CVE-2017-17898 (PHP, published 2017-12-27T17:08Z)
Description: value: Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, which allows remote attackers to obtain sensitive information.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/accountancy/tpl/export_journal.tpl.php
htdocs/adherents/canvas/default/tpl/adherentcard_create.tpl.php
htdocs/adherents/canvas/default/tpl/adherentcard_edit.tpl.php
htdocs/adherents/canvas/default/tpl/adherentcard_view.tpl.php
htdocs/adherents/tpl/linkedobjectblock.tpl.php
htdocs/comm/propal/tpl/linkedobjectblock.tpl.php
htdocs/commande/tpl/linkedobjectblock.tpl.php
htdocs/compta/facture/card.php
htdocs/compta/facture/tpl/linkedobjectblock.tpl.php
htdocs/compta/facture/tpl/linkedobjectblockForRec.tpl.php
htdocs/contact/canvas/default/tpl/contactcard_create.tpl.php
htdocs/contact/canvas/default/tpl/contactcard_edit.tpl.php
htdocs/contact/canvas/default/tpl/contactcard_view.tpl.php
htdocs/contrat/tpl/linkedobjectblock.tpl.php
htdocs/core/tpl/admin_extrafields_add.tpl.php
htdocs/core/tpl/admin_extrafields_edit.tpl.php
htdocs/core/tpl/admin_extrafields_view.tpl.php
htdocs/core/tpl/ajax/fileupload_main.tpl.php
htdocs/core/tpl/ajax/fileupload_view.tpl.php
htdocs/core/tpl/ajaxrow.tpl.php
htdocs/core/tpl/bloc_showhide.tpl.php
htdocs/core/tpl/contacts.tpl.php
htdocs/core/tpl/document_actions_post_headers.tpl.php
htdocs/core/tpl/extrafields_view.tpl.php
htdocs/core/tpl/login.tpl.php
htdocs/core/tpl/notes.tpl.php
htdocs/core/tpl/objectline_create.tpl.php
htdocs/core/tpl/objectline_edit.tpl.php
htdocs/core/tpl/objectline_view.tpl.php
htdocs/core/tpl/originproductline.tpl.php
htdocs/core/tpl/passwordforgotten.tpl.php
htdocs/core/tpl/resource_add.tpl.php
htdocs/core/tpl/resource_view.tpl.php
htdocs/ecm/tpl/enablefiletreeajax.tpl.php
htdocs/expedition/tpl/linkedobjectblock.tpl.php
htdocs/expensereport/tpl/linkedobjectblock.tpl.php
htdocs/fichinter/tpl/linkedobjectblock.tpl.php
htdocs/fourn/commande/tpl/linkedobjectblock.tpl.php
htdocs/fourn/facture/tpl/linkedobjectblock.tpl.php
htdocs/main.inc.php
htdocs/modulebuilder/template/core/tpl/mytemplate.tpl.php
htdocs/product/canvas/product/tpl/card_create.tpl.php
htdocs/product/canvas/product/tpl/card_edit.tpl.php
htdocs/product/canvas/product/tpl/card_view.tpl.php
htdocs/product/canvas/product/tpl/list.tpl.php
htdocs/product/canvas/service/tpl/card_create.tpl.php
htdocs/product/canvas/service/tpl/card_edit.tpl.php
htdocs/product/canvas/service/tpl/card_view.tpl.php
htdocs/product/canvas/service/tpl/list.tpl.php
htdocs/product/inventory/tpl/inventory.tpl.php
htdocs/product/stock/tpl/stockcorrection.tpl.php
htdocs/product/stock/tpl/stocktransfer.tpl.php
htdocs/societe/canvas/company/tpl/card_create.tpl.php
htdocs/societe/canvas/company/tpl/card_edit.tpl.php
htdocs/societe/canvas/company/tpl/card_view.tpl.php
htdocs/societe/canvas/individual/tpl/card_create.tpl.php
htdocs/societe/canvas/individual/tpl/card_edit.tpl.php
htdocs/societe/canvas/individual/tpl/card_view.tpl.php
htdocs/societe/tpl/linesalesrepresentative.tpl.php
htdocs/supplier_proposal/tpl/linkedobjectblock.tpl.php
Commit message: FIX security vulnerability reported by ADLab of Venustech

Vulnerable code:
 *
 *
 *
 *
	
    
    <?php  
 *
    
    <?php  
				
 *
    
    			else 
    <?php  
 *
    
 *
 *
 *
    
    		if (type == '' || type == 'varchar' || type == 'int' || type == 'double' || type == 'price') { 
    			jQuery("tr.extra_computed_value").show(); 
    		} 
    		
			else if (type == 'separate') { 
				size.val('').prop('disabled', true); unique.removeAttr('checked').prop('disabled', true); required.val('').prop('disabled', true); 
				jQuery('#size, #default_value').val('').prop('disabled', true); 
				required.removeAttr('disabled'); alwayseditable.removeAttr('disabled'); list.val('').removeAttr('disabled'); 
    		if (type == 'varchar' || type == 'int' || type == 'double' || type == 'price') { 
    			jQuery("tr.extra_computed_value").show(); 
    		} 
    		
				unique.removeAttr('disabled');		
				required.removeAttr('checked').prop('disabled', true); alwayseditable.removeAttr('checked').prop('disabled', true); list.val('').prop('disabled', true); 
				jQuery('#size, #default_value').val('').prop('disabled', true); 
				required.removeAttr('disabled'); alwayseditable.removeAttr('disabled'); list.val('').removeAttr('disabled'); 
			}			
    	});    	
        
    
 *
 *
		} 
		} 
		} 
 *
//var_dump($linked_resources);
		
		
		
 *
    
    <?php  
 *
	
 *
    
 *
    
    <?php  
    
    			else 
<?php 
    <?php  
    	$inj += preg_match('/updatexml^(/i',	 $val);
 *
	<?php } else if ($key == $num) { 
 *
 *
	<?php } else if ($key == $num) { 	
        
        
        
            
            
            
        
        
    
    	
        
        
            
             
        
    
       
           
           
        
	
		
	
	
	
		
		_headerList($view); 
        
        
        foreach ($lines as $k=>$row) { 
            
            
	                 }   
	                    
                    <input type="hidden" name="det_id_<?php echo $row['k']; ?>" value="<?php echo $row['id']; ?>" /> 
                    	echo '<td align="right">'.$row['pmp_new'].'</td>';	
		                 }   
		                    
			<?php $i++; 
        
        } 
		
	
	
				<?php 
				
				
	
	
 *
 *
 *
 *
 *
 *
        // Sale representative
    
    <?php  

Fixed code:

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}




// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


    <?php

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


    <?php


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


    			else
    <?php

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

    		if (type == '' || type == 'varchar' || type == 'int' || type == 'double' || type == 'price') {
    			jQuery("tr.extra_computed_value").show();
    		}

			else if (type == 'separate') {
				size.val('').prop('disabled', true); unique.removeAttr('checked').prop('disabled', true); required.val('').prop('disabled', true);
				jQuery('#size, #default_value').val('').prop('disabled', true);
				required.removeAttr('disabled'); alwayseditable.removeAttr('disabled'); list.val('').removeAttr('disabled');
// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

    		if (type == 'varchar' || type == 'int' || type == 'double' || type == 'price') {
    			jQuery("tr.extra_computed_value").show();
    		}

				unique.removeAttr('disabled');
				required.removeAttr('checked').prop('disabled', true); alwayseditable.removeAttr('checked').prop('disabled', true); list.val('').prop('disabled', true);
				jQuery('#size, #default_value').val('').prop('disabled', true);
				required.removeAttr('disabled'); alwayseditable.removeAttr('disabled'); list.val('').removeAttr('disabled');
			}
    	});

// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}




// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($object) || ! is_object($object))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($blocname))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($object) || ! is_object($object))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($object) || ! is_object($object))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($object) || ! is_object($object))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($object) || ! is_object($object))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($object) || ! is_object($object))
{
	print "Error, template page can't be called as URL";
	exit;
}

		}
		}
		}
// Protection to avoid direct call of template
if (empty($object) || ! is_object($object))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}





// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


    <?php

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


    <?php

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


    			else
<?php
    <?php
    	$inj += preg_match('/updatexml\(/i',	 $val);
// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

	<?php } else if ($key == $num) {
// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

	<?php } else if ($key == $num) {
<?php

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

?>


























		_headerList($view);


        foreach ($lines as $k=>$row) {


	                 }

                    <input type="hidden" name="det_id_<?php echo $row['k']; ?>" value="<?php echo $row['id']; ?>" />
                    	echo '<td align="right">'.$row['pmp_new'].'</td>';
		                 }

			<?php $i++;

        }



				<?php





// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}

		// Sale representative
// Protection to avoid direct call of template
if (empty($conf) || ! is_object($conf))
{
	print "Error, template page can't be called as URL";
	exit;
}


    <?php