CVE-2022-0414 (PHP, published 2022-01-31T11:15Z)
Description: value: Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-1284 \u2014 Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Repository: https://github.com/dolibarr/dolibarr
Files changed:
htdocs/product/card.php
htdocs/product/class/product.class.php
Commit message: Fix #huntr76f3b405-9f5d-44b1-8434-b52b56ee395f

Vulnerable code:
					print '<input name="weight" size="5" value="'.$object->weight.'"> ';
					print $formproduct->selectMeasuringUnits("weight_units", "weight", $object->weight_units, 0, 2);
					print '<input name="size" size="5" value="'.$object->length.'">x';
					print '<input name="sizewidth" size="5" value="'.$object->width.'">x';
					print '<input name="sizeheight" size="5" value="'.$object->height.'"> ';
					print $formproduct->selectMeasuringUnits("size_units", "size", $object->length_units, 0, 2);
					print '<input name="surface" size="5" value="'.$object->surface.'"> ';
					print $formproduct->selectMeasuringUnits("surface_units", "surface", $object->surface_units, 0, 2);
					print '<input name="volume" size="5" value="'.$object->volume.'"> ';
					print $formproduct->selectMeasuringUnits("volume_units", "volume", $object->volume_units, 0, 2);
					print '<input name="net_measure" size="5" value="'.$object->net_measure.'"> ';
					print $formproduct->selectMeasuringUnits("net_measure_units", "", $object->net_measure_units, 0, 0);

Fixed code:
					print '<input name="weight" size="5" value="'.(GETPOSTISSET('weight') ? GETPOST('weight') : $object->weight).'"> ';
					print $formproduct->selectMeasuringUnits("weight_units", "weight", GETPOSTISSET('weight_units') ? GETPOST('weight_units') : $object->weight_units, 0, 2);
					print '<input name="size" size="5" value="'.(GETPOSTISSET('size') ? GETPOST('size') : $object->length).'">x';
					print '<input name="sizewidth" size="5" value="'.(GETPOSTISSET('sizewidth') ? GETPOST('sizewidth') : $object->width).'">x';
					print '<input name="sizeheight" size="5" value="'.(GETPOSTISSET('sizeheight') ? GETPOST('sizeheight') : $object->height).'"> ';
					print $formproduct->selectMeasuringUnits("size_units", "size", GETPOSTISSET('size_units') ? GETPOST('size_units') : $object->length_units, 0, 2);
					print '<input name="surface" size="5" value="'.(GETPOSTISSET('surface') ? GETPOST('surface') : $object->surface).'"> ';
					print $formproduct->selectMeasuringUnits("surface_units", "surface", GETPOSTISSET('surface_units') ? GETPOST('surface_units') : $object->surface_units, 0, 2);
					print '<input name="volume" size="5" value="'.(GETPOSTISSET('volume') ? GETPOST('volume') : $object->volume).'"> ';
					print $formproduct->selectMeasuringUnits("volume_units", "volume", GETPOSTISSET('volume_units') ? GETPOST('volume_units') : $object->volume_units, 0, 2);
					print '<input name="net_measure" size="5" value="'.(GETPOSTISSET('net_measure') ? GETPOST('net_measure') : $object->net_measure).'"> ';
					print $formproduct->selectMeasuringUnits("net_measure_units", "", GETPOSTISSET('net_measure_units') ? GETPOST('net_measure_units') : $object->net_measure_units, 0, 0);
		global $langs;

		$arrayofnonnegativevalue = array('weight'=>'Weight', 'width'=>'Width', 'height'=>'Height', 'length'=>'Length', 'surface'=>'Surface', 'volume'=>'Volume');
		foreach ($arrayofnonnegativevalue as $key => $value) {
			if (property_exists($this, $key) && $this->$key < 0) {
				$langs->load("other");
				$this->errors[] = $langs->trans("FieldCannotBeNegative", $langs->transnoentitiesnoconv($value));
				$result = -4;
			}
		}