Baike.dev
Log in
Back to tool/Back to issues
#40626·dolibarr

restrictedArea() leaks a var_dump into every page, and checks $object->type on an id

Author: momodemo333Created Sep 21, 2026Updated Sep 21, 2026

Found while running the phpunit suite against current develop — CodingPhpTest::testPHP fails on htdocs/core/lib/security.lib.php, and the cause is live on every install.

1. A var_dump left inside restrictedArea()

htdocs/core/lib/security.lib.php:949, from f433edf67c:

php
$checkonentityready = 1;
var_dump($checkonentityready, $sql);

Loading /product/card.php?id=1 on a fresh develop prints, before <!doctype html>:

int(1)
string(98) "SELECT COUNT(dbt.rowid) as nb FROM llx_product as dbt WHERE dbt.rowid IN (1) AND dbt.entity IN (1)"

Two consequences beyond the noise: output before the doctype means headers are already sent, so any later header() call fails — and since the same commit calls restrictedArea() from document.php and viewimage.php, a downloaded file would get those two lines prepended to it. A PDF or an image served that way is corrupt.

It also turns CodingPhpTest red for everyone.

2. $object->type where the parameter holds an id

Same commit, security.lib.php:391 and :395:

php
} elseif ($feature == 'produit') {
    if ($object->type == 0 && !$user->hasRight('produit', 'lire')) {
    ...
    if ($object->type == 1 && !$user->hasRight('service', 'lire')) {

The third parameter of restrictedArea() is the object id, not the object — product/card.php:208 calls restrictedArea($user, 'produit', $object->id, 'product&product', '', ''). Hence the warning that comes with the dump above:

Warning: Attempt to read property "type" on string in security.lib.php on line 395

$object->type is then null, and in PHP null == 0 is true while null == 1 is false, so the first branch always runs and the second never does. The service, lire check is unreachable as written.

I did not touch this one because I cannot tell what it was meant to do — load the product to read its type, or drop the type distinction. That is yours to say.

Happy to send a PR for the var_dump alone if that helps, but it is a one-line delete and you will be faster.

Tested on develop at f433edf67c, PHP 8.3.33, MariaDB.

Written four-handed with Claude Code — reproduced and checked by the human before posting.

Source: Dolibarr/dolibarr

View original on GitHubView discussion on GitHub