<string, array\<string, array\<string, string\>\>\>, array\<int, array\> given\.$#'
149-
identifier: argument.type
150-
count: 1
151-
path: ../../../htdocs/accountancy/admin/report_list.php
152-
153135
-
154136
message: '#^Ternary operator condition is always true\.$#'
155137
identifier: ternary.alwaysTrue
@@ -1164,12 +1146,6 @@ parameters:
11641146
count: 1
11651147
path: ../../../htdocs/admin/dict.php
11661148

1167-
-
1168-
message: '#^Parameter \#12 \$tabcomplete of function complete_dictionary_with_modules expects array\<string, array\<string, array\<string, string\>\>\>, array\<string, array\<string, array\<string, string\>\|string\>\> given\.$#'
1169-
identifier: argument.type
1170-
count: 1
1171-
path: ../../../htdocs/admin/dict.php
1172-
11731149
-
11741150
message: '#^Variable \$param in empty\(\) always exists and is not falsy\.$#'
11751151
identifier: empty.variable
@@ -3402,12 +3378,6 @@ parameters:
34023378
count: 2
34033379
path: ../../../htdocs/bookmarks/bookmarks.lib.php
34043380

3405-
-
3406-
message: '#^Ternary operator condition is always false\.$#'
3407-
identifier: ternary.alwaysFalse
3408-
count: 1
3409-
path: ../../../htdocs/bookmarks/bookmarks.lib.php
3410-
34113381
-
34123382
message: '#^Variable \$contextpage in empty\(\) always exists and is not falsy\.$#'
34133383
identifier: empty.variable
@@ -3486,24 +3456,12 @@ parameters:
34863456
count: 1
34873457
path: ../../../htdocs/categories/class/api_categories.class.php
34883458

3489-
-
3490-
message: '#^Left side of && is always true\.$#'
3491-
identifier: booleanAnd.leftAlwaysTrue
3492-
count: 1
3493-
path: ../../../htdocs/categories/class/categorie.class.php
3494-
34953459
-
34963460
message: '#^Method Categorie\:\:get_full_arbo\(\) should return \-1\|array\<int, array\{rowid\: int, id\: int, fk_parent\: int, label\: string, description\: string, color\: string, position\: string, visible\: int, \.\.\.\}\> but returns array\<array\{rowid\: mixed, id\: mixed, fk_parent\: mixed, label\: mixed, description\: mixed, color\: mixed, position\: mixed, visible\: mixed, \.\.\.\}\>\.$#'
34973461
identifier: return.type
34983462
count: 1
34993463
path: ../../../htdocs/categories/class/categorie.class.php
35003464

3501-
-
3502-
message: '#^Negated boolean expression is always true\.$#'
3503-
identifier: booleanNot.alwaysTrue
3504-
count: 3
3505-
path: ../../../htdocs/categories/class/categorie.class.php
3506-
35073465
-
35083466
message: '#^Parameter \#1 \$array of function dol_sort_array contains unresolvable type\.$#'
35093467
identifier: argument.unresolvableType
@@ -3522,12 +3480,6 @@ parameters:
35223480
count: 1
35233481
path: ../../../htdocs/categories/class/categorie.class.php
35243482

3525-
-
3526-
message: '#^Variable \$url in empty\(\) always exists and is not falsy\.$#'
3527-
identifier: empty.variable
3528-
count: 2
3529-
path: ../../../htdocs/categories/class/categorie.class.php
3530-
35313483
-
35323484
message: '#^If condition is always true\.$#'
35333485
identifier: if.alwaysTrue
@@ -8142,12 +8094,6 @@ parameters:
81428094
count: 3
81438095
path: ../../../htdocs/core/actions_massactions.inc.php
81448096

8145-
-
8146-
message: '#^Variable \$permissiontoadd might not be defined\.$#'
8147-
identifier: variable.undefined
8148-
count: 10
8149-
path: ../../../htdocs/core/actions_massactions.inc.php
8150-
81518097
-
81528098
message: '#^Variable \$search_status might not be defined\.$#'
81538099
identifier: variable.undefined
@@ -19926,12 +19872,6 @@ parameters:
1992619872
count: 1
1992719873
path: ../../../htdocs/master.inc.php
1992819874

19929-
-
19930-
message: '#^Call to function is_array\(\) with array\<array\{modulenamewithcase\: mixed, moduledescriptorrelpath\: string, moduledescriptorfullpath\: mixed, moduledescriptorrootpath\: mixed, moduletype\?\: ''external''\|''internal''\}\> will always evaluate to true\.$#'
19931-
identifier: function.alreadyNarrowedType
19932-
count: 1
19933-
path: ../../../htdocs/modulebuilder/index.php
19934-
1993519875
-
1993619876
message: '#^Call to function is_array\(\) with non\-empty\-array\<mixed\> will always evaluate to true\.$#'
1993719877
identifier: function.alreadyNarrowedType
@@ -19944,12 +19884,6 @@ parameters:
1994419884
count: 2
1994519885
path: ../../../htdocs/modulebuilder/index.php
1994619886

19947-
-
19948-
message: '#^Parameter \#2 \$arrayreplacement of function dolReplaceInFile expects array\<string, string\>, array\<int\|string, array\<mixed\>\|string\> given\.$#'
19949-
identifier: argument.type
19950-
count: 1
19951-
path: ../../../htdocs/modulebuilder/index.php
19952-
1995319887
-
1995419888
message: '#^Right side of && is always true\.$#'
1995519889
identifier: booleanAnd.rightAlwaysTrue
@@ -26661,7 +26595,7 @@ parameters:
2666126595
-
2666226596
message: '#^Variable \$prodcustprice might not be defined\.$#'
2666326597
identifier: variable.undefined
26664-
count: 36
26598+
count: 3
2666526599
path: ../../../htdocs/societe/price.php
2666626600

2666726601
-
@@ -27198,36 +27132,12 @@ parameters:
2719827132
count: 1
2719927133
path: ../../../htdocs/theme/eldy/style.css.php
2720027134

27201-
-
27202-
message: '#^Variable \$fontlist might not be defined\.$#'
27203-
identifier: variable.undefined
27204-
count: 4
27205-
path: ../../../htdocs/theme/md/btn.inc.php
27206-
27207-
-
27208-
message: '#^Variable \$left might not be defined\.$#'
27209-
identifier: variable.undefined
27210-
count: 2
27211-
path: ../../../htdocs/theme/md/btn.inc.php
27212-
2721327135
-
2721427136
message: '#^Variable \$nbtopmenuentries might not be defined\.$#'
2721527137
identifier: variable.undefined
2721627138
count: 2
2721727139
path: ../../../htdocs/theme/md/btn.inc.php
2721827140

27219-
-
27220-
message: '#^Variable \$right might not be defined\.$#'
27221-
identifier: variable.undefined
27222-
count: 1
27223-
path: ../../../htdocs/theme/md/btn.inc.php
27224-
27225-
-
27226-
message: '#^Variable \$user might not be defined\.$#'
27227-
identifier: variable.undefined
27228-
count: 1
27229-
path: ../../../htdocs/theme/md/btn.inc.php
27230-
2723127141
-
2723227142
message: '#^Variable \$left might not be defined\.$#'
2723327143
identifier: variable.undefined
@@ -28362,12 +28272,6 @@ parameters:
2836228272
count: 8
2836328273
path: ../../../htdocs/webportal/class/html.formwebportal.class.php
2836428274

28365-
-
28366-
message: '#^Parameter \#3 \$preselectedvalue of method FormWebPortal\:\:selectForForms\(\) expects int, array\<mixed\>\|string given\.$#'
28367-
identifier: argument.type
28368-
count: 1
28369-
path: ../../../htdocs/webportal/class/html.formwebportal.class.php
28370-
2837128275
-
2837228276
message: '#^Call to function method_exists\(\) with \$this\(WebPortalInvoice\) and ''getLibStatut'' will always evaluate to true\.$#'
2837328277
identifier: function.alreadyNarrowedType
@@ -28488,12 +28392,6 @@ parameters:
2848828392
count: 1
2848928393
path: ../../../htdocs/webportal/class/webportalpropal.class.php
2849028394

28491-
-
28492-
message: '#^Parameter \#1 \$authentication of function check_authentication expects array\{login\: string, password\: string, entity\: int\|null, dolibarrkey\: string\}, array\{login\: string, entity\: int\} given\.$#'
28493-
identifier: argument.type
28494-
count: 1
28495-
path: ../../../htdocs/webservices/server_category.php
28496-
2849728395
-
2849828396
message: '#^Negated boolean expression is always true\.$#'
2849928397
identifier: booleanNot.alwaysTrue
@@ -28530,12 +28428,6 @@ parameters:
2853028428
count: 2
2853128429
path: ../../../htdocs/website/class/website.class.php
2853228430

28533-
-
28534-
message: '#^Parameter \#2 \$arrayreplacement of function dolReplaceInFile expects array\<string, string\>, array\<string, int\|string\> given\.$#'
28535-
identifier: argument.type
28536-
count: 3
28537-
path: ../../../htdocs/website/class/website.class.php
28538-
2853928431
-
2854028432
message: '#^Property Website\:\:\$description \(string\) in isset\(\) is not nullable\.$#'
2854128433
identifier: isset.property
@@ -28614,12 +28506,6 @@ parameters:
2861428506
count: 1
2861528507
path: ../../../htdocs/website/index.php
2861628508

28617-
-
28618-
message: '#^If condition is always true\.$#'
28619-
identifier: if.alwaysTrue
28620-
count: 1
28621-
path: ../../../htdocs/website/index.php
28622-
2862328509
-
2862428510
message: '#^Left side of && is always true\.$#'
2862528511
identifier: booleanAnd.leftAlwaysTrue
@@ -28635,7 +28521,7 @@ parameters:
2863528521
-
2863628522
message: '#^Negated boolean expression is always false\.$#'
2863728523
identifier: booleanNot.alwaysFalse
28638-
count: 2
28524+
count: 1
2863928525
path: ../../../htdocs/website/index.php
2864028526

2864128527
-
@@ -28656,30 +28542,12 @@ parameters:
2865628542
count: 1
2865728543
path: ../../../htdocs/website/index.php
2865828544

28659-
-
28660-
message: '#^Variable \$cate_arbo might not be defined\.$#'
28661-
identifier: variable.undefined
28662-
count: 1
28663-
path: ../../../htdocs/website/index.php
28664-
28665-
-
28666-
message: '#^Variable \$containertype might not be defined\.$#'
28667-
identifier: variable.undefined
28668-
count: 2
28669-
path: ../../../htdocs/website/index.php
28670-
2867128545
-
2867228546
message: '#^Variable \$contextpage in empty\(\) always exists and is not falsy\.$#'
2867328547
identifier: empty.variable
2867428548
count: 1
2867528549
path: ../../../htdocs/website/index.php
2867628550

28677-
-
28678-
message: '#^Variable \$disabled might not be defined\.$#'
28679-
identifier: variable.undefined
28680-
count: 1
28681-
path: ../../../htdocs/website/index.php
28682-
2868328551
-
2868428552
message: '#^Variable \$dolibarr_main_url_root might not be defined\.$#'
2868528553
identifier: variable.undefined
@@ -28692,36 +28560,6 @@ parameters:
2869228560
count: 1
2869328561
path: ../../../htdocs/website/index.php
2869428562

28695-
-
28696-
message: '#^Variable \$langcode might not be defined\.$#'
28697-
identifier: variable.undefined
28698-
count: 2
28699-
path: ../../../htdocs/website/index.php
28700-
28701-
-
28702-
message: '#^Variable \$otherfilters might not be defined\.$#'
28703-
identifier: variable.undefined
28704-
count: 2
28705-
path: ../../../htdocs/website/index.php
28706-
28707-
-
28708-
message: '#^Variable \$tmpobject might not be defined\.$#'
28709-
identifier: variable.undefined
28710-
count: 1
28711-
path: ../../../htdocs/website/index.php
28712-
28713-
-
28714-
message: '#^Variable \$urltograbdirrootwithoutslash might not be defined\.$#'
28715-
identifier: variable.undefined
28716-
count: 2
28717-
path: ../../../htdocs/website/index.php
28718-
28719-
-
28720-
message: '#^Variable \$urltograbdirwithoutslash might not be defined\.$#'
28721-
identifier: variable.undefined
28722-
count: 4
28723-
path: ../../../htdocs/website/index.php
28724-
2872528563
-
2872628564
message: '#^If condition is always false\.$#'
2872728565
identifier: if.alwaysFalse
@@ -28770,12 +28608,6 @@ parameters:
2877028608
count: 1
2877128609
path: ../../../htdocs/website/websiteaccount_card.php
2877228610

28773-
-
28774-
message: '#^Method Workstations\:\:index\(\) return type has no value type specified in iterable type array\.$#'
28775-
identifier: missingType.iterableValue
28776-
count: 1
28777-
path: ../../../htdocs/workstation/class/api_workstations.class.php
28778-
2877928611
-
2878028612
message: '#^Call to function method_exists\(\) with \$this\(Workstation\) and ''getLibStatut'' will always evaluate to true\.$#'
2878128613
identifier: function.alreadyNarrowedType

0 commit comments

Comments
 (0)