forked from Dolibarr/dolibarr
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'develop' of https://github.com/Dolibarr/dolibarr into d…
…ev_28554
- Loading branch information
Showing
1,053 changed files
with
19,480 additions
and
17,153 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| --- | ||
| name: Cleanup caches of a closed branch | ||
| # See https://github.com/actions/cache/blob/main/tips-and-workarounds.md#force-deletion-of-caches-overriding-default-cache-eviction-policy | ||
| on: | ||
| pull_request: | ||
| types: [closed] | ||
| workflow_dispatch: | ||
| jobs: | ||
| cleanup: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| # `actions:write` permission is required to delete caches | ||
| # See also: https://docs.github.com/en/rest/actions/cache?apiVersion=2022-11-28#delete-a-github-actions-cache-for-a-repository-using-a-cache-id | ||
| actions: write | ||
| contents: read | ||
| steps: | ||
| - name: Check out code | ||
| uses: actions/checkout@v4 | ||
| - name: Cleanup | ||
| run: | | ||
| gh extension install actions/gh-actions-cache | ||
| REPO=${{ github.repository }} | ||
| BRANCH=refs/pull/${{ github.event.pull_request.number }}/merge | ||
| echo "Fetching list of cache key" | ||
| cacheKeysForPR=$(gh actions-cache list -R $REPO -B $BRANCH | cut -f 1 ) | ||
| ## Setting this to not fail the workflow while deleting cache keys. | ||
| set +e | ||
| echo "Deleting caches..." | ||
| for cacheKey in $cacheKeysForPR | ||
| do | ||
| gh actions-cache delete $cacheKey -R $REPO -B $BRANCH --confirm | ||
| done | ||
| echo "Done" | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,41 +1,39 @@ | ||
| --- | ||
| name: Win CI | ||
| # yamllint disable-line rule:truthy | ||
| on: | ||
| push: | ||
| pull_request: | ||
| workflow_dispatch: | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | ||
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref | ||
| }} | ||
| cancel-in-progress: true | ||
|
|
||
| env: | ||
| PHPUNIT_LOG: phpunit_tests.log | ||
| DOLIBARR_LOG: documents/dolibarr.log | ||
| PHPSERVER_LOG: phpserver.log | ||
| PHPSERVER_DOMAIN_PORT: 127.0.0.1:8000 # could be 127.0.0.1:8000 if config modified | ||
| CACHE_KEY_PART: ${{ ( github.event_name == 'pull_request' ) && github.base_ref }}${{ ( github.event_name == 'pull_request' ) && '-' }}${{ github.head_ref }} | ||
| PHP_INI_SCAN_DIR: "C:\\myphpini" | ||
| PHPSERVER_DOMAIN_PORT: 127.0.0.1:8000 # could be 127.0.0.1:8000 if config modified | ||
| CACHE_KEY_PART: ${{ github.event_name == 'pull_request' && format('{0}-{1}', github.base_ref, github.head_ref) || github.ref_name }} | ||
| PHP_INI_SCAN_DIR: C:\myphpini | ||
| CKEY: win-ci-2 | ||
|
|
||
| GITHUB_JSON: ${{ toJSON(github) }} # Helps in debugging Github Action | ||
| jobs: | ||
| win-test: | ||
| strategy: | ||
| matrix: | ||
| os: [windows-latest] | ||
| # php_version: [7.4, 8.0] # Add more versions if needed | ||
| php_version: [7.4] # Add more versions if needed | ||
| php_version: [7.4] # Add more versions if needed | ||
| runs-on: ${{ matrix.os }} | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup MariaDB | ||
| uses: ankane/setup-mariadb@v1 | ||
| with: | ||
| # mariadb-version: ${{ matrix.mariadb-version }} | ||
| database: travis # Specify your database name | ||
|
|
||
| database: travis # Specify your database name | ||
| - name: Setup PHP | ||
| uses: shivammathur/setup-php@v2 | ||
| with: | ||
|
|
@@ -57,16 +55,18 @@ jobs: | |
| id: cache | ||
| uses: actions/cache/restore@v4 | ||
| with: | ||
| # See https://github.com/actions/cache/issues/1275#issuecomment-1925217178 | ||
| enableCrossOsArchive: true | ||
| path: | | ||
| db_init.sql | ||
| db_init.sql.md5 | ||
| key: ${{ matrix.os }}-${{ env.ckey }}-${{ matrix.php_version }}-${{ env.CACHE_KEY_PART }}-${{ github.run_id }} | ||
| key: ${{ matrix.os }}-${{ env.ckey }}-${{ matrix.php_version }}-${{ env.CACHE_KEY_PART | ||
| }}-${{ github.run_id }} | ||
| restore-keys: | | ||
| ${{ matrix.os }}-${{ env.ckey }}-${{ matrix.php_version }}-${{ env.CACHE_KEY_PART }}- | ||
| ${{ matrix.os }}-${{ env.ckey }}-${{ matrix.php_version }}-${{ github.head_ref }}- | ||
| ${{ matrix.os }}-${{ env.ckey }}-${{ matrix.php_version }}-${{ github.base_ref }}- | ||
| ${{ matrix.os }}-${{ env.ckey }}-${{ matrix.php_version }}- | ||
| - name: Create local php.ini | ||
| shell: cmd | ||
| if: false | ||
|
|
@@ -91,7 +91,6 @@ jobs: | |
| SET PHP_INI_SCAN_DIR= | ||
| ECHO "==== Verify it is used by PHP ===" | ||
| php --ini | ||
| - name: Run Bash script | ||
| # Note this is bash (MSYS) on Windows | ||
| shell: bash | ||
|
|
@@ -106,7 +105,6 @@ jobs: | |
| ls -l | ||
| echo "TEE=$(cygpath -w "$(which tee)")" >> "$GITHUB_ENV" | ||
| echo "BASEDIR=$(realpath .)" >> "$GITHUB_ENV" | ||
| - name: Start web server | ||
| id: server | ||
| if: false | ||
|
|
@@ -115,9 +113,8 @@ jobs: | |
| Start-Process -FilePath "php.exe" -WindowStyle Hidden -ArgumentList "-S ${{ env.PHPSERVER_DOMAIN_PORT }} -t htdocs > ${{ env.PHPSERVER_LOG }}" -PassThru | ||
| curl "http://${{ env.PHPSERVER_DOMAIN_PORT }}" | ||
| shell: powershell | ||
|
|
||
| - name: Run PHPUnit tests | ||
| continue-on-error: true | ||
| # continue-on-error: true | ||
| shell: cmd | ||
| # setting up php.ini, starting the php server are currently in this step | ||
| run: |- | ||
|
|
@@ -146,15 +143,13 @@ jobs: | |
| cat htdocs/conf/conf.php | ||
| curl "http://${{ env.PHPSERVER_DOMAIN_PORT }}" | ||
| REM 'DOSKEY' USED to recover error code (no pipefile equivalent in windows?) | ||
| ( php "%PHPROOT%\phpunit" -d memory_limit=-1 -c %CD%\test\phpunit\phpunittest.xml "test\phpunit\AllTests.php" & call doskey /exename=err err=%%^^errorlevel%% ) | "${{ env.TEE }}" "${{ env.PHPUNIT_LOG }}" | ||
| ( php "%PHPROOT%\phpunit" -d memory_limit=-1 -c %CD%\test\phpunit\phpunittest.xml "test\phpunit\AllTests.php" --exclude-group WindowsWaitingForFix & call doskey /exename=err err=%%^^errorlevel%% ) | "${{ env.TEE }}" "${{ env.PHPUNIT_LOG }}" | ||
| for /f "tokens=2 delims==" %%A in ('doskey /m:err') do EXIT /B %%A | ||
| - name: Convert Raw Log to Annotations | ||
| uses: mdeweerd/[email protected] | ||
| if: ${{ failure() }} | ||
| with: | ||
| in: ${{ env.PHPUNIT_LOG }} | ||
|
|
||
| - name: Provide dolibarr and phpunit logs as artifact | ||
| uses: actions/upload-artifact@v4 | ||
| if: ${{ ! cancelled() }} | ||
|
|
@@ -169,9 +164,11 @@ jobs: | |
| retention-days: 2 | ||
|
|
||
| # Save cache | ||
| - name: "Save cache" | ||
| - name: Save cache | ||
| uses: actions/cache/save@v4 | ||
| if: ${{ ! cancelled() }} | ||
| with: | ||
| # See https://github.com/actions/cache/issues/1275#issuecomment-1925217178 | ||
| enableCrossOsArchive: true | ||
| key: ${{ steps.cache.outputs.cache-primary-key }} | ||
| path: db_init.* | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,7 +11,9 @@ Security report are valid only on current stable version (see https://dolibarr.o | |
| To report a vulnerability, for a private report, you can: | ||
|
|
||
| - Send your report on Vulnerability Disclosure Program (VDP) [https://app.yogosha.com/cvd/dolibarr/10VxeNx6Ui3rSEhAgX63US](https://app.yogosha.com/cvd/dolibarr/10VxeNx6Ui3rSEhAgX63US) (recommended for everybody) | ||
| <!-- | ||
| - Or if you have permissions, use GitHub security advisory at [https://github.com/Dolibarr/dolibarr/security/advisories/new](https://github.com/Dolibarr/dolibarr/security/advisories/new) | ||
| --> | ||
| - Or send an email to [email protected] with clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary. | ||
|
|
||
| ## Hunting vulnerabilities on Dolibarr | ||
|
|
@@ -102,3 +104,5 @@ Scope is the web application (backoffice) and the APIs. | |
| * SSL/TLS best practices | ||
| * Invalid or missing SPF (Sender Policy Framework) records (Incomplete or missing SPF/DKIM/DMARC) | ||
| * Physical or social engineering attempts or issues that require physical access to a victim’s computer/device | ||
| * Vulnerabilities of type XSS exploited by using javascript into a website page (with permission to edit website pages) or by using php code into a website page | ||
| using the permission to edit php code are not qualified, except if this allow to get higher privileges (being able to set javascript or php code is the expected behaviour). | ||
Oops, something went wrong.