engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

suitecrm+dolibarr: 5-MOAD scan — 3 new defects, MOADs 0002/0003/0005 CLEAN

Browse source 
suitecrm-0004: SugarBean.php subpanel union field dedup in_array($field, $all_fields)
inside nested foreach over subpanel queries — O(S*F^2), 4.3x at S=40 F=60.
Fix: parallel hash set for O(1) isset() check.

dolibarr-0004: emailcollector_card.php line 575 — IMAP password logged verbatim
unconditionally in dol_syslog(). CWE-312 HIGH. Fix: replace with literal ***.

dolibarr-0005: functions_ldap.php line 98 — LDAP admin searchPassword first 3 chars
leaked via dol_trunc() in dol_syslog() and browser print when $ldapdebug=true.
CWE-312 MEDIUM. Fix: replace dol_trunc(...) with literal *** in both sinks.

All 4 SuiteCRM tests PASS. All 5 Dolibarr tests PASS.
MOADs 0002/0003/0005 CLEAN for both targets (PHP single-threaded, architectural globals).
This commit is contained in:
russell@unturf.com 2026-03-31 20:27:34 -04:00
parent 14c3a92bab
commit fc7fdad2dc
9 changed files with 301 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
defects/dolibarr/patch/dolibarr-0004-emailcollector-imap-password-logged.patch Normal file
View file

@ -0,0 +1,11 @@
--- a/htdocs/admin/emailcollector_card.php
+++ b/htdocs/admin/emailcollector_card.php
@@ -572,7 +572,7 @@
$timeoutconnect = getDolGlobalInt('MAIN_USE_CONNECT_TIMEOUT', 5);
$timeoutread = getDolGlobalInt('MAIN_USE_RESPONSE_TIMEOUT', 20);
- dol_syslog("imap_open connectstring=".$connectstringsource." login=".$object->login." password=".$object->password." timeoutconnect=".$timeoutconnect." timeoutread=".$timeoutread);
+ dol_syslog("imap_open connectstring=".$connectstringsource." login=".$object->login." password=*** timeoutconnect=".$timeoutconnect." timeoutread=".$timeoutread);
$result1 = imap_timeout(IMAP_OPENTIMEOUT, $timeoutconnect); // timeout seems ignored with ssl connect
$result2 = imap_timeout(IMAP_READTIMEOUT, $timeoutread);

11
defects/dolibarr/patch/dolibarr-0005-ldap-searchpassword-logged.patch Normal file
View file

@ -0,0 +1,11 @@
--- a/htdocs/core/login/functions_ldap.php
+++ b/htdocs/core/login/functions_ldap.php
@@ -95,9 +95,9 @@
if ($ldapdebug) {
dol_syslog("functions_ldap::check_user_password_ldap Server:".implode(',', $ldap->server).", Port:".$ldap->serverPort.", Protocol:".$ldap->ldapProtocolVersion.", Type:".$ldap->serverType);
- dol_syslog("functions_ldap::check_user_password_ldap uid/samaccountname=".$ldapuserattr.", dn=".$ldapdn.", Admin:".$ldap->searchUser.", Pass:".dol_trunc($ldap->searchPassword, 3));
+ dol_syslog("functions_ldap::check_user_password_ldap uid/samaccountname=".$ldapuserattr.", dn=".$ldapdn.", Admin:".$ldap->searchUser.", Pass:***");
print "DEBUG: Server:".implode(',', $ldap->server).", Port:".$ldap->serverPort.", Protocol:".$ldap->ldapProtocolVersion.", Type:".$ldap->serverType."<br>\n";
- print "DEBUG: uid/samaccountname=".$ldapuserattr.", dn=".$ldapdn.", Admin:".$ldap->searchUser.", Pass:".dol_trunc($ldap->searchPassword, 3)."<br>\n";
+ print "DEBUG: uid/samaccountname=".$ldapuserattr.", dn=".$ldapdn.", Admin:".$ldap->searchUser.", Pass:***<br>\n";
}