diff --git a/.env.example b/.env.example index 72aafd007a..e77fb5f11f 100644 --- a/.env.example +++ b/.env.example @@ -173,3 +173,4 @@ IMPORT_MEMORY_LIMIT=500M REPORT_TIME_LIMIT=12000 REQUIRE_SAML=false API_THROTTLE_PER_MINUTE=120 +CSV_ESCAPE_FORMULAS=true diff --git a/app/Http/Controllers/ReportsController.php b/app/Http/Controllers/ReportsController.php index f3d6924742..78972a46ec 100644 --- a/app/Http/Controllers/ReportsController.php +++ b/app/Http/Controllers/ReportsController.php @@ -411,6 +411,7 @@ class ReportsController extends Controller $customfields = CustomField::get(); $response = new StreamedResponse(function () use ($customfields, $request) { \Log::debug('Starting streamed response'); + \Log::debug('CSV escaping is set to: '.config('app.escape_formulas')); // Open output stream $handle = fopen('php://output', 'w'); @@ -858,7 +859,17 @@ class ReportsController extends Controller $row[] = $asset->$column_name; } } - fputcsv($handle, $formatter->escapeRecord($row)); + + + // CSV_ESCAPE_FORMULAS is set to false in the .env + if (config('app.escape_formulas') === false) { + fputcsv($handle, $row); + + // CSV_ESCAPE_FORMULAS is set to true or is not set in the .env + } else { + fputcsv($handle, $formatter->escapeRecord($row)); + } + $executionTime = microtime(true) - $_SERVER['REQUEST_TIME_FLOAT']; \Log::debug('-- Record '.$count.' Asset ID:'.$asset->id.' in '.$executionTime); } diff --git a/config/app.php b/config/app.php index c3627ddea6..8833ea2ae7 100755 --- a/config/app.php +++ b/config/app.php @@ -394,7 +394,7 @@ return [ 'allow_purge' => env('ALLOW_DATA_PURGE', false), - /* + /* |-------------------------------------------------------------------------- | Allow Backup Deletion |-------------------------------------------------------------------------- @@ -405,4 +405,20 @@ return [ 'allow_backup_delete' => env('ALLOW_BACKUP_DELETE', false), + + /* + |-------------------------------------------------------------------------- + | Escape Excel formulas in CSV exports + |-------------------------------------------------------------------------- + | + | This determins whether or not we should escape Excel formulas in CSV exports. + | This can be UNSAFE in untrusted environments, and therefore defaults to true + | so that Excel forumals WILL be escaped in CSV exports, however if your workflow + | is designed around using formulas in your fields, you + | you can set CSV_ESCAPE_FORMULAS to 'false' in your .env. + | + */ + + 'escape_formulas' => env('CSV_ESCAPE_FORMULAS', true), + ];