Vendor reference detected as sql injection

[John-H-Smith]

Bug

Hi there, with dolibarr 16.0.0 and 16.0.1, I am not able to create a vendor invoice with vendor reference '23F0643B-0021' or even '23F0643B0021'. It's alerting then: Access refused to xxx.xxx.xxx.xxx by SQL or Script injection protection in main.inc.php - GETPOST type=0 paramkey=ref_supplier paramvalue=23F0643B-0021 page=/fourn/facture/card.php

Environment Version

16.0.0, 16.0.1

Environment OS

AlmaLinux release 8.6

Environment Web server

Apache/2.4.37

Environment PHP

PHP 7.4.32

Environment Database

10.6.10-MariaDB

Environment URL(s)

No response

Expected and actual behavior

Expected: Vendor invoice should get created

Actual: Error 'Access refused to xxx.xxx.xxx.xxx by SQL or Script injection protection in main.inc.php - GETPOST type=0 paramkey=ref_supplier paramvalue=23F0643B-0021 page=/fourn/facture/card.php' (IP censored)

Steps to reproduce the behavior

Just create a vendor invoice with reference 23F0643B0021.

Attached files

No response

[ns-info90]

We need more details because when I do the test I don't meet your blockage

[hregis]

@John-H-Smith i can't reproduce your problem... have you externals modules ?

[John-H-Smith]

We need more details because when I do the test I don't meet your blockage

Alright... strange. What information do you need?

@John-H-Smith i can't reproduce your problem... have you externals modules ? No, no external modules are installed. A list of my enabled modules:

• Users & Groups
• Third Parties
• Proposals
• Contracts/Subscriptions
• Interventions
• Vendors
• Invoices
• Taxes & Special Expenses
• Banks & Cash
• Payment by credit transfer
• Payments by Direct Debit
• Accounting (simplified)
• Products
• Services
• Projects or Leads
• Events/Agenda
• DMS / ECM
• WYSIWYG editor
• Multicurrency
• Inter-modules Workflow
• Module and Application Builder
• Notifications on business event
• API/Web services (REST server)
• Scheduled jobs
• Unalterable Archives I hope you have some ideas what's causing that problem.

BTW I got it working with creating the invoice with another reference and then changing it on the invoice card. But, something is causing this error... I just checked the php error log, which is saying the exactly same: [Mon Nov 07 08:00:25.435829 2022] [proxy_fcgi:error] [pid 3692514:tid 140369379448576] [client xxx.xxx.xxx.xxx:0] AH01071: Got error 'PHP message: Access refused to xxx.xxx.xxx.xxx by SQL or Script injection protection in main.inc.php - GETPOST type=0 paramkey=ref_supplier paramvalue=23F0643B', referer: https://my-website.com/fourn/facture/card.php?leftmenu=suppliers_bills&action=create

[hregis]

@John-H-Smith i'm sorry, I activated all the modules mentioned, but I still do not reproduce the problem! have you activated the Dolibarr logs and can you send them keeping only the part where you create or modify this supplier reference please? thanks

[John-H-Smith]

No, I haven't. Right now, I activated them, but cannot reproduce this issue either. Maybe, this is a minor bug.

[John-H-Smith]

Hi there, I just reproduced the very same error again with reference E225152C-0015

[John-H-Smith]

Alright, seems like copying from a pdf file copied a \ with, so the reference was technically E225152C-\0015, so it has been detected as unicode. Maybe such types should be sanitized instead of running into a hard error.

[AurelienBISOTTI]

Then I think it's not a bug but you might open a request for new function "sanitize reference name" ?