CVE-2012-1226: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the (1) file parameter to document.php or (2) backtopage parameter in a create action to comm/action/fiche.php.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Published: 2012-02-21T13:31Z
Repository: https://github.com/Dolibarr/dolibarr
Language: PHP
Files changed: htdocs/comm/action/document.php, htdocs/comm/action/fiche.php, htdocs/comm/remise.php, htdocs/comm/remx.php, htdocs/contact/fiche.php, htdocs/core/lib/functions.lib.php, htdocs/document.php, htdocs/projet/fiche.php, htdocs/projet/tasks.php, htdocs/public/members/new.php
Commit date: 2012-02-27 17:02:56 +0100
Commit message: Fix: Multiple directory traversal vulnerabilities with document.php

Diff: diff --git a/htdocs/comm/action/document.php b/htdocs/comm/action/document.php
index da79ff4223..88fa0f440e 100755
--- a/htdocs/comm/action/document.php
+++ b/htdocs/comm/action/document.php
@@ -1,10 +1,10 @@
 <?php
 /* Copyright (C) 2003-2004 Rodolphe Quiedeville  <rodolphe@quiedeville.org>
  * Copyright (C) 2004-2010 Laurent Destailleur   <eldy@users.sourceforge.net>
  * Copyright (C) 2005      Marc Barilley / Ocebo <marc@ocebo.com>
- * Copyright (C) 2005-2009 Regis Houssin         <regis@dolibarr.fr>
+ * Copyright (C) 2005-2012 Regis Houssin         <regis@dolibarr.fr>
  * Copyright (C) 2005      Simon TOSSER          <simon@kornog-computing.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
diff --git a/htdocs/comm/action/fiche.php b/htdocs/comm/action/fiche.php
index 85bb92979b..2951f701c7 100644
--- a/htdocs/comm/action/fiche.php
+++ b/htdocs/comm/action/fiche.php
@@ -1,10 +1,10 @@
 <?php
 /* Copyright (C) 2001-2005 Rodolphe Quiedeville <rodolphe@quiedeville.org>
  * Copyright (C) 2004-2012 Laurent Destailleur  <eldy@users.sourceforge.net>
  * Copyright (C) 2005      Simon TOSSER         <simon@kornog-computing.com>
- * Copyright (C) 2005-2011 Regis Houssin        <regis@dolibarr.fr>
+ * Copyright (C) 2005-2012 Regis Houssin        <regis@dolibarr.fr>
  * Copyright (C) 2010      Juanjo Menent        <jmenent@2byte.es>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
@@ -41,15 +41,16 @@ $langs->load("commercial");
 $langs->load("other");
 $langs->load("bills");
 $langs->load("orders");
 $langs->load("agenda");
 
-$action=GETPOST("action");
+$action=GETPOST('action','alpha');
+$backtopage=GETPOST('backtopage','alpha');
 
 // Security check
-$socid = GETPOST('socid');
-$id = GETPOST('id');
+$socid = GETPOST('socid','int');
+$id = GETPOST('id','int');
 if ($user->societe_id) $socid=$user->societe_id;
 //$result = restrictedArea($user, 'agenda', $id, 'actioncomm', 'actions', '', 'id');
 
 $error=GETPOST("error");
 
@@ -64,13 +65,11 @@ $contact = new Contact($db);
  */
 if ($action == 'add_action')
 {
 	$error=0;
 
-    $backtopage='';
-    if (! empty($_POST["backtopage"])) $backtopage=$_POST["backtopage"];
-    if (! $backtopage)
+    if (empty($backtopage))
     {
         if ($socid > 0) $backtopage = DOL_URL_ROOT.'/societe/agenda.php?socid='.$socid;
         else $backtopage=DOL_URL_ROOT.'/comm/action/index.php';
     }
 
@@ -337,18 +336,13 @@ if ($action == 'update')
 		$langs->load("errors");
 		$mesg='<div class="error">'.$langs->trans($actioncomm->error).'</div>';
 	}
 	else
 	{
-		if (! empty($_POST["from"]))  // deprecated. Use backtopage instead
-		{
-			header("Location: ".$_POST["from"]);
-			exit;
-		}
-        if (! empty($_POST["backtopage"]))
+        if (! empty($backtopage))
         {
-            header("Location: ".$_POST["backtopage"]);
+            header("Location: ".$backtopage);
             exit;
         }
 	}
 }
 
@@ -424,11 +418,11 @@ if ($action == 'create')
     }
 
 	print '<form name="formaction" action="'.DOL_URL_ROOT.'/comm/action/fiche.php" method="POST">';
 	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	print '<input type="hidden" name="action" value="add_action">';
-	if (GETPOST("backtopage")) print '<input type="hidden" name="backtopage" value="'.(GETPOST("backtopage") != 1 ? GETPOST("backtopage") : $_SERVER["HTTP_REFERER"]).'">';
+	print '<input type="hidden" name="backtopage" value="'.(! empty($backtopage) ? $backtopage : $_SERVER["HTTP_REFERER"]).'">';
 
 	if (GETPOST("actioncode") == 'AC_RDV') print_fiche_titre($langs->trans("AddActionRendezVous"));
 	else print_fiche_titre($langs->trans("AddAnAction"));
 
 	dol_htmloutput_mesg($mesg);
@@ -677,11 +671,11 @@ if ($id)
 		print '<form name="formaction" action="'.DOL_URL_ROOT.'/comm/action/fiche.php" method="post">';
 		print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 		print '<input type="hidden" name="action" value="update">';
 		print '<input type="hidden" name="id" value="'.$id.'">';
 		print '<input type="hidden" name="ref_ext" value="'.$act->ref_ext.'">';
-		if (GETPOST("backtopage")) print '<input type="hidden" name="backtopage" value="'.(GETPOST("backtopage") ? GETPOST("backtopage") : $_SERVER["HTTP_REFERER"]).'">';
+		print '<input type="hidden" name="backtopage" value="'.(! empty($backtopage) ? $backtopage : $_SERVER["HTTP_REFERER"]).'">';
 
 		print '<table class="border" width="100%">';
 
 		// Ref
 		print '<tr><td width="30%">'.$langs->trans("Ref").'</td><td colspan="3">'.$act->id.'</td></tr>';
diff --git a/htdocs/comm/remise.php b/htdocs/comm/remise.php
index abfb500597..b124a83714 100644
--- a/htdocs/comm/remise.php
+++ b/htdocs/comm/remise.php
@@ -28,25 +28,27 @@ require_once(DOL_DOCUMENT_ROOT."/contact/class/contact.class.php");
 
 $langs->load("companies");
 $langs->load("orders");
 $langs->load("bills");
 
-$socid = GETPOST("id");
+$socid = GETPOST('id','int');
 // Security check
 if ($user->societe_id > 0)
 {
 	$socid = $user->societe_id;
 }
 
+$backtopage = GETPOST('backtopage','alpha');
+
 
 /*
  * Actions
  */
 
-if (GETPOST('cancel') && GETPOST('backtopage'))
+if (GETPOST('cancel') && ! empty($backtopage))
 {
-     Header("Location: ".GETPOST("backtopage"));
+     Header("Location: ".$backtopage);
      exit;
 }
 
 if (GETPOST("action") == 'setremise')
 {
@@ -54,13 +56,13 @@ if (GETPOST("action") == 'setremise')
 	$soc->fetch($_GET["id"]);
 	$result=$soc->set_remise_client($_POST["remise"],$_POST["note"],$user);
 
 	if ($result > 0)
 	{
-	    if (GETPOST('backtopage'))
+	    if (! empty($backtopage))
 	    {
-    		Header("Location: ".GETPOST('backtopage'));
+    		Header("Location: ".$backtopage);
     		exit;
 	    }
 	    else
 	    {
     		Header("Location: remise.php?id=".$_GET["id"]);
@@ -120,11 +122,11 @@ if ($socid > 0)
 	print_fiche_titre($langs->trans("NewRelativeDiscount"),'','');
 
 	print '<form method="POST" action="remise.php?id='.$objsoc->id.'">';
 	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	print '<input type="hidden" name="action" value="setremise">';
-    print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
+    print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
 
 	print '<table class="border" width="100%">';
 
 	// Nouvelle valeur
 	print '<tr><td colspan="2">';
@@ -136,11 +138,11 @@ if ($socid > 0)
 
 	print "</table>";
 
 	print '<center>';
 	print '<input type="submit" class="button" value="'.$langs->trans("Modify").'">';
-    if (GETPOST("backtopage"))
+    if (! empty($backtopage))
     {
         print '&nbsp; &nbsp; ';
 	    print '<input type="submit" class="button" name="cancel" value="'.$langs->trans("Cancel").'">';
     }
 	print '</center>';
diff --git a/htdocs/comm/remx.php b/htdocs/comm/remx.php
index 8f26a58463..42bac50817 100644
--- a/htdocs/comm/remx.php
+++ b/htdocs/comm/remx.php
@@ -30,11 +30,12 @@ require_once(DOL_DOCUMENT_ROOT."/core/class/discount.class.php");
 
 $langs->load("orders");
 $langs->load("bills");
 $langs->load("companies");
 
-$action=GETPOST('action');
+$action=GETPOST('action','alpha');
+$backtopage=GETPOST('backtopage','alpha');
 
 // Security check
 $socid = GETPOST("id");
 if ($user->societe_id > 0)
 {
@@ -44,13 +45,13 @@ if ($user->societe_id > 0)
 
 /*
  * Actions
  */
 
-if (GETPOST('cancel') && GETPOST('backtopage'))
+if (GETPOST('cancel') && ! empty($backtopage))
 {
-     Header("Location: ".GETPOST("backtopage"));
+     Header("Location: ".$backtopage);
      exit;
 }
 
 if ($action == 'confirm_split' && GETPOST("confirm") == 'yes')
 {
@@ -149,13 +150,13 @@ if ($action == 'setremise')
 			$soc->fetch($_GET["id"]);
 			$discountid=$soc->set_remise_except($_POST["amount_ht"],$user,$_POST["desc"],$_POST["tva_tx"]);
 
 			if ($discountid > 0)
 			{
-			    if (GETPOST("backtopage"))
+			    if (! empty($backtopage))
 			    {
-			        Header("Location: ".GETPOST("backtopage").'&discountid='.$discountid);
+			        Header("Location: ".$backtopage.'&discountid='.$discountid);
 			        exit;
 			    }
 				else
 				{
 				    Header("Location: remx.php?id=".$_GET["id"]);
@@ -226,11 +227,11 @@ if ($socid > 0)
 
 
 	print '<form method="POST" action="'.$_SERVER["PHP_SELF"].'?id='.$objsoc->id.'">';
 	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	print '<input type="hidden" name="action" value="setremise">';
-    print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
+    print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
 
 	print '<table class="border" width="100%">';
 
 	// Name
 	print '<tr><td width="38%">'.$langs->trans('Name').'</td>';
@@ -278,11 +279,11 @@ if ($socid > 0)
 
 	print "</table>";
 
 	print '<center>';
 	print '<input type="submit" class="button" name="submit" value="'.$langs->trans("AddGlobalDiscount").'">';
-    if (GETPOST("backtopage"))
+    if (! empty($backtopage))
     {
         print '&nbsp; &nbsp; ';
 	    print '<input type="submit" class="button" name="cancel" value="'.$langs->trans("Cancel").'">';
     }
 	print '</center>';
diff --git a/htdocs/contact/fiche.php b/htdocs/contact/fiche.php
index 213980d55a..bb6ff79a06 100644
--- a/htdocs/contact/fiche.php
+++ b/htdocs/contact/fiche.php
@@ -37,14 +37,15 @@ $langs->load("users");
 $langs->load("other");
 $langs->load("commercial");
 
 $mesg=''; $error=0; $errors=array();
 
-$action		= (GETPOST('action') ? GETPOST('action') : 'view');
-$confirm	= GETPOST('confirm');
-$id			= GETPOST("id");
-$socid		= GETPOST("socid");
+$action		= (GETPOST('action','alpha') ? GETPOST('action','alpha') : 'view');
+$confirm	= GETPOST('confirm','alpha');
+$backtopage = GETPOST('backtopage','alpha');
+$id			= GETPOST('id','int');
+$socid		= GETPOST('socid','int');
 if ($user->societe_id) $socid=$user->societe_id;
 
 $object = new Contact($db);
 
 // Get object canvas (By default, this is not defined, so standard usage of dolibarr)
@@ -74,21 +75,21 @@ $parameters=array('id'=>$id, 'objcanvas'=>$objcanvas);
 $reshook=$hookmanager->executeHooks('doActions',$parameters,$object,$action);    // Note that $action and $object may have been modified by some hooks
 
 if (empty($reshook))
 {
     // Cancel
-    if (GETPOST("cancel") && GETPOST('backtopage'))
+    if (GETPOST("cancel") && ! empty($backtopage))
     {
-        header("Location: ".GETPOST('backtopage'));
+        header("Location: ".$backtopage);
         exit;
     }
 
 	// Creation utilisateur depuis contact
     if ($action == 'confirm_create_user' && $confirm == 'yes' && $user->rights->user->user->creer)
     {
         // Recuperation contact actuel
-        $result = $object->fetch($_GET["id"]);
+        $result = $object->fetch($id);
 
         if ($result > 0)
         {
             $db->begin();
 
@@ -170,11 +171,11 @@ if (empty($reshook))
         }
 
         if (! $error && $id > 0)
         {
             $db->commit();
-            if (GETPOST('backtopage')) $url=GETPOST('backtopage');
+            if (! empty($backtopage)) $url=$backtopage;
             else $url='fiche.php?id='.$id;
             Header("Location: ".$url);
             exit;
         }
         else
@@ -366,11 +367,11 @@ else
 
             print '<br>';
             print '<form method="post" name="formsoc" action="'.$_SERVER["PHP_SELF"].'">';
             print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
             print '<input type="hidden" name="action" value="add">';
-            print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
+            print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
             print '<table class="border" width="100%">';
 
             // Name
             print '<tr><td width="20%" class="fieldrequired">'.$langs->trans("Lastname").' / '.$langs->trans("Label").'</td><td width="30%"><input name="name" type="text" size="30" maxlength="80" value="'.(isset($_POST["name"])?$_POST["name"]:$object->name).'"></td>';
             print '<td width="20%">'.$langs->trans("Firstname").'</td><td width="30%"><input name="firstname" type="text" size="30" maxlength="80" value="'.(isset($_POST["firstname"])?$_POST["firstname"]:$object->firstname).'"></td></tr>';
@@ -495,11 +496,11 @@ else
             print "</table><br><br>";
 
 
             print '<center>';
             print '<input type="submit" class="button" name="add" value="'.$langs->trans("Add").'">';
-            if (GETPOST('backtopage'))
+            if (! empty($backtopage))
             {
                 print ' &nbsp; &nbsp; ';
                 print '<input type="submit" class="button" name="cancel" value="'.$langs->trans("Cancel").'">';
             }
             print '</center>';
@@ -535,15 +536,15 @@ else
 							});
 						})';
                 print '</script>';
             }
 
-            print '<form method="post" action="'.$_SERVER["PHP_SELF"].'?id='.GETPOST("id").'" name="formsoc">';
+            print '<form method="post" action="'.$_SERVER["PHP_SELF"].'?id='.$id.'" name="formsoc">';
             print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
-            print '<input type="hidden" name="id" value="'.GETPOST("id").'">';
+            print '<input type="hidden" name="id" value="'.$id.'">';
             print '<input type="hidden" name="action" value="update">';
-            print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
+            print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
             print '<input type="hidden" name="contactid" value="'.$object->id.'">';
             print '<input type="hidden" name="old_name" value="'.$object->name.'">';
             print '<input type="hidden" name="old_firstname" value="'.$object->firstname.'">';
             print '<table class="border" width="100%">';
 
diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index f9836b4165..5dfcda5ab1 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -255,11 +255,15 @@ function GETPOST($paramname,$check='',$method=0)
 		// Check if numeric
 		if ($check == 'int' && ! preg_match('/^[-\.,0-9]+$/i',trim($out))) $out='';
 		// Check if alpha
 		//if ($check == 'alpha' && ! preg_match('/^[ =:@#\/\\\(\)\-\._a-z0-9]+$/i',trim($out))) $out='';
 		// '"' is dangerous because param in url can close the href= or src= and add javascript functions.
-		if ($check == 'alpha' && preg_match('/"/',trim($out))) $out='';
+		if ($check == 'alpha')
+		{
+			if (preg_match('/"/',trim($out))) $out='';
+			else if (preg_match('/(\.\.\/)+/',trim($out))) $out='';
+		}
 	}
 
 	return $out;
 }
 
diff --git a/htdocs/document.php b/htdocs/document.php
index 9c59f1da05..8836ebdbf9 100644
--- a/htdocs/document.php
+++ b/htdocs/document.php
@@ -1,10 +1,10 @@
 <?php
 /* Copyright (C) 2004-2007 Rodolphe Quiedeville <rodolphe@quiedeville.org>
  * Copyright (C) 2004-2012 Laurent Destailleur  <eldy@users.sourceforge.net>
  * Copyright (C) 2005      Simon Tosser         <simon@kornog-computing.com>
- * Copyright (C) 2005-2011 Regis Houssin        <regis@dolibarr.fr>
+ * Copyright (C) 2005-2012 Regis Houssin        <regis@dolibarr.fr>
  * Copyright (C) 2010	   Pierre Morin         <pierre.morin@auguria.net>
  * Copyright (C) 2010	   Juanjo Menent        <jmenent@2byte.es>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -48,14 +48,14 @@ function llxHeader() { }
 
 require("./main.inc.php");	// Load $user and permissions
 require_once(DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php');
 
 $encoding = '';
-$action = GETPOST("action");
-$original_file = GETPOST("file");	// Do not use urldecode here ($_GET are already decoded by PHP).
-$modulepart = GETPOST("modulepart");
-$urlsource = GETPOST("urlsource");
+$action = GETPOST('action','alpha');
+$original_file = GETPOST('file','alpha');	// Do not use urldecode here ($_GET are already decoded by PHP).
+$modulepart = GETPOST('modulepart','alpha');
+$urlsource = GETPOST('urlsource','alpha');
 
 // Security check
 if (empty($modulepart)) accessforbidden('Bad value for parameter modulepart');
 
 
@@ -70,11 +70,11 @@ if (empty($modulepart)) accessforbidden('Bad value for parameter modulepart');
  * View
  */
 
 // Define mime type
 $type = 'application/octet-stream';
-if (GETPOST('type')) $type=GETPOST('type');
+if (GETPOST('type','alpha')) $type=GETPOST('type','alpha');
 else $type=dol_mimetype($original_file);
 //print 'X'.$type.'-'.$original_file;exit;
 
 // Define attachment (attachment=true to force choice popup 'open'/'save as')
 $attachment = true;
diff --git a/htdocs/projet/fiche.php b/htdocs/projet/fiche.php
index 95aba87efb..371028f02f 100644
--- a/htdocs/projet/fiche.php
+++ b/htdocs/projet/fiche.php
@@ -32,12 +32,13 @@ require_once(DOL_DOCUMENT_ROOT."/core/modules/project/modules_project.php");
 
 $langs->load("projects");
 $langs->load('companies');
 
 $id=GETPOST('id','int');
-$ref = GETPOST('ref');
-$action=GETPOST('action');
+$ref = GETPOST('ref','alpha');
+$action=GETPOST('action','alpha');
+$backtopage=GETPOST('backtopage','alpha');
 
 if ($id == '' && $ref == '' && ($action != "create" && $action != "add" && $action != "update" && ! $_POST["cancel"])) accessforbidden();
 
 $mine = GETPOST('mode')=='mine' ? 1 : 0;
 //if (! $user->rights->projet->all->lire) $mine=1;	// Special for projects
@@ -53,13 +54,13 @@ $result = restrictedArea($user, 'projet', $id);
 /*
  * Actions
  */
 
 // Cancel
-if (GETPOST("cancel") && GETPOST('backtopage'))
+if (GETPOST("cancel") && ! empty($backtopage))
 {
-    header("Location: ".GETPOST('backtopage'));
+    header("Location: ".$backtopage);
     exit;
 }
 
 if ($action == 'add' && $user->rights->projet->creer)
 {
@@ -274,11 +275,11 @@ if ($action == 'create' && $user->rights->projet->creer)
     dol_htmloutput_mesg($mesg);
 
     print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
     print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
     print '<input type="hidden" name="action" value="add">';
-    print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
+    print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
 
     print '<table class="border" width="100%">';
 
     $project = new Project($db);
 
@@ -330,11 +331,11 @@ if ($action == 'create' && $user->rights->projet->creer)
 
     print '</table>';
 
     print '<br><center>';
     print '<input type="submit" class="button" value="'.$langs->trans("Create").'">';
-    if (GETPOST('backtopage'))
+    if (! empty($backtopage))
     {
         print ' &nbsp; &nbsp; ';
 	    print '<input type="submit" class="button" name="cancel" value="'.$langs->trans("Cancel").'">';
     }
     print '</center>';
diff --git a/htdocs/projet/tasks.php b/htdocs/projet/tasks.php
index c05bac91f4..6c4ccb733f 100644
--- a/htdocs/projet/tasks.php
+++ b/htdocs/projet/tasks.php
@@ -34,10 +34,11 @@ $langs->load("users");
 $langs->load("projects");
 
 $action = GETPOST('action', 'alpha');
 $id = GETPOST('id', 'int');
 $ref = GETPOST('ref', 'alpha');
+$backtopage=GETPOST('backtopage','alpha');
 
 $mode = GETPOST('mode', 'alpha');
 $mine = ($mode == 'mine' ? 1 : 0);
 //if (! $user->rights->projet->all->lire) $mine=1;	// Special for projects
 
@@ -109,13 +110,13 @@ if ($action == 'createtask' && $user->rights->projet->creer)
 			}
 		}
 
 		if (! $error)
 		{
-		    if (GETPOST('backtopage'))
+		    if (! empty($backtopage))
 			{
-				Header("Location: ".GETPOST('backtopage'));
+				Header("Location: ".$backtopage);
 				exit;
 			}
 			else if (empty($projectid))
 			{
 				Header("Location: ".DOL_URL_ROOT.'/projet/tasks/index.php'.(empty($mode)?'':'?mode='.$mode));
@@ -123,13 +124,13 @@ if ($action == 'createtask' && $user->rights->projet->creer)
 			}
 		}
 	}
 	else
 	{
-		if (GETPOST('backtopage'))
+		if (! empty($backtopage))
 		{
-			Header("Location: ".GETPOST('backtopage'));
+			Header("Location: ".$backtopage);
 			exit;
 		}
 	    else if (empty($id))
         {
             // We go back on task list
@@ -217,11 +218,11 @@ if ($action == 'create' && $user->rights->projet->creer && (empty($object->socie
 	dol_htmloutput_errors($mesg);
 
 	print '<form action="'.$_SERVER['PHP_SELF'].'" method="POST">';
 	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
 	print '<input type="hidden" name="action" value="createtask">';
-	print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
+	print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
 	if (! empty($object->id)) print '<input type="hidden" name="id" value="'.$object->id.'">';
 	if (! empty($mode)) print '<input type="hidden" name="mode" value="'.$mode.'">';
 
 	print '<table class="border" width="100%">';
 
diff --git a/htdocs/public/members/new.php b/htdocs/public/members/new.php
index fc7feedb0a..d1d63d0310 100644
--- a/htdocs/public/members/new.php
+++ b/htdocs/public/members/new.php
@@ -45,12 +45,12 @@ require_once(DOL_DOCUMENT_ROOT."/core/lib/company.lib.php");
 
 // Init vars
 $errmsg='';
 $num=0;
 $error=0;
-$backtopage=GETPOST('backtopage');
-$action=GETPOST('action');
+$backtopage=GETPOST('backtopage','alpha');
+$action=GETPOST('action','alpha');
 
 // Load translation files
 $langs->load("main");
 $langs->load("members");
 $langs->load("companies");
@@ -253,11 +253,11 @@ if ($action == 'add')
             if (! empty($conf->global->ADHERENT_AUTOREGISTER_MAIL) && ! empty($conf->global->ADHERENT_AUTOREGISTER_MAIL_SUBJECT))
             {
                 $result=$adh->send_an_email($conf->global->ADHERENT_AUTOREGISTER_MAIL,$conf->global->ADHERENT_AUTOREGISTER_MAIL_SUBJECT,array(),array(),array(),"","",0,-1);
             }
 
-            if ($backtopage) $urlback=$backtopage;
+            if (! empty($backtopage)) $urlback=$backtopage;
             else if ($conf->global->MEMBER_URL_REDIRECT_SUBSCRIPTION)
             {
                 $urlback=$conf->global->MEMBER_URL_REDIRECT_SUBSCRIPTION;
                 // TODO Make replacement of __AMOUNT__, etc...
             }
@@ -543,11 +543,11 @@ if (! empty($conf->global->MEMBER_NEWFORM_AMOUNT)
 print "</table>\n";
 
 // Save
 print '<br><center>';
 print '<input type="submit" value="'.$langs->trans("Save").'" id="submitsave" class="button">';
-if ($backtopage)
+if (! empty($backtopage))
 {
     print ' &nbsp; &nbsp; <input type="submit" value="'.$langs->trans("Cancel").'" id="submitcancel" class="button">';
 }
 print '</center>';
 

Vulnerable code:  * Copyright (C) 2005-2009 Regis Houssin         <regis@dolibarr.fr>
 * Copyright (C) 2005-2011 Regis Houssin        <regis@dolibarr.fr>
$action=GETPOST("action");
$socid = GETPOST('socid');
$id = GETPOST('id');
    $backtopage='';
    if (! empty($_POST["backtopage"])) $backtopage=$_POST["backtopage"];
    if (! $backtopage)
		if (! empty($_POST["from"]))  // deprecated. Use backtopage instead
		{
			header("Location: ".$_POST["from"]);
			exit;
		}
        if (! empty($_POST["backtopage"]))
            header("Location: ".$_POST["backtopage"]);
	if (GETPOST("backtopage")) print '<input type="hidden" name="backtopage" value="'.(GETPOST("backtopage") != 1 ? GETPOST("backtopage") : $_SERVER["HTTP_REFERER"]).'">';
		if (GETPOST("backtopage")) print '<input type="hidden" name="backtopage" value="'.(GETPOST("backtopage") ? GETPOST("backtopage") : $_SERVER["HTTP_REFERER"]).'">';
$socid = GETPOST("id");
if (GETPOST('cancel') && GETPOST('backtopage'))
     Header("Location: ".GETPOST("backtopage"));
	    if (GETPOST('backtopage'))
    		Header("Location: ".GETPOST('backtopage'));
    print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
    if (GETPOST("backtopage"))
$action=GETPOST('action');
if (GETPOST('cancel') && GETPOST('backtopage'))
     Header("Location: ".GETPOST("backtopage"));
			    if (GETPOST("backtopage"))
			        Header("Location: ".GETPOST("backtopage").'&discountid='.$discountid);
    print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
    if (GETPOST("backtopage"))
$action		= (GETPOST('action') ? GETPOST('action') : 'view');
$confirm	= GETPOST('confirm');
$id			= GETPOST("id");
$socid		= GETPOST("socid");
    if (GETPOST("cancel") && GETPOST('backtopage'))
        header("Location: ".GETPOST('backtopage'));
        $result = $object->fetch($_GET["id"]);
            if (GETPOST('backtopage')) $url=GETPOST('backtopage');
            print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
            if (GETPOST('backtopage'))
            print '<form method="post" action="'.$_SERVER["PHP_SELF"].'?id='.GETPOST("id").'" name="formsoc">';
            print '<input type="hidden" name="id" value="'.GETPOST("id").'">';
            print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
		if ($check == 'alpha' && preg_match('/"/',trim($out))) $out='';
 * Copyright (C) 2005-2011 Regis Houssin        <regis@dolibarr.fr>
$action = GETPOST("action");
$original_file = GETPOST("file");	// Do not use urldecode here ($_GET are already decoded by PHP).
$modulepart = GETPOST("modulepart");
$urlsource = GETPOST("urlsource");
if (GETPOST('type')) $type=GETPOST('type');
$ref = GETPOST('ref');
$action=GETPOST('action');
if (GETPOST("cancel") && GETPOST('backtopage'))
    header("Location: ".GETPOST('backtopage'));
    print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
    if (GETPOST('backtopage'))
		    if (GETPOST('backtopage'))
				Header("Location: ".GETPOST('backtopage'));
		if (GETPOST('backtopage'))
			Header("Location: ".GETPOST('backtopage'));
	print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
$backtopage=GETPOST('backtopage');
$action=GETPOST('action');
            if ($backtopage) $urlback=$backtopage;
if ($backtopage)
Fixed code:  * Copyright (C) 2005-2012 Regis Houssin         <regis@dolibarr.fr>
 * Copyright (C) 2005-2012 Regis Houssin        <regis@dolibarr.fr>
$action=GETPOST('action','alpha');
$backtopage=GETPOST('backtopage','alpha');
$socid = GETPOST('socid','int');
$id = GETPOST('id','int');
    if (empty($backtopage))
        if (! empty($backtopage))
            header("Location: ".$backtopage);
	print '<input type="hidden" name="backtopage" value="'.(! empty($backtopage) ? $backtopage : $_SERVER["HTTP_REFERER"]).'">';
		print '<input type="hidden" name="backtopage" value="'.(! empty($backtopage) ? $backtopage : $_SERVER["HTTP_REFERER"]).'">';
$socid = GETPOST('id','int');
$backtopage = GETPOST('backtopage','alpha');

if (GETPOST('cancel') && ! empty($backtopage))
     Header("Location: ".$backtopage);
	    if (! empty($backtopage))
    		Header("Location: ".$backtopage);
    print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
    if (! empty($backtopage))
$action=GETPOST('action','alpha');
$backtopage=GETPOST('backtopage','alpha');
if (GETPOST('cancel') && ! empty($backtopage))
     Header("Location: ".$backtopage);
			    if (! empty($backtopage))
			        Header("Location: ".$backtopage.'&discountid='.$discountid);
    print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
    if (! empty($backtopage))
$action		= (GETPOST('action','alpha') ? GETPOST('action','alpha') : 'view');
$confirm	= GETPOST('confirm','alpha');
$backtopage = GETPOST('backtopage','alpha');
$id			= GETPOST('id','int');
$socid		= GETPOST('socid','int');
    if (GETPOST("cancel") && ! empty($backtopage))
        header("Location: ".$backtopage);
        $result = $object->fetch($id);
            if (! empty($backtopage)) $url=$backtopage;
            print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
            if (! empty($backtopage))
            print '<form method="post" action="'.$_SERVER["PHP_SELF"].'?id='.$id.'" name="formsoc">';
            print '<input type="hidden" name="id" value="'.$id.'">';
            print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
		if ($check == 'alpha')
		{
			if (preg_match('/"/',trim($out))) $out='';
			else if (preg_match('/(\.\.\/)+/',trim($out))) $out='';
		}
 * Copyright (C) 2005-2012 Regis Houssin        <regis@dolibarr.fr>
$action = GETPOST('action','alpha');
$original_file = GETPOST('file','alpha');	// Do not use urldecode here ($_GET are already decoded by PHP).
$modulepart = GETPOST('modulepart','alpha');
$urlsource = GETPOST('urlsource','alpha');
if (GETPOST('type','alpha')) $type=GETPOST('type','alpha');
$ref = GETPOST('ref','alpha');
$action=GETPOST('action','alpha');
$backtopage=GETPOST('backtopage','alpha');
if (GETPOST("cancel") && ! empty($backtopage))
    header("Location: ".$backtopage);
    print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
    if (! empty($backtopage))
$backtopage=GETPOST('backtopage','alpha');
		    if (! empty($backtopage))
				Header("Location: ".$backtopage);
		if (! empty($backtopage))
			Header("Location: ".$backtopage);
	print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
$backtopage=GETPOST('backtopage','alpha');
$action=GETPOST('action','alpha');
            if (! empty($backtopage)) $urlback=$backtopage;
if (! empty($backtopage))