DoliSCAN 2.2.22: security fixes

Security

A deleted employee could take a colleague's DoliSCAN account down with them. The module found the account from the wrong identifier, and the deletion also applied to the DoliSCAN server.

The other points addressed in this version:

• downloading a receipt stays within the folder of the expense report that requests it;
• the main access token is stored encrypted and is never displayed again;
• the diagnostics, correction and company mapping pages are restricted to the super administrator;
• any action that contacts the DoliSCAN server, creates or deletes a remote account requires a confirmation, which prevents it from being triggered from another site;
• the values entered in the mobile application are escaped before display, and a receipt label can no longer become a formula when the list is opened in a spreadsheet;
• deleting an account depends on the delete permission, and no longer on the write permission;
• the module refuses to contact the server over unencrypted HTTP, and reports any drop in the transport security level.

Tokens are no longer written to the log

The DoliSCAN server access token has been stored encrypted in the database since the previous version. It nevertheless remained readable elsewhere: when the module connected, the server's response was copied as-is into the Dolibarr log, token included, as were the security codes received by email. Anyone who could read dolibarr.log could therefore impersonate the account.

These values are now masked before writing, leaving only the last four characters, enough to recognise which token is in use without being able to use it.

If your logs are kept or archived, the remedy must be completed on your side: the fix prevents future writes, it does not rewrite what is already on disk. Check who has access to these files and, if a token appears in them, renew it from the module's configuration page.

Security update, recommended for all installations.

To do after the update

1. Run the VAT correction if you handle fuel. From the module's diagnostics page, the section listing the lines whose net amount and VAT are swapped shows what is affected, with the two breakdowns side by side, and the correction button. If there is nothing to correct, the section says so.

2. Check the permissions if you are coming from a version earlier than 2.2.20. Dolibarr only writes a module's permissions when it is activated: if you have not done so yet, deactivate then reactivate DoliSCAN from Home > Setup > Modules/Applications, then grant the employees concerned the right to validate their DoliSCAN expense reports in Users and groups, Permissions tab, DoliSCAN section. The diagnostics page detects this case and offers to reinstall the permissions.

Day to day

• the interface is translated: English, Spanish, German and Italian. More than two hundred sentences were displayed in French regardless of the chosen language, and German as well as Italian did not exist at all;
• the nightly synchronisation no longer stops on an expense report whose date is unusable: it skips it, reports it, and processes the following ones;
• failures are reported instead of being passed over in silence, whether it concerns a record, a payment or an import;
• synchronisation is faster: the module only waits between two calls if the server asks it to, and two indexes have been added for databases with a large number of expense reports;
• the information tab of a DoliSCAN account finally opens, it was asking the database for columns that did not exist;
• the expense report list displays its total row.

Multi-company

This point only concerns installations equipped with the Multi-company module.

Partitioning by entity has been completed: the expense report list, the general resynchronisation, the last synchronisation marker, the logins sent with projects and the search for a linked supplier invoice all stay within the current company.

Four less visible paths were reworked at the same time:

• the list of DoliSCAN accounts of an employee active in two companies now only displays the one of the company being viewed. The others appeared there with their login identifier and their synchronisation dates;
• the resynchronisation of an expense report checks who owns the Dolibarr expense report attached to it. An attachment that had become inconsistent led to filing one employee's receipts in a colleague's expense report, or in another company's;
• the search for an already processed report takes the employee and the company into account, instead of relying solely on the identifier returned by the server. That identifier is only unique for a given DoliSCAN server: since the module allows one server per company, two companies could return the same one and one company's report was taken for the other's;
• a report or an account whose company is unknown is no longer treated as belonging to the company being viewed. The refusal only applies if the Multi-company module is active: on a single-company installation, there is no other company a piece of data could leak to, and old rows remain accessible as usual.

Compatibility

DoliSCAN 2.2.22 requires Dolibarr 18 or higher and PHP 7.4 or higher. The module's static analysis is verified on Dolibarr 18 to 23.

The user documentation is available at doc.cap-rel.fr/doliscan-dolibarr.