lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Escape all status

Browse Source
This commit is contained in:
Laurent Destailleur 2017-09-08 13:23:12 +02:00
parent 835cd43565
commit 03fe9d4e97
13 changed files with 51 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
htdocs/adherents/type.php
View File

@ -390,13 +390,13 @@ if ($rowid > 0)
} }
if ($status != '') if ($status != '')
{ {
$sql.= " AND d.statut IN (".$status.")"; // Peut valoir un nombre ou liste de nombre separes par virgules $sql.= " AND d.statut IN (".$db->escape($status).")"; // Peut valoir un nombre ou liste de nombre separes par virgules
} }
if ($action == 'search') if ($action == 'search')
{ {
if (GETPOST('search')) if (GETPOST('search'))
{ {
$sql.= natural_search(array("d.firstname","d.lastname"), GETPOST('search')); $sql.= natural_search(array("d.firstname","d.lastname"), GETPOST('search','alpha'));
} }
} }
if (! empty($search_lastname)) if (! empty($search_lastname))

10
htdocs/comm/mailing/class/advtargetemailing.class.php
View File

@ -640,16 +640,16 @@ class AdvanceTargetingMailing extends CommonObject
$sqlwhere[]=$this->transformToSQL('t.firstname',$arrayquery['contact_firstname']); $sqlwhere[]=$this->transformToSQL('t.firstname',$arrayquery['contact_firstname']);
} }
if (!empty($arrayquery['contact_country']) && count($arrayquery['contact_country'])) { if (!empty($arrayquery['contact_country']) && count($arrayquery['contact_country'])) {
$sqlwhere[]= " (t.fk_pays IN (".implode(',',$arrayquery['contact_country'])."))"; $sqlwhere[]= " (t.fk_pays IN (".$db->escape(implode(',',$arrayquery['contact_country']))."))";
} }
if (!empty($arrayquery['contact_status']) && count($arrayquery['contact_status'])>0) { if (!empty($arrayquery['contact_status']) && count($arrayquery['contact_status'])>0) {
$sqlwhere[]= " (t.statut IN (".implode(',',$arrayquery['contact_status'])."))"; $sqlwhere[]= " (t.statut IN (".$db->escape(implode(',',$arrayquery['contact_status']))."))";
} }
if (!empty($arrayquery['contact_civility']) && count($arrayquery['contact_civility'])>0) { if (!empty($arrayquery['contact_civility']) && count($arrayquery['contact_civility'])>0) {
$sqlwhere[]= " (t.civility IN ('".implode("','",$arrayquery['contact_civility'])."'))"; $sqlwhere[]= " (t.civility IN ('".$db->escape(implode("','",$arrayquery['contact_civility']))."'))";
} }
if ($arrayquery['contact_no_email']!='') { if ($arrayquery['contact_no_email']!='') {
$sqlwhere[]= " (t.no_email='".$arrayquery['contact_no_email']."')"; $sqlwhere[]= " (t.no_email='".$db->escape($arrayquery['contact_no_email'])."')";
} }
if ($arrayquery['contact_update_st_dt']!='') { if ($arrayquery['contact_update_st_dt']!='') {
$sqlwhere[]= " (t.tms >= '".$this->db->idate($arrayquery['contact_update_st_dt'])."' AND t.tms <= '".$this->db->idate($arrayquery['contact_update_end_dt'])."')"; $sqlwhere[]= " (t.tms >= '".$this->db->idate($arrayquery['contact_update_st_dt'])."' AND t.tms <= '".$this->db->idate($arrayquery['contact_update_end_dt'])."')";
@ -658,7 +658,7 @@ class AdvanceTargetingMailing extends CommonObject
$sqlwhere[]= " (t.datec >= '".$this->db->idate($arrayquery['contact_create_st_dt'])."' AND t.datec <= '".$this->db->idate($arrayquery['contact_create_end_dt'])."')"; $sqlwhere[]= " (t.datec >= '".$this->db->idate($arrayquery['contact_create_st_dt'])."' AND t.datec <= '".$this->db->idate($arrayquery['contact_create_end_dt'])."')";
} }
if (!empty($arrayquery['contact_categ']) && count($arrayquery['contact_categ'])>0) { if (!empty($arrayquery['contact_categ']) && count($arrayquery['contact_categ'])>0) {
$sqlwhere[]= " (contactcateg.fk_categorie IN (".implode(",",$arrayquery['contact_categ'])."))"; $sqlwhere[]= " (contactcateg.fk_categorie IN (".$db->escape(implode(",",$arrayquery['contact_categ']))."))";
} }
//Standard Extrafield feature //Standard Extrafield feature

2
htdocs/comm/propal/stats/index.php
View File

@ -92,7 +92,7 @@ dol_mkdir($dir);
$stats = new PropaleStats($db, $socid, ($userid>0?$userid:0), $mode); $stats = new PropaleStats($db, $socid, ($userid>0?$userid:0), $mode);
if ($object_status != '' && $object_status >= 0) $stats->where .= ' AND p.fk_statut IN ('.$object_status.')'; if ($object_status != '' && $object_status >= 0) $stats->where .= ' AND p.fk_statut IN ('.$db->escape($object_status).')';
// Build graphic number of object // Build graphic number of object
$data = $stats->getNbByMonthWithPrevYear($endyear,$startyear); $data = $stats->getNbByMonthWithPrevYear($endyear,$startyear);

4
htdocs/commande/stats/index.php
View File

@ -88,11 +88,11 @@ dol_mkdir($dir);
$stats = new CommandeStats($db, $socid, $mode, ($userid>0?$userid:0)); $stats = new CommandeStats($db, $socid, $mode, ($userid>0?$userid:0));
if ($mode == 'customer') if ($mode == 'customer')
{ {
if ($object_status != '' && $object_status >= -1) $stats->where .= ' AND c.fk_statut IN ('.$object_status.')'; if ($object_status != '' && $object_status >= -1) $stats->where .= ' AND c.fk_statut IN ('.$db->escape($object_status).')';
} }
if ($mode == 'supplier') if ($mode == 'supplier')
{ {
if ($object_status != '' && $object_status >= 0) $stats->where .= ' AND c.fk_statut IN ('.$object_status.')'; if ($object_status != '' && $object_status >= 0) $stats->where .= ' AND c.fk_statut IN ('.$db->escape($object_status).')';
} }

4
htdocs/compta/facture/stats/index.php
View File

@ -84,11 +84,11 @@ dol_mkdir($dir);
$stats = new FactureStats($db, $socid, $mode, ($userid>0?$userid:0)); $stats = new FactureStats($db, $socid, $mode, ($userid>0?$userid:0));
if ($mode == 'customer') if ($mode == 'customer')
{ {
if ($object_status != '' && $object_status >= -1) $stats->where .= ' AND f.fk_statut IN ('.$object_status.')'; if ($object_status != '' && $object_status >= -1) $stats->where .= ' AND f.fk_statut IN ('.$db->escape($object_status).')';
} }
if ($mode == 'supplier') if ($mode == 'supplier')
{ {
if ($object_status != '' && $object_status >= 0) $stats->where .= ' AND f.fk_statut IN ('.$object_status.')'; if ($object_status != '' && $object_status >= 0) $stats->where .= ' AND f.fk_statut IN ('.$db->escape($object_status).')';
} }
// Build graphic number of object // Build graphic number of object

2
htdocs/core/class/html.form.class.php
View File

@ -1918,7 +1918,7 @@ class Form
$sql.= ' WHERE p.entity IN ('.getEntity('product').')'; $sql.= ' WHERE p.entity IN ('.getEntity('product').')';
if (count($warehouseStatusArray)) if (count($warehouseStatusArray))
{ {
$sql.= ' AND (p.fk_product_type = 1 OR e.statut IN ('.implode(',',$warehouseStatusArray).'))'; $sql.= ' AND (p.fk_product_type = 1 OR e.statut IN ('.$db->escape(implode(',',$warehouseStatusArray)).'))';
} }
if (!empty($conf->global->PRODUIT_ATTRIBUTES_HIDECHILD)) { if (!empty($conf->global->PRODUIT_ATTRIBUTES_HIDECHILD)) {

4
htdocs/don/list.php
View File

@ -92,11 +92,11 @@ $sql.= " FROM ".MAIN_DB_PREFIX."don as d LEFT JOIN ".MAIN_DB_PREFIX."projet AS p
$sql.= " ON p.rowid = d.fk_projet WHERE 1 = 1"; $sql.= " ON p.rowid = d.fk_projet WHERE 1 = 1";
if ($statut != '' && $statut != '-1') if ($statut != '' && $statut != '-1')
{ {
$sql .= " AND d.fk_statut IN (".$statut.")"; $sql .= " AND d.fk_statut IN (".$db->escape($statut).")";
} }
if (trim($search_ref) != '') if (trim($search_ref) != '')
{ {
$sql.= natural_search('d.ref',$search_ref); $sql.= natural_search('d.ref', $search_ref);
} }
if (trim($search_all) != '') if (trim($search_all) != '')
{ {

2
htdocs/expensereport/stats/index.php
View File

@ -74,7 +74,7 @@ print load_fiche_titre($title, $mesg);
dol_mkdir($dir); dol_mkdir($dir);
$stats = new ExpenseReportStats($db, $socid, $userid); $stats = new ExpenseReportStats($db, $socid, $userid);
if ($object_status != '' && $object_status >= -1) $stats->where .= ' AND e.fk_statut IN ('.$object_status.')'; if ($object_status != '' && $object_status >= -1) $stats->where .= ' AND e.fk_statut IN ('.$db->escape($object_status).')';
// Build graphic number of object // Build graphic number of object
// $data = array(array('Lib',val1,val2,val3),...) // $data = array(array('Lib',val1,val2,val3),...)

2
htdocs/fichinter/stats/index.php
View File

@ -75,7 +75,7 @@ print load_fiche_titre($title,'','title_commercial.png');
dol_mkdir($dir); dol_mkdir($dir);
$stats = new FichinterStats($db, $socid, $mode, ($userid>0?$userid:0)); $stats = new FichinterStats($db, $socid, $mode, ($userid>0?$userid:0));
if ($object_status != '' && $object_status > -1) $stats->where .= ' AND c.fk_statut IN ('.$object_status.')'; if ($object_status != '' && $object_status > -1) $stats->where .= ' AND c.fk_statut IN ('.$db->escape($object_status).')';
// Build graphic number of object // Build graphic number of object
$data = $stats->getNbByMonthWithPrevYear($endyear,$startyear); $data = $stats->getNbByMonthWithPrevYear($endyear,$startyear);

4
htdocs/fourn/commande/list.php
View File

@ -535,9 +535,9 @@ if ($search_request_author) $sql.=natural_search(array('u.lastname','u.firstname
if ($billed != '' && $billed >= 0) $sql .= " AND cf.billed = ".$billed; if ($billed != '' && $billed >= 0) $sql .= " AND cf.billed = ".$billed;
//Required triple check because statut=0 means draft filter //Required triple check because statut=0 means draft filter
if (GETPOST('statut', 'alpha') !== '') if (GETPOST('statut', 'intcomma') !== '')
{ {
$sql .= " AND cf.fk_statut IN (".$db->escape(GETPOST('statut', 'alpha')).")"; $sql .= " AND cf.fk_statut IN (".$db->escape($db->escape(GETPOST('statut', 'intcomma'))).")";
} }
if ($search_status != '' && $search_status >= 0) if ($search_status != '' && $search_status >= 0)
{ {

4
htdocs/product/class/html.formproduct.class.php
View File

@ -115,14 +115,14 @@ class FormProduct
$sql.= " WHERE e.entity IN (".getEntity('stock').")"; $sql.= " WHERE e.entity IN (".getEntity('stock').")";
if (count($warehouseStatus)) if (count($warehouseStatus))
{ {
$sql.= " AND e.statut IN (".implode(',',$warehouseStatus).")"; $sql.= " AND e.statut IN (".$db->escape(implode(',',$warehouseStatus)).")";
} }
else else
{ {
$sql.= " AND e.statut = 1"; $sql.= " AND e.statut = 1";
} }
if(!empty($exclude)) $sql.= ' AND e.rowid NOT IN('.implode(',', $exclude).')'; if(!empty($exclude)) $sql.= ' AND e.rowid NOT IN('.$db->escape(implode(',', $exclude)).')';
if ($sumStock && empty($fk_product)) $sql.= " GROUP BY e.rowid, e.label, e.description, e.fk_parent"; if ($sumStock && empty($fk_product)) $sql.= " GROUP BY e.rowid, e.label, e.description, e.fk_parent";
$sql.= " ORDER BY e.label"; $sql.= " ORDER BY e.label";

2
htdocs/product/class/product.class.php
View File

@ -3750,7 +3750,7 @@ class Product extends CommonObject
$sql.= " WHERE w.entity IN (".getEntity('stock').")"; $sql.= " WHERE w.entity IN (".getEntity('stock').")";
$sql.= " AND w.rowid = ps.fk_entrepot"; $sql.= " AND w.rowid = ps.fk_entrepot";
$sql.= " AND ps.fk_product = ".$this->id; $sql.= " AND ps.fk_product = ".$this->id;
if ($conf->global->ENTREPOT_EXTRA_STATUS && count($warehouseStatus)) $sql.= " AND w.statut IN (".implode(',',$warehouseStatus).")"; if ($conf->global->ENTREPOT_EXTRA_STATUS && count($warehouseStatus)) $sql.= " AND w.statut IN (".$db->escape(implode(',',$warehouseStatus)).")";
dol_syslog(get_class($this)."::load_stock", LOG_DEBUG); dol_syslog(get_class($this)."::load_stock", LOG_DEBUG);
$result = $this->db->query($sql); $result = $this->db->query($sql);

2
htdocs/supplier_proposal/list.php
View File

@ -284,7 +284,7 @@ if ($search_montant_vat != '') $sql.= natural_search("sp.tva", $search_montant_v
if ($search_montant_ttc != '') $sql.= natural_search("sp.total", $search_montant_ttc, 1); if ($search_montant_ttc != '') $sql.= natural_search("sp.total", $search_montant_ttc, 1);
if ($sall) $sql .= natural_search(array_keys($fieldstosearchall), $sall); if ($sall) $sql .= natural_search(array_keys($fieldstosearchall), $sall);
if ($socid) $sql.= ' AND s.rowid = '.$socid; if ($socid) $sql.= ' AND s.rowid = '.$socid;
if ($search_status >= 0 && $search_status != '') $sql.= ' AND sp.fk_statut IN ('.$search_status.')'; if ($search_status >= 0 && $search_status != '') $sql.= ' AND sp.fk_statut IN ('.$db->escape($search_status).')';
if ($month > 0) if ($month > 0)
{ {
if ($year > 0 && empty($day)) if ($year > 0 && empty($day))