I have found (create) solution.
Open “include/utils.php” and search:
PHP Code:
function clean_string($str, $filter = "STANDARD") {
global $sugar_config;
$filters = Array(
"STANDARD" => "#[^A-Z0-9\-_\.\@]#i",
"STANDARDSPACE" => "#[^A-Z0-9\-_\.\@\ ]#i",
"FILE" => "#[^A-Z0-9\-_\.]#i",
"NUMBER" => "#[^0-9\-]#i",
"SQL_COLUMN_LIST" => "#[^A-Z0-9,_\.]#i",
"PATH_NO_URL" => "#://#i",
"SAFED_GET" => "#[^A-Z0-9\@\=\&\?\.\/\-_~]#i", /* range of allowed characters in a GET string */
"UNIFIED_SEARCH" => "#[\\x00]#", /* cn: bug 3356 & 9236 - MBCS search strings */
"AUTO_INCREMENT" => "#[^0-9\-,\ ]#i",
"ALPHANUM" => "#[^A-Z0-9\-]#i",
);
if (preg_match($filters[$filter], $str)) {
if (isset($GLOBALS['log']) && is_object($GLOBALS['log'])) {
$GLOBALS['log']->fatal("SECURITY: bad data passed in; string: {$str}");
}
die("Bad data passed in; <a href=\"{$sugar_config['site_url']}\">Return to Home</a>");
}
else {
return $str;
}
}
Then add to $filter this:
PHP Code:
"SAFED_PATH" => "#[^A-Z0-9\:\\\@\=\&\?\.\/\-_~]#i",
After that? finde( function clean_special_arguments should be right after function clean_string):
PHP Code:
function clean_special_arguments() {
if(isset($_SERVER['PHP_SELF'])) {
if (!empty($_SERVER['PHP_SELF'])) clean_string($_SERVER['PHP_SELF'], 'SAFED_PATH');
}
if (!empty($_REQUEST) && !empty($_REQUEST['login_theme'])) clean_string($_REQUEST['login_theme'], "STANDARD");
if (!empty($_REQUEST) && !empty($_REQUEST['ck_login_theme_20'])) clean_string($_REQUEST['ck_login_theme_20'], "STANDARD");
if (!empty($_SESSION) && !empty($_SESSION['authenticated_user_theme'])) clean_string($_SESSION['authenticated_user_theme'], "STANDARD");
if (!empty($_REQUEST) && !empty($_REQUEST['module_name'])) clean_string($_REQUEST['module_name'], "STANDARD");
if (!empty($_REQUEST) && !empty($_REQUEST['module'])) clean_string($_REQUEST['module'], "STANDARD");
if (!empty($_POST) && !empty($_POST['parent_type'])) clean_string($_POST['parent_type'], "STANDARD");
if (!empty($_REQUEST) && !empty($_REQUEST['mod_lang'])) clean_string($_REQUEST['mod_lang'], "STANDARD");
if (!empty($_SESSION) && !empty($_SESSION['authenticated_user_language'])) clean_string($_SESSION['authenticated_user_language'], "STANDARD");
if (!empty($_SESSION) && !empty($_SESSION['dyn_layout_file'])) clean_string($_SESSION['dyn_layout_file'], "PATH_NO_URL");
if (!empty($_GET) && !empty($_GET['from'])) clean_string($_GET['from']);
if (!empty($_GET) && !empty($_GET['gmto'])) clean_string($_GET['gmto'], "NUMBER");
if (!empty($_GET) && !empty($_GET['case_number'])) clean_string($_GET['case_number'], "AUTO_INCREMENT");
if (!empty($_GET) && !empty($_GET['bug_number'])) clean_string($_GET['bug_number'], "AUTO_INCREMENT");
if (!empty($_GET) && !empty($_GET['quote_num'])) clean_string($_GET['quote_num'], "AUTO_INCREMENT");
clean_superglobals('stamp', 'ALPHANUM'); // for vcr controls
clean_superglobals('offset', 'ALPHANUM');
clean_superglobals('return_action');
clean_superglobals('return_module');
return TRUE;
}
Finde here this string:
PHP Code:
if (!empty($_SERVER['PHP_SELF'])) clean_string($_SERVER['PHP_SELF'], 'SAFED_GET');
And replace it with this:
PHP Code:
if (!empty($_SERVER['PHP_SELF'])) clean_string($_SERVER['PHP_SELF'], 'SAFED_PATH');
Tested on SugarCRm 5.2e CE on MS Windows + Apache 2.2.11 + MOD_PHP + PHP 5.2.9-2
Good luck!
Bookmarks