search

Dolibarr / dolibarr

Dolibarr ERP CRM is a modern software package to manage your company or foundation's activity (contacts, suppliers, invoices, orders, stocks, agenda, accounting, ...). it's an open source Web application (written in PHP) designed for businesses of any sizes, foundations and freelancers.
https://www.dolibarr.org
GNU General Public License v3.0
5.47k stars 2.8k forks source link

script injection protection in main.inc.php:analyseVarsForSqlAndScriptsInjection #28332

Open adriansev opened 8 months ago

adriansev commented 8 months ago

Bug

Hi! after i updated the ips of the Dolibarr machine and of the database machine when trying to add users i get:

Access refused to DBA_MACHINE by SQL or Script injection protection in main.inc.php:analyseVarsForSqlAndScriptsInjection type=0
Try to go back, fix data of your form and resubmit it. You can contact also your technical support.

but psql access works without problems, and also the listing of already present users works (so it's not an db access problem)..

Any idea how can i fix this? what and where should i change to return to working condition? Thanks a lot!

Environment Version

19.0

Environment OS

Alma 9

Environment Web server

httpd 2.4.57

Environment PHP

php-fpm 8.0.30

Environment Database

postgresql16 16.2

Environment URL(s)

http://hr.spacescience.ro/hr/user/card.php

Expected and actual behavior

Expected: To create the user as it worked before changing the ips Actual: does not not work with the message:

Access refused to DBA_MACHINE by SQL or Script injection protection in main.inc.php:analyseVarsForSqlAndScriptsInjection type=0
Try to go back, fix data of your form and resubmit it. You can contact also your technical support.

Steps to reproduce the behavior

No response

Attached files

No response

adriansev commented 8 months ago

well, the "solution" to have something working was to create another (empty) db. but it would be really useful to have a way to not break (or at least to un-break) if anything network related was changed...

dpnx-nudra commented 2 months ago

This happened to me after an update to 19.0.3, meanwhile i was creating a new email template. I'm looking for a workaround