CVE-2012-1226 (PHP, published 2012-02-21T13:31Z)
Description: value: Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the (1) file parameter to document.php or (2) backtopage parameter in a create action to comm/action/fiche.php.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/comm/action/document.php
htdocs/comm/action/fiche.php
htdocs/comm/remise.php
htdocs/comm/remx.php
htdocs/contact/fiche.php
htdocs/core/lib/functions.lib.php
htdocs/document.php
htdocs/projet/fiche.php
htdocs/projet/tasks.php
htdocs/public/members/new.php
Commit message: Fix: Multiple directory traversal vulnerabilities with document.php


Vulnerable code:
 * Copyright (C) 2005-2009 Regis Houssin         <regis@dolibarr.fr>
 * Copyright (C) 2005-2011 Regis Houssin        <regis@dolibarr.fr>
$action=GETPOST("action");
$socid = GETPOST('socid');
$id = GETPOST('id');
    $backtopage='';
    if (! empty($_POST["backtopage"])) $backtopage=$_POST["backtopage"];
    if (! $backtopage)
		if (! empty($_POST["from"]))  // deprecated. Use backtopage instead
		{
			header("Location: ".$_POST["from"]);
			exit;
		}
        if (! empty($_POST["backtopage"]))
            header("Location: ".$_POST["backtopage"]);
	if (GETPOST("backtopage")) print '<input type="hidden" name="backtopage" value="'.(GETPOST("backtopage") != 1 ? GETPOST("backtopage") : $_SERVER["HTTP_REFERER"]).'">';
		if (GETPOST("backtopage")) print '<input type="hidden" name="backtopage" value="'.(GETPOST("backtopage") ? GETPOST("backtopage") : $_SERVER["HTTP_REFERER"]).'">';
$socid = GETPOST("id");
if (GETPOST('cancel') && GETPOST('backtopage'))
     Header("Location: ".GETPOST("backtopage"));
	    if (GETPOST('backtopage'))
    		Header("Location: ".GETPOST('backtopage'));
    print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
    if (GETPOST("backtopage"))
$action=GETPOST('action');
if (GETPOST('cancel') && GETPOST('backtopage'))
     Header("Location: ".GETPOST("backtopage"));
			    if (GETPOST("backtopage"))
			        Header("Location: ".GETPOST("backtopage").'&discountid='.$discountid);
    print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
    if (GETPOST("backtopage"))
$action		= (GETPOST('action') ? GETPOST('action') : 'view');
$confirm	= GETPOST('confirm');
$id			= GETPOST("id");
$socid		= GETPOST("socid");
    if (GETPOST("cancel") && GETPOST('backtopage'))
        header("Location: ".GETPOST('backtopage'));
        $result = $object->fetch($_GET["id"]);
            if (GETPOST('backtopage')) $url=GETPOST('backtopage');
            print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
            if (GETPOST('backtopage'))
            print '<form method="post" action="'.$_SERVER["PHP_SELF"].'?id='.GETPOST("id").'" name="formsoc">';
            print '<input type="hidden" name="id" value="'.GETPOST("id").'">';
            print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
		if ($check == 'alpha' && preg_match('/"/',trim($out))) $out='';
 * Copyright (C) 2005-2011 Regis Houssin        <regis@dolibarr.fr>
$action = GETPOST("action");
$original_file = GETPOST("file");	// Do not use urldecode here ($_GET are already decoded by PHP).
$modulepart = GETPOST("modulepart");
$urlsource = GETPOST("urlsource");
if (GETPOST('type')) $type=GETPOST('type');
$ref = GETPOST('ref');
$action=GETPOST('action');
if (GETPOST("cancel") && GETPOST('backtopage'))
    header("Location: ".GETPOST('backtopage'));
    print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
    if (GETPOST('backtopage'))
		    if (GETPOST('backtopage'))
				Header("Location: ".GETPOST('backtopage'));
		if (GETPOST('backtopage'))
			Header("Location: ".GETPOST('backtopage'));
	print '<input type="hidden" name="backtopage" value="'.GETPOST('backtopage').'">';
$backtopage=GETPOST('backtopage');
$action=GETPOST('action');
            if ($backtopage) $urlback=$backtopage;
if ($backtopage)

Fixed code:
 * Copyright (C) 2005-2012 Regis Houssin         <regis@dolibarr.fr>
 * Copyright (C) 2005-2012 Regis Houssin        <regis@dolibarr.fr>
$action=GETPOST('action','alpha');
$backtopage=GETPOST('backtopage','alpha');
$socid = GETPOST('socid','int');
$id = GETPOST('id','int');
    if (empty($backtopage))
        if (! empty($backtopage))
            header("Location: ".$backtopage);
	print '<input type="hidden" name="backtopage" value="'.(! empty($backtopage) ? $backtopage : $_SERVER["HTTP_REFERER"]).'">';
		print '<input type="hidden" name="backtopage" value="'.(! empty($backtopage) ? $backtopage : $_SERVER["HTTP_REFERER"]).'">';
$socid = GETPOST('id','int');
$backtopage = GETPOST('backtopage','alpha');

if (GETPOST('cancel') && ! empty($backtopage))
     Header("Location: ".$backtopage);
	    if (! empty($backtopage))
    		Header("Location: ".$backtopage);
    print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
    if (! empty($backtopage))
$action=GETPOST('action','alpha');
$backtopage=GETPOST('backtopage','alpha');
if (GETPOST('cancel') && ! empty($backtopage))
     Header("Location: ".$backtopage);
			    if (! empty($backtopage))
			        Header("Location: ".$backtopage.'&discountid='.$discountid);
    print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
    if (! empty($backtopage))
$action		= (GETPOST('action','alpha') ? GETPOST('action','alpha') : 'view');
$confirm	= GETPOST('confirm','alpha');
$backtopage = GETPOST('backtopage','alpha');
$id			= GETPOST('id','int');
$socid		= GETPOST('socid','int');
    if (GETPOST("cancel") && ! empty($backtopage))
        header("Location: ".$backtopage);
        $result = $object->fetch($id);
            if (! empty($backtopage)) $url=$backtopage;
            print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
            if (! empty($backtopage))
            print '<form method="post" action="'.$_SERVER["PHP_SELF"].'?id='.$id.'" name="formsoc">';
            print '<input type="hidden" name="id" value="'.$id.'">';
            print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
		if ($check == 'alpha')
		{
			if (preg_match('/"/',trim($out))) $out='';
			else if (preg_match('/(\.\.\/)+/',trim($out))) $out='';
		}
 * Copyright (C) 2005-2012 Regis Houssin        <regis@dolibarr.fr>
$action = GETPOST('action','alpha');
$original_file = GETPOST('file','alpha');	// Do not use urldecode here ($_GET are already decoded by PHP).
$modulepart = GETPOST('modulepart','alpha');
$urlsource = GETPOST('urlsource','alpha');
if (GETPOST('type','alpha')) $type=GETPOST('type','alpha');
$ref = GETPOST('ref','alpha');
$action=GETPOST('action','alpha');
$backtopage=GETPOST('backtopage','alpha');
if (GETPOST("cancel") && ! empty($backtopage))
    header("Location: ".$backtopage);
    print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
    if (! empty($backtopage))
$backtopage=GETPOST('backtopage','alpha');
		    if (! empty($backtopage))
				Header("Location: ".$backtopage);
		if (! empty($backtopage))
			Header("Location: ".$backtopage);
	print '<input type="hidden" name="backtopage" value="'.$backtopage.'">';
$backtopage=GETPOST('backtopage','alpha');
$action=GETPOST('action','alpha');
            if (! empty($backtopage)) $urlback=$backtopage;
if (! empty($backtopage))