rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.
Vulnerability ID: CVE-2018-1000528
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/gosa-project/gosa-core
Published: 2018-06-26
File: html/password.php
Commit message: (see #14)
escape html entities for uid to avoid code execution
Commit author: bzapiec

Vulnerable version (before fix):
 function displayPWchanger()  /* Fill template with required values */ $smarty->assign('date', gmdate("D, d M Y H:i:s")); $smarty->assign('uid', $uid); $smarty->assign('password_img', get_template_path('images/password.png'));  /* Displasy SSL mode warning? */

Fixed version (after fix):
 function displayPWchanger()  /* Fill template with required values */ $smarty->assign('date', gmdate("D, d M Y H:i:s")); $smarty->assign('uid', set_post($uid)); $smarty->assign('password_img', get_template_path('images/password.png'));  /* Displasy SSL mode warning? */

Patch:
patch: @@ -305,7 +305,7 @@ function displayPWchanger()
 
 /* Fill template with required values */
 $smarty->assign('date', gmdate("D, d M Y H:i:s"));
-$smarty->assign('uid', $uid);
+$smarty->assign('uid', set_post($uid));
 $smarty->assign('password_img', get_template_path('images/password.png'));
 
 /* Displasy SSL mode warning? */
path: html/password.php
Vulnerability: LimeSurvey version 3.14.4 and earlier contains a directory traversal in file upload that allows upload of webshell vulnerability in file upload functionality that can result in remote code execution as authenticated user. This attack appear to be exploitable via An authenticated user can upload a specially crafted zip file to get remote code execution. This vulnerability appears to have been fixed in after commit 72a02ebaaf95a80e26127ee7ee2b123cccce05a7 / version 3.14.4.
Vulnerability ID: CVE-2018-1000659
CWE: CWE-22
Severity score: 6.4
Project: https://github.com/LimeSurvey/LimeSurvey
Published: 2018-09-06
File: application/third_party/pclzip/pclzip.lib.php
Commit message: [security] fixed issue #13959: RCE via resource file upload as authenticated user
Commit author: LouisGac

Vulnerable version (before fix):
 function privExtractFile(&$p_entry, $p_path, $p_remove_path, $p_remove_all_path,       }     }      // ----- Add the path     if ($p_path != '') {       $p_entry['filename'] = $p_path."/".$p_entry['filename'];

Fixed version (after fix):
 function privExtractFile(&$p_entry, $p_path, $p_remove_path, $p_remove_all_path,       }     }      // Added by LS Team to check for invalid paths     $p_entry['filename'] = get_absolute_path($p_entry['filename']);          // ----- Add the path     if ($p_path != '') {       $p_entry['filename'] = $p_path."/".$p_entry['filename'];

Patch:
patch: @@ -3669,6 +3669,9 @@ function privExtractFile(&$p_entry, $p_path, $p_remove_path, $p_remove_all_path,
       }
     }
 
+    // Added by LS Team to check for invalid paths
+    $p_entry['filename'] = get_absolute_path($p_entry['filename']);    
+
     // ----- Add the path
     if ($p_path != '') {
       $p_entry['filename'] = $p_path."/".$p_entry['filename'];
path: application/third_party/pclzip/pclzip.lib.php
Vulnerability: Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function ContentSettingsObserver::AllowScript() in content_settings_observer.cc that can result in Websites can run inline JavaScript even if script is blocked, making attackers easier to track users. This attack appear to be exploitable via the victim must visit a specially crafted website. This vulnerability appears to have been fixed in 0.25.2.
Vulnerability ID: CVE-2018-1000815
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/brave/muon
Published: 2018-12-20
File: chromium_src/chrome/renderer/content_settings_observer.cc
Commit message: Issue: 15232 AllowScript should use atom::ContentSettingsManager like other Allow* methods in the observer
Commit author: Pranjal

Vulnerable version (before fix):
 bool ContentSettingsObserver::AllowScript(bool enabled_per_settings) {   // IsWhitelistedForContentSettings(); if there is only the default rule   // allowing all scripts, it's quicker this way.   bool allow = true;   if (content_setting_rules_) {     ContentSetting setting = GetContentSettingFromRules(         content_setting_rules_->script_rules, frame,         url::Origin(frame->GetDocument().GetSecurityOrigin()).GetURL());     allow = setting != CONTENT_SETTING_BLOCK;   }   allow = allow || IsWhitelistedForContentSettings(); 

Fixed version (after fix):
 bool ContentSettingsObserver::AllowScript(bool enabled_per_settings) {   // IsWhitelistedForContentSettings(); if there is only the default rule   // allowing all scripts, it's quicker this way.   bool allow = true;   if (content_settings_manager_->content_settings()) {     allow =         content_settings_manager_->GetSetting(           ContentSettingsManager::GetOriginOrURL(render_frame()->GetWebFrame()),           url::Origin(frame->GetDocument().GetSecurityOrigin()).GetURL(),           "javascript",           allow) != CONTENT_SETTING_BLOCK;   }   allow = allow || IsWhitelistedForContentSettings(); 

Patch:
patch: @@ -432,11 +432,13 @@ bool ContentSettingsObserver::AllowScript(bool enabled_per_settings) {
   // IsWhitelistedForContentSettings(); if there is only the default rule
   // allowing all scripts, it's quicker this way.
   bool allow = true;
-  if (content_setting_rules_) {
-    ContentSetting setting = GetContentSettingFromRules(
-        content_setting_rules_->script_rules, frame,
-        url::Origin(frame->GetDocument().GetSecurityOrigin()).GetURL());
-    allow = setting != CONTENT_SETTING_BLOCK;
+  if (content_settings_manager_->content_settings()) {
+    allow =
+        content_settings_manager_->GetSetting(
+          ContentSettingsManager::GetOriginOrURL(render_frame()->GetWebFrame()),
+          url::Origin(frame->GetDocument().GetSecurityOrigin()).GetURL(),
+          "javascript",
+          allow) != CONTENT_SETTING_BLOCK;
   }
   allow = allow || IsWhitelistedForContentSettings();
path: chromium_src/chrome/renderer/content_settings_observer.cc
Vulnerability: libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar->lzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.
Vulnerability ID: CVE-2018-1000877
CWE: CWE-415
Severity score: 6.4
Project: https://github.com/libarchive/libarchive
Published: 2018-12-20
File: libarchive/archive_read_support_format_rar.c
Commit message: Avoid a double-free when a window size of 0 is specified

new_size can be 0 with a malicious or corrupted RAR archive.

realloc(area, 0) is equivalent to free(area), so the region would
be free()d here and the free()d again in the cleanup function.

Found with a setup running AFL, afl-rb, and qsym.
Commit author: Daniel Axtens

Vulnerable version (before fix):
 parse_codes(struct archive_read *a)       new_size = DICTIONARY_MAX_SIZE;     else       new_size = rar_fls((unsigned int)rar->unp_size) << 1;     new_window = realloc(rar->lzss.window, new_size);     if (new_window == NULL) {       archive_set_error(&a->archive, ENOMEM,

Fixed version (after fix):
 parse_codes(struct archive_read *a)       new_size = DICTIONARY_MAX_SIZE;     else       new_size = rar_fls((unsigned int)rar->unp_size) << 1;     if (new_size == 0) {       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,                         "Zero window size is invalid.");       return (ARCHIVE_FATAL);     }     new_window = realloc(rar->lzss.window, new_size);     if (new_window == NULL) {       archive_set_error(&a->archive, ENOMEM,

Patch:
patch: @@ -2300,6 +2300,11 @@ parse_codes(struct archive_read *a)
       new_size = DICTIONARY_MAX_SIZE;
     else
       new_size = rar_fls((unsigned int)rar->unp_size) << 1;
+    if (new_size == 0) {
+      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+                        "Zero window size is invalid.");
+      return (ARCHIVE_FATAL);
+    }
     new_window = realloc(rar->lzss.window, new_size);
     if (new_window == NULL) {
       archive_set_error(&a->archive, ENOMEM,
path: libarchive/archive_read_support_format_rar.c
Vulnerability: libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l() that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted archive file.
Vulnerability ID: CVE-2018-1000879
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/libarchive/libarchive
Published: 2018-12-20
File: libarchive/archive_acl.c
Commit message: Skip 0-length ACL fields

Currently, it is possible to create an archive that crashes bsdtar
with a malformed ACL:

Program received signal SIGSEGV, Segmentation fault.
archive_acl_from_text_l (acl=<optimised out>, text=0x7e2e92 "", want_type=<optimised out>, sc=<optimised out>) at libarchive/archive_acl.c:1726
1726				switch (*s) {
(gdb) p n
$1 = 1
(gdb) p field[n]
$2 = {start = 0x0, end = 0x0}

Stop this by checking that the length is not zero before beginning
the switch statement.

I am pretty sure this is the bug mentioned in the qsym paper [1],
and I was able to replicate it with a qsym + AFL + afl-rb setup.

[1] https://www.usenix.org/conference/usenixsecurity18/presentation/yun
Commit author: Daniel Axtens

Vulnerable version (before fix):
 archive_acl_from_text_l(struct archive_acl *acl, const char *text, 			st = field[n].start + 1; 			len = field[n].end - field[n].start;  			switch (*s) { 			case 'u': 				if (len == 1 || (len == 4

Fixed version (after fix):
 archive_acl_from_text_l(struct archive_acl *acl, const char *text, 			st = field[n].start + 1; 			len = field[n].end - field[n].start;  			if (len == 0) { 				ret = ARCHIVE_WARN; 				continue; 			}  			switch (*s) { 			case 'u': 				if (len == 1 || (len == 4

Patch:
patch: @@ -1723,6 +1723,11 @@ archive_acl_from_text_l(struct archive_acl *acl, const char *text,
 			st = field[n].start + 1;
 			len = field[n].end - field[n].start;
 
+			if (len == 0) {
+				ret = ARCHIVE_WARN;
+				continue;
+			}
+
 			switch (*s) {
 			case 'u':
 				if (len == 1 || (len == 4
path: libarchive/archive_acl.c
Vulnerability: libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.
Vulnerability ID: CVE-2018-1000880
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/libarchive/libarchive
Published: 2018-12-20
File: libarchive/archive_read_support_format_warc.c
Commit message: warc: consume data once read

The warc decoder only used read ahead, it wouldn't actually consume
data that had previously been printed. This means that if you specify
an invalid content length, it will just reprint the same data over
and over and over again until it hits the desired length.

This means that a WARC resource with e.g.
Content-Length: 666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666666665
but only a few hundred bytes of data, causes a quasi-infinite loop.

Consume data in subsequent calls to _warc_read.

Found with an AFL + afl-rb + qsym setup.
Commit author: Daniel Axtens

Vulnerable version (before fix):
 _warc_read(struct archive_read *a, const void **buf, size_t *bsz, int64_t *off) 		return (ARCHIVE_EOF); 	}  	rab = __archive_read_ahead(a, 1U, &nrd); 	if (nrd < 0) { 		*bsz = 0U;

Fixed version (after fix):
 _warc_read(struct archive_read *a, const void **buf, size_t *bsz, int64_t *off) 		return (ARCHIVE_EOF); 	}  	if (w->unconsumed) { 		__archive_read_consume(a, w->unconsumed); 		w->unconsumed = 0U; 	}  	rab = __archive_read_ahead(a, 1U, &nrd); 	if (nrd < 0) { 		*bsz = 0U;

Patch:
patch: @@ -386,6 +386,11 @@ _warc_read(struct archive_read *a, const void **buf, size_t *bsz, int64_t *off)
 		return (ARCHIVE_EOF);
 	}
 
+	if (w->unconsumed) {
+		__archive_read_consume(a, w->unconsumed);
+		w->unconsumed = 0U;
+	}
+
 	rab = __archive_read_ahead(a, 1U, &nrd);
 	if (nrd < 0) {
 		*bsz = 0U;
path: libarchive/archive_read_support_format_warc.c
Vulnerability: soundlib/Snd_fx.cpp in OpenMPT before 1.27.07.00 and libopenmpt before 0.3.8 allows remote attackers to cause a denial of service (out-of-bounds read) via an IT or MO3 file with many nested pattern loops.
Vulnerability ID: CVE-2018-10017
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/OpenMPT/openmpt
Published: 2018-04-11
File: soundlib/Snd_fx.cpp
Commit message: [Fix] Possible out-of-bounds read when computing length of some IT files with pattern loops (OpenMPT: formats that are converted to IT, libopenmpt: IT/ITP/MO3), caught with afl-fuzz.

git-svn-id: https://source.openmpt.org/svn/openmpt/trunk/OpenMPT@10027 56274372-70c3-4bfc-bfc3-4c3a0b034d27
Commit author: Johannes Schultz

Vulnerable version (before fix):
 std::vector<GetLengthType> CSoundFile::GetLength(enmGetLengthResetMode adjustMod 			if(GetType() == MOD_TYPE_IT) 			{ 				// IT pattern loop start row update - at the end of a pattern loop, set pattern loop start to next row (for upcoming pattern loops with missing SB0) 				for(CHANNELINDEX nChn = 0; nChn < GetNumChannels(); nChn++) 				{ 					if((pChn->rowCommand.command == CMD_S3MCMDEX && pChn->rowCommand.param >= 0xB1 && pChn->rowCommand.param <= 0xBF)) 					{

Fixed version (after fix):
 std::vector<GetLengthType> CSoundFile::GetLength(enmGetLengthResetMode adjustMod 			if(GetType() == MOD_TYPE_IT) 			{ 				// IT pattern loop start row update - at the end of a pattern loop, set pattern loop start to next row (for upcoming pattern loops with missing SB0) 				pChn = playState.Chn; 				for(CHANNELINDEX nChn = 0; nChn < GetNumChannels(); nChn++, pChn++) 				{ 					if((pChn->rowCommand.command == CMD_S3MCMDEX && pChn->rowCommand.param >= 0xB1 && pChn->rowCommand.param <= 0xBF)) 					{

Patch:
patch: @@ -1204,7 +1204,8 @@ std::vector<GetLengthType> CSoundFile::GetLength(enmGetLengthResetMode adjustMod
 			if(GetType() == MOD_TYPE_IT)
 			{
 				// IT pattern loop start row update - at the end of a pattern loop, set pattern loop start to next row (for upcoming pattern loops with missing SB0)
-				for(CHANNELINDEX nChn = 0; nChn < GetNumChannels(); nChn++)
+				pChn = playState.Chn;
+				for(CHANNELINDEX nChn = 0; nChn < GetNumChannels(); nChn++, pChn++)
 				{
 					if((pChn->rowCommand.command == CMD_S3MCMDEX && pChn->rowCommand.param >= 0xB1 && pChn->rowCommand.param <= 0xBF))
 					{
path: soundlib/Snd_fx.cpp
Vulnerability: The hi3660_stub_clk_probe function in drivers/clk/hisilicon/clk-hi3660-stub.c in the Linux kernel before 4.16 allows local users to cause a denial of service (NULL pointer dereference) by triggering a failure of resource retrieval.
Vulnerability ID: CVE-2018-10074
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2018-04-12
File: drivers/clk/hisilicon/clk-hi3660-stub.c
Commit message: clk: hisilicon: hi3660：Fix potential NULL dereference in hi3660_stub_clk_probe()

platform_get_resource() may return NULL, add proper check to
avoid potential NULL dereferencing.

This is detected by Coccinelle semantic patch.

@@
expression pdev, res, n, t, e, e1, e2;
@@

res = platform_get_resource(pdev, t, n);
+ if (!res)
+   return -EINVAL;
... when != res == NULL
e = devm_ioremap(e1, res->start, e2);

Fixes: 4f16f7ff3bc0 ("clk: hisilicon: Add support for Hi3660 stub clocks")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Commit author: Wei Yongjun

Vulnerable version (before fix):
 static int hi3660_stub_clk_probe(struct platform_device *pdev) 		return PTR_ERR(stub_clk_chan.mbox);  	res = platform_get_resource(pdev, IORESOURCE_MEM, 0); 	freq_reg = devm_ioremap(dev, res->start, resource_size(res)); 	if (!freq_reg) 		return -ENOMEM;

Fixed version (after fix):
 static int hi3660_stub_clk_probe(struct platform_device *pdev) 		return PTR_ERR(stub_clk_chan.mbox);  	res = platform_get_resource(pdev, IORESOURCE_MEM, 0); 	if (!res) 		return -EINVAL; 	freq_reg = devm_ioremap(dev, res->start, resource_size(res)); 	if (!freq_reg) 		return -ENOMEM;

Patch:
patch: @@ -149,6 +149,8 @@ static int hi3660_stub_clk_probe(struct platform_device *pdev)
 		return PTR_ERR(stub_clk_chan.mbox);
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!res)
+		return -EINVAL;
 	freq_reg = devm_ioremap(dev, res->start, resource_size(res));
 	if (!freq_reg)
 		return -ENOMEM;
path: drivers/clk/hisilicon/clk-hi3660-stub.c
Vulnerability: The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value.
Vulnerability ID: CVE-2018-10087
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2018-04-13
File: kernel/exit.c
Commit message: kernel/exit.c: avoid undefined behaviour when calling wait4()

wait4(-2147483648, 0x20, 0, 0xdd0000) triggers:
UBSAN: Undefined behaviour in kernel/exit.c:1651:9

The related calltrace is as follows:

  negation of -2147483648 cannot be represented in type 'int':
  CPU: 9 PID: 16482 Comm: zj Tainted: G    B          ---- -------   3.10.0-327.53.58.71.x86_64+ #66
  Hardware name: Huawei Technologies Co., Ltd. Tecal RH2285          /BC11BTSA              , BIOS CTSAV036 04/27/2011
  Call Trace:
    dump_stack+0x19/0x1b
    ubsan_epilogue+0xd/0x50
    __ubsan_handle_negate_overflow+0x109/0x14e
    SyS_wait4+0x1cb/0x1e0
    system_call_fastpath+0x16/0x1b

Exclude the overflow to avoid the UBSAN warning.

Link: http://lkml.kernel.org/r/1497264618-20212-1-git-send-email-zhongjiang@huawei.com
Signed-off-by: zhongjiang <zhongjiang@huawei.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Xishi Qiu <qiuxishi@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: zhongjiang

Vulnerable version (before fix):
 long kernel_wait4(pid_t upid, int __user *stat_addr, int options, 			__WNOTHREAD|__WCLONE|__WALL)) 		return -EINVAL;  	if (upid == -1) 		type = PIDTYPE_MAX; 	else if (upid < 0) {

Fixed version (after fix):
 long kernel_wait4(pid_t upid, int __user *stat_addr, int options, 			__WNOTHREAD|__WCLONE|__WALL)) 		return -EINVAL;  	/* -INT_MIN is not defined */ 	if (upid == INT_MIN) 		return -ESRCH;  	if (upid == -1) 		type = PIDTYPE_MAX; 	else if (upid < 0) {

Patch:
patch: @@ -1639,6 +1639,10 @@ long kernel_wait4(pid_t upid, int __user *stat_addr, int options,
 			__WNOTHREAD|__WCLONE|__WALL))
 		return -EINVAL;
 
+	/* -INT_MIN is not defined */
+	if (upid == INT_MIN)
+		return -ESRCH;
+
 	if (upid == -1)
 		type = PIDTYPE_MAX;
 	else if (upid < 0) {
path: kernel/exit.c
Vulnerability: SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.
Vulnerability ID: CVE-2018-10094
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/Dolibarr/dolibarr
Published: 2018-05-22
File: htdocs/adherents/list.php
Commit message: FIX CVE-2018-10094
Commit author: Laurent Destailleur

Vulnerable version (before fix):
 $result=restrictedArea($user,'adherent');  $filter=GETPOST("filter",'alpha'); $statut=GETPOST("statut",'alpha'); $search=GETPOST("search",'alpha'); $search_ref=GETPOST("search_ref",'alpha'); $search_lastname=GETPOST("search_lastname",'alpha');

Fixed version (after fix):
 $result=restrictedArea($user,'adherent');  $filter=GETPOST("filter",'alpha'); $statut=GETPOST("statut",'intcomma'); $search=GETPOST("search",'alpha'); $search_ref=GETPOST("search_ref",'alpha'); $search_lastname=GETPOST("search_lastname",'alpha');

Patch:
patch: @@ -43,7 +43,7 @@
 $result=restrictedArea($user,'adherent');
 
 $filter=GETPOST("filter",'alpha');
-$statut=GETPOST("statut",'alpha');
+$statut=GETPOST("statut",'intcomma');
 $search=GETPOST("search",'alpha');
 $search_ref=GETPOST("search_ref",'alpha');
 $search_lastname=GETPOST("search_lastname",'alpha');
path: htdocs/adherents/list.php
Vulnerability: Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.
Vulnerability ID: CVE-2018-10095
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/Dolibarr/dolibarr
Published: 2018-05-22
File: htdocs/adherents/cartes/carte.php
Commit message: FIX CVE-2018-10095
Commit author: Laurent Destailleur

Vulnerable version (before fix):
 require_once DOL_DOCUMENT_ROOT.'/core/modules/member/modules_cards.php'; require_once DOL_DOCUMENT_ROOT.'/core/modules/printsheet/modules_labels.php';  $langs->load("members"); $langs->load("errors");  // Choix de l'annee d'impression ou annee courante. $now = dol_now(); $year=dol_print_date($now,'%Y'); $month=dol_print_date($now,'%m'); $day=dol_print_date($now,'%d'); $foruserid=GETPOST('foruserid'); $foruserlogin=GETPOST('foruserlogin'); $mode=GETPOST('mode'); $model=GETPOST("model");			// Doc template to use for business cards $modellabel=GETPOST("modellabel");	// Doc template to use for address sheet $mesg='';  $adherentstatic=new Adherent($db);

Fixed version (after fix):
 require_once DOL_DOCUMENT_ROOT.'/core/modules/member/modules_cards.php'; require_once DOL_DOCUMENT_ROOT.'/core/modules/printsheet/modules_labels.php';  $langs->loadLangs(array("members","errors"));  // Choix de l'annee d'impression ou annee courante. $now = dol_now(); $year=dol_print_date($now,'%Y'); $month=dol_print_date($now,'%m'); $day=dol_print_date($now,'%d'); $foruserid=GETPOST('foruserid','alphanohtml'); $foruserlogin=GETPOST('foruserlogin','alphanohtml'); $mode=GETPOST('mode','aZ09'); $model=GETPOST("model",'aZ09');				// Doc template to use for business cards $modellabel=GETPOST("modellabel",'aZ09');	// Doc template to use for address sheet $mesg='';  $adherentstatic=new Adherent($db);

Patch:
patch: @@ -29,19 +29,18 @@
 require_once DOL_DOCUMENT_ROOT.'/core/modules/member/modules_cards.php';
 require_once DOL_DOCUMENT_ROOT.'/core/modules/printsheet/modules_labels.php';
 
-$langs->load("members");
-$langs->load("errors");
+$langs->loadLangs(array("members","errors"));
 
 // Choix de l'annee d'impression ou annee courante.
 $now = dol_now();
 $year=dol_print_date($now,'%Y');
 $month=dol_print_date($now,'%m');
 $day=dol_print_date($now,'%d');
-$foruserid=GETPOST('foruserid');
-$foruserlogin=GETPOST('foruserlogin');
-$mode=GETPOST('mode');
-$model=GETPOST("model");			// Doc template to use for business cards
-$modellabel=GETPOST("modellabel");	// Doc template to use for address sheet
+$foruserid=GETPOST('foruserid','alphanohtml');
+$foruserlogin=GETPOST('foruserlogin','alphanohtml');
+$mode=GETPOST('mode','aZ09');
+$model=GETPOST("model",'aZ09');				// Doc template to use for business cards
+$modellabel=GETPOST("modellabel",'aZ09');	// Doc template to use for address sheet
 $mesg='';
 
 $adherentstatic=new Adherent($db);
path: htdocs/adherents/cartes/carte.php