diff --git a/.snyk b/.snyk new file mode 100644 index 000000000..3984df3ed --- /dev/null +++ b/.snyk @@ -0,0 +1,9 @@ +ignore: + - "vendor/**" + - "plugins/**" + - "includes/libraries/cryptojs/**" + - "includes/libraries/csrfp/**" + - "includes/libraries/ezimuel/**" + - "includes/libraries/plupload/**" + - "includes/libraries/yubico/**" + - "install/**" \ No newline at end of file diff --git a/api/Controller/Api/BaseController.php b/api/Controller/Api/BaseController.php index e75544a91..21dc48f06 100755 --- a/api/Controller/Api/BaseController.php +++ b/api/Controller/Api/BaseController.php @@ -80,8 +80,7 @@ public function sanitizeUrl(array $array) return dataSanitizer( $array, - $filters, - __DIR__.'/../../..' + $filters ); } diff --git a/api/Controller/Api/ItemController.php b/api/Controller/Api/ItemController.php index 593dc51eb..76261702f 100755 --- a/api/Controller/Api/ItemController.php +++ b/api/Controller/Api/ItemController.php @@ -185,29 +185,38 @@ public function createAction(array $userData) // get parameters $arrQueryStringParams = $this->getQueryStringParams(); - // check parameters - $arrCheck = $this->checkNewItemData($arrQueryStringParams, $userData); - if ($arrCheck['error'] === true) { - $strErrorDesc = $arrCheck['strErrorDesc']; - $strErrorHeader = $arrCheck['strErrorHeader']; + // Check that the parameters are indeed an array before using them + if (is_array($arrQueryStringParams)) { + // check parameters + $arrCheck = $this->checkNewItemData($arrQueryStringParams, $userData); + + if ($arrCheck['error'] === true) { + $strErrorDesc = $arrCheck['strErrorDesc']; + $strErrorHeader = $arrCheck['strErrorHeader']; + } else { + // launch + $itemModel = new ItemModel(); + $ret = $itemModel->addItem( + (int) $arrQueryStringParams['folder_id'], + (string) $arrQueryStringParams['label'], + (string) $arrQueryStringParams['password'], + (string) $arrQueryStringParams['description'], + (string) $arrQueryStringParams['login'], + (string) $arrQueryStringParams['email'], + (string) $arrQueryStringParams['url'], + (string) $arrQueryStringParams['tags'], + (string) $arrQueryStringParams['anyone_can_modify'], + (string) $arrQueryStringParams['icon'], + (int) $userData['id'], + (string) $userData['username'], + ); + $responseData = json_encode($ret); + } + } else { - // launch - $itemModel = new ItemModel(); - $ret = $itemModel->addItem( - $arrQueryStringParams['folder_id'], - $arrQueryStringParams['label'], - $arrQueryStringParams['password'], - $arrQueryStringParams['description'], - $arrQueryStringParams['login'], - $arrQueryStringParams['email'], - $arrQueryStringParams['url'], - $arrQueryStringParams['tags'], - $arrQueryStringParams['anyone_can_modify'], - $arrQueryStringParams['icon'], - $userData['id'], - $userData['username'], - ); - $responseData = json_encode($ret); + // Gérer le cas où les paramètres ne sont pas un tableau + $strErrorDesc = 'Data not consistent'; + $strErrorHeader = 'Expected array, received ' . gettype($arrQueryStringParams); } } } else { diff --git a/api/inc/jwt_utils.php b/api/inc/jwt_utils.php index 0df070d47..bfa33614b 100755 --- a/api/inc/jwt_utils.php +++ b/api/inc/jwt_utils.php @@ -88,7 +88,8 @@ function get_authorization_header() $authorizationHeader = $request->headers->get('Authorization'); $headers = null; - if (null !== $authorizationHeader) { + // Check if the authorization header is not empty + if (!empty($authorizationHeader)) { $headers = trim($authorizationHeader); } else if (function_exists('apache_request_headers') === true) { $requestHeaders = (array) apache_request_headers(); diff --git a/api/index.php b/api/index.php index c6c356a4a..4fea17350 100755 --- a/api/index.php +++ b/api/index.php @@ -23,7 +23,18 @@ * @see https://www.teampass.net */ -header("Access-Control-Allow-Origin: ".$_SERVER['HTTP_HOST']); +// Determine the protocol used +$protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https://' : 'http://'; + +// Validate and filter the host +$host = filter_var($_SERVER['HTTP_HOST'], FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME); + +// Allocate the correct CORS header +if ($host !== false) { + header("Access-Control-Allow-Origin: $protocol$host"); +} else { + header("Access-Control-Allow-Origin: 'null'"); +} header("Content-Type: application/json; charset=UTF-8"); header("Access-Control-Allow-Methods: POST, GET"); header("Access-Control-Max-Age: 3600"); @@ -33,7 +44,7 @@ // sanitize url segments $base = new BaseController(); $uri = $base->getUriSegments(); -if (is_array($uri) === false || is_string($uri) === true) { +if (!is_array($uri)) { $uri = [$uri]; // ensure $uril is table } diff --git a/includes/config/include.php b/includes/config/include.php index 7c30a8877..941ec9e71 100755 --- a/includes/config/include.php +++ b/includes/config/include.php @@ -28,7 +28,7 @@ define('TP_VERSION', '3.1.2'); define("UPGRADE_MIN_DATE", "1727110744"); -define('TP_VERSION_MINOR', '143'); +define('TP_VERSION_MINOR', '144'); define('TP_TOOL_NAME', 'Teampass'); define('TP_ONE_DAY_SECONDS', 86400); define('TP_ONE_WEEK_SECONDS', 604800); diff --git a/includes/core/login.php b/includes/core/login.php index 01bb265ca..4310d73ad 100755 --- a/includes/core/login.php +++ b/includes/core/login.php @@ -77,7 +77,7 @@ exit; } else { // Gérer les erreurs - echo 'Erreur lors de la récupération des informations utilisateur : ' . $userInfo['message']; + echo 'Erreur lors de la récupération des informations utilisateur : ' . htmlspecialchars($userInfo['message'], ENT_QUOTES, 'UTF-8'); }; } @@ -87,7 +87,6 @@ // Check if user exists in Teampass if (WIP === true) { error_log('---- CALLBACK LOGIN ----'); - //error_log('Info : ' . print_r($session->get('userOauth2Info'), true)); } $session->set('user-login', strstr($session->get('userOauth2Info')['userPrincipalName'], '@', true)); diff --git a/index.php b/index.php index 00a19dfc0..a99a7cc41 100755 --- a/index.php +++ b/index.php @@ -686,9 +686,9 @@