CVE-2013-2093: Improper Input Validation (CWE-20)
value: Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2019-11-20T21:15Z
Repository: https://github.com/Dolibarr/dolibarr
Language: PHP
Files changed: htdocs/core/lib/barcode.lib.php
Commit date: 2013-05-11 15:04:17 +0200
Commit message: Sec: Param not escaped
Fix: Bad return error
Diff: diff --git a/htdocs/core/lib/barcode.lib.php b/htdocs/core/lib/barcode.lib.php
index f83ea5f433c..67b51748d3e 100644
--- a/htdocs/core/lib/barcode.lib.php
+++ b/htdocs/core/lib/barcode.lib.php
@@ -72,15 +72,15 @@ function barcode_print($code, $encoding="ANY", $scale = 2 ,$mode = "png")
 {
     // DOLCHANGE LDR Add log
     dol_syslog("barcode.lib.php::barcode_print $code $encoding $scale $mode");
 
     $bars=barcode_encode($code,$encoding);
-
-    if (! $bars)
+    if (! $bars || ! empty($bars['error']))
     {
         // DOLCHANGE LDR Return error message instead of array
-        $error='Bad Value '.$code.' for encoding '.$encoding;
+        if (empty($bars['error'])) $error='Bad Value '.$code.' for encoding '.$encoding;
+        else $error=$bars['error'];
         dol_syslog('barcode.lib.php::barcode_print '.$error, LOG_ERR);
         return $error;
     }
     if (! $mode) $mode="png";
     //if (preg_match("/^(text|txt|plain)$/i",$mode)) print barcode_outtext($bars['text'],$bars['bars']);
@@ -131,11 +131,11 @@ function barcode_encode($code,$encoding)
     {
         /* use built-in EAN-Encoder */
         dol_syslog("barcode.lib.php::barcode_encode Use barcode_encode_ean");
         $bars=barcode_encode_ean($code, $encoding);
     }
-    else if (file_exists($genbarcode_loc))
+    else if (file_exists($genbarcode_loc))	// For example C39
     {
         /* use genbarcode */
         dol_syslog("barcode.lib.php::barcode_encode Use genbarcode ".$genbarcode_loc." code=".$code." encoding=".$encoding);
         $bars=barcode_encode_genbarcode($code, $encoding);
     }
@@ -250,14 +250,15 @@ function barcode_encode_genbarcode($code,$encoding)
     if (!$encoding) $encoding="ANY";
     $encoding=preg_replace("/[\\\|]/", "_", $encoding);
     $code=preg_replace("/[\\\|]/", "_", $code);
 
     $command=escapeshellarg($genbarcode_loc);
-    $paramclear=" \"".str_replace("\"", "\\\"",$code)."\" \"".str_replace("\"", "\\\"",strtoupper($encoding))."\"";
-
+    //$paramclear=" \"".str_replace("\"", "\\\"",$code)."\" \"".str_replace("\"", "\\\"",strtoupper($encoding))."\"";
+    $paramclear=" ".escapeshellarg($code)." ".escapeshellarg(strtoupper($encoding));
+    
     $fullcommandclear=$command." ".$paramclear." 2>&1";
-    //print $fullcommandclear."<br>\n";
+    //print $fullcommandclear."<br>\n";exit;
 
     dol_syslog("Run command ".$fullcommandclear);
     $fp=popen($fullcommandclear, "r");
     if ($fp)
     {
@@ -271,18 +272,24 @@ function barcode_encode_genbarcode($code,$encoding)
         dol_syslog("barcode.lib.php::barcode_encode_genbarcode failed to run popen ".$fullcommandclear, LOG_ERR);
         return false;
     }
     //var_dump($bars);
     $ret=array(
-		"encoding" => trim($encoding),
 		"bars" => trim($bars),
-		"text" => trim($text)
+		"text" => trim($text),
+		"encoding" => trim($encoding),
+    	"error" => ""
     );
     //var_dump($ret);
-    if (!$ret['encoding']) return false;
+    if (preg_match('/permission denied/i',$ret['bars'])) 
+    { 
+    	$ret['error']=$ret['bars']; $ret['bars']='';
+    	return $ret;
+    }
     if (!$ret['bars']) return false;
     if (!$ret['text']) return false;
+    if (!$ret['encoding']) return false;
     return $ret;
 }
 
 /**
  * Output image onto standard output, or onto disk if global filebarcode is defined

Vulnerable code: 
    if (! $bars)
        $error='Bad Value '.$code.' for encoding '.$encoding;
    else if (file_exists($genbarcode_loc))
    $paramclear=" \"".str_replace("\"", "\\\"",$code)."\" \"".str_replace("\"", "\\\"",strtoupper($encoding))."\"";

    //print $fullcommandclear."<br>\n";
		"encoding" => trim($encoding),
		"text" => trim($text)
    if (!$ret['encoding']) return false;
Fixed code:     if (! $bars || ! empty($bars['error']))
        if (empty($bars['error'])) $error='Bad Value '.$code.' for encoding '.$encoding;
        else $error=$bars['error'];
    else if (file_exists($genbarcode_loc))	// For example C39
    //$paramclear=" \"".str_replace("\"", "\\\"",$code)."\" \"".str_replace("\"", "\\\"",strtoupper($encoding))."\"";
    $paramclear=" ".escapeshellarg($code)." ".escapeshellarg(strtoupper($encoding));
    
    //print $fullcommandclear."<br>\n";exit;
		"text" => trim($text),
		"encoding" => trim($encoding),
    	"error" => ""
    if (preg_match('/permission denied/i',$ret['bars'])) 
    { 
    	$ret['error']=$ret['bars']; $ret['bars']='';
    	return $ret;
    }
    if (!$ret['encoding']) return false;