From 236f6ad23bf07af1ab88573195791d464483d1f9 Mon Sep 17 00:00:00 2001 From: Christian Foellmann Date: Mon, 27 Jun 2022 13:11:31 +0200 Subject: [PATCH 1/4] fix fetching mode_reglement default from soc/comm on propal creation --- htdocs/comm/propal/card.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/comm/propal/card.php b/htdocs/comm/propal/card.php index b40092abfaa..723453dd073 100644 --- a/htdocs/comm/propal/card.php +++ b/htdocs/comm/propal/card.php @@ -1655,7 +1655,7 @@ if ($action == 'create') { // Mode of payment print ''.$langs->trans('PaymentMode').''; print img_picto('', 'bank').' '; - $form->select_types_paiements((GETPOSTISSET('mode_reglement_id') ? GETPOST('mode_reglement_id', 'int') : $soc->mode_reglement_id), 'mode_reglement_id', 'CRDT', 0, 1, 0, 0, 1, 'maxwidth200 widthcentpercentminusx'); + $form->select_types_paiements((GETPOSTISSET('mode_reglement_id') && GETPOST('mode_reglement_id') != 0 ? GETPOST('mode_reglement_id', 'int') : $soc->mode_reglement_id), 'mode_reglement_id', 'CRDT', 0, 1, 0, 0, 1, 'maxwidth200 widthcentpercentminusx'); print ''; // Bank Account From 3e0bc05eddce7ac5b705ff74d38fb8e8b4e06fd7 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 27 Jun 2022 17:34:25 +0200 Subject: [PATCH 2/4] Update card.php --- htdocs/comm/propal/card.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/comm/propal/card.php b/htdocs/comm/propal/card.php index 723453dd073..e4213f64228 100644 --- a/htdocs/comm/propal/card.php +++ b/htdocs/comm/propal/card.php @@ -1655,7 +1655,7 @@ if ($action == 'create') { // Mode of payment print ''.$langs->trans('PaymentMode').''; print img_picto('', 'bank').' '; - $form->select_types_paiements((GETPOSTISSET('mode_reglement_id') && GETPOST('mode_reglement_id') != 0 ? GETPOST('mode_reglement_id', 'int') : $soc->mode_reglement_id), 'mode_reglement_id', 'CRDT', 0, 1, 0, 0, 1, 'maxwidth200 widthcentpercentminusx'); + $form->select_types_paiements((GETPOSTISSET('mode_reglement_id') && (GETPOST('mode_reglement_id') != 0 ? GETPOST('mode_reglement_id', 'int') : $soc->mode_reglement_id)), 'mode_reglement_id', 'CRDT', 0, 1, 0, 0, 1, 'maxwidth200 widthcentpercentminusx'); print ''; // Bank Account From bea16a5256c66584259639eebf1c20891fef0780 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 28 Jun 2022 14:50:43 +0200 Subject: [PATCH 3/4] Fix SEPA file with special chars --- .../class/bonprelevement.class.php | 174 +++++++++--------- 1 file changed, 87 insertions(+), 87 deletions(-) diff --git a/htdocs/compta/prelevement/class/bonprelevement.class.php b/htdocs/compta/prelevement/class/bonprelevement.class.php index 8cfdcf7e02b..d87317e2420 100644 --- a/htdocs/compta/prelevement/class/bonprelevement.class.php +++ b/htdocs/compta/prelevement/class/bonprelevement.class.php @@ -1488,7 +1488,7 @@ class BonPrelevement extends CommonObject fputs($this->file, ' '.$i.''.$CrLf); fputs($this->file, ' '.$this->total.''.$CrLf); fputs($this->file, ' '.$CrLf); - fputs($this->file, ' '.dolEscapeXML(strtoupper(dol_string_nospecial(dol_string_unaccent($this->raison_sociale), ''))).''.$CrLf); + fputs($this->file, ' '.dolEscapeXML(strtoupper(dol_string_nospecial(dol_string_unaccent($this->raison_sociale), ' '))).''.$CrLf); fputs($this->file, ' '.$CrLf); fputs($this->file, ' '.$CrLf); fputs($this->file, ' '.$CrLf); @@ -1604,7 +1604,7 @@ class BonPrelevement extends CommonObject fputs($this->file, ' '.$i.''.$CrLf); fputs($this->file, ' '.$this->total.''.$CrLf); fputs($this->file, ' '.$CrLf); - fputs($this->file, ' '.dolEscapeXML(strtoupper(dol_string_nospecial(dol_string_unaccent($this->raison_sociale), ''))).''.$CrLf); + fputs($this->file, ' '.dolEscapeXML(strtoupper(dol_string_nospecial(dol_string_unaccent($this->raison_sociale), ' '))).''.$CrLf); fputs($this->file, ' '.$CrLf); fputs($this->file, ' '.$CrLf); fputs($this->file, ' '.$CrLf); @@ -1854,16 +1854,16 @@ class BonPrelevement extends CommonObject $XML_DEBITOR .= ' '.$CrLf; $XML_DEBITOR .= ' '.$CrLf; $XML_DEBITOR .= ' '.$CrLf; - $XML_DEBITOR .= ' '.dolEscapeXML(strtoupper(dol_string_nospecial(dol_string_unaccent($row_nom), ''))).''.$CrLf; + $XML_DEBITOR .= ' '.dolEscapeXML(strtoupper(dol_string_nospecial(dol_string_unaccent($row_nom), ' '))).''.$CrLf; $XML_DEBITOR .= ' '.$CrLf; $XML_DEBITOR .= ' '.$row_country_code.''.$CrLf; $addressline1 = strtr($row_address, array(CHR(13) => ", ", CHR(10) => "")); $addressline2 = strtr($row_zip.(($row_zip && $row_town) ? ' ' : ''.$row_town), array(CHR(13) => ", ", CHR(10) => "")); if (trim($addressline1)) { - $XML_DEBITOR .= ' '.dolEscapeXML(dol_trunc(dol_string_nospecial(dol_string_unaccent($addressline1), ''), 70, 'right', 'UTF-8', 1)).''.$CrLf; + $XML_DEBITOR .= ' '.dolEscapeXML(dol_trunc(dol_string_nospecial(dol_string_unaccent($addressline1), ' '), 70, 'right', 'UTF-8', 1)).''.$CrLf; } if (trim($addressline2)) { - $XML_DEBITOR .= ' '.dolEscapeXML(dol_trunc(dol_string_nospecial(dol_string_unaccent($addressline2), ''), 70, 'right', 'UTF-8', 1)).''.$CrLf; + $XML_DEBITOR .= ' '.dolEscapeXML(dol_trunc(dol_string_nospecial(dol_string_unaccent($addressline2), ' '), 70, 'right', 'UTF-8', 1)).''.$CrLf; } $XML_DEBITOR .= ' '.$CrLf; $XML_DEBITOR .= ' '.$CrLf; @@ -1908,14 +1908,14 @@ class BonPrelevement extends CommonObject $XML_CREDITOR .= ' '.round($row_somme, 2).''.$CrLf; $XML_CREDITOR .= ' '.$CrLf; /* - $XML_CREDITOR .= ' '.$CrLf; - $XML_CREDITOR .= ' '.$CrLf; - $XML_CREDITOR .= ' '.$Rum.''.$CrLf; - $XML_CREDITOR .= ' '.$DtOfSgntr.''.$CrLf; - $XML_CREDITOR .= ' false'.$CrLf; - $XML_CREDITOR .= ' '.$CrLf; - $XML_CREDITOR .= ' '.$CrLf; - */ + $XML_CREDITOR .= ' '.$CrLf; + $XML_CREDITOR .= ' '.$CrLf; + $XML_CREDITOR .= ' '.$Rum.''.$CrLf; + $XML_CREDITOR .= ' '.$DtOfSgntr.''.$CrLf; + $XML_CREDITOR .= ' false'.$CrLf; + $XML_CREDITOR .= ' '.$CrLf; + $XML_CREDITOR .= ' '.$CrLf; + */ //$XML_CREDITOR .= ' SLEV'.$CrLf; $XML_CREDITOR .= ' '.$CrLf; $XML_CREDITOR .= ' '.$CrLf; @@ -1923,16 +1923,16 @@ class BonPrelevement extends CommonObject $XML_CREDITOR .= ' '.$CrLf; $XML_CREDITOR .= ' '.$CrLf; $XML_CREDITOR .= ' '.$CrLf; - $XML_CREDITOR .= ' '.dolEscapeXML(strtoupper(dol_string_nospecial(dol_string_unaccent($row_nom)))).''.$CrLf; + $XML_CREDITOR .= ' '.dolEscapeXML(strtoupper(dol_string_nospecial(dol_string_unaccent($row_nom), ' '))).''.$CrLf; $XML_CREDITOR .= ' '.$CrLf; $XML_CREDITOR .= ' '.$row_country_code.''.$CrLf; $addressline1 = strtr($row_address, array(CHR(13) => ", ", CHR(10) => "")); $addressline2 = strtr($row_zip.(($row_zip && $row_town) ? ' ' : ''.$row_town), array(CHR(13) => ", ", CHR(10) => "")); if (trim($addressline1)) { - $XML_CREDITOR .= ' '.dolEscapeXML(dol_trunc(dol_string_nospecial(dol_string_unaccent($addressline1), ''), 70, 'right', 'UTF-8', 1)).''.$CrLf; + $XML_CREDITOR .= ' '.dolEscapeXML(dol_trunc(dol_string_nospecial(dol_string_unaccent($addressline1), ' '), 70, 'right', 'UTF-8', 1)).''.$CrLf; } if (trim($addressline2)) { - $XML_CREDITOR .= ' '.dolEscapeXML(dol_trunc(dol_string_nospecial(dol_string_unaccent($addressline2), ''), 70, 'right', 'UTF-8', 1)).''.$CrLf; + $XML_CREDITOR .= ' '.dolEscapeXML(dol_trunc(dol_string_nospecial(dol_string_unaccent($addressline2), ' '), 70, 'right', 'UTF-8', 1)).''.$CrLf; } $XML_CREDITOR .= ' '.$CrLf; $XML_CREDITOR .= ' '.$CrLf; @@ -2096,16 +2096,16 @@ class BonPrelevement extends CommonObject $XML_SEPA_INFO .= ' '.$CrLf; $XML_SEPA_INFO .= ' '.$dateTime_ETAD.''.$CrLf; $XML_SEPA_INFO .= ' '.$CrLf; - $XML_SEPA_INFO .= ' '.dolEscapeXML(strtoupper(dol_string_nospecial(dol_string_unaccent($this->raison_sociale), ''))).''.$CrLf; + $XML_SEPA_INFO .= ' '.dolEscapeXML(strtoupper(dol_string_nospecial(dol_string_unaccent($this->raison_sociale), ' '))).''.$CrLf; $XML_SEPA_INFO .= ' '.$CrLf; $XML_SEPA_INFO .= ' '.$country[1].''.$CrLf; $addressline1 = strtr($configuration->global->MAIN_INFO_SOCIETE_ADDRESS, array(CHR(13) => ", ", CHR(10) => "")); $addressline2 = strtr($configuration->global->MAIN_INFO_SOCIETE_ZIP.(($configuration->global->MAIN_INFO_SOCIETE_ZIP || ' '.$configuration->global->MAIN_INFO_SOCIETE_TOWN) ? ' ' : '').$configuration->global->MAIN_INFO_SOCIETE_TOWN, array(CHR(13) => ", ", CHR(10) => "")); if ($addressline1) { - $XML_SEPA_INFO .= ' '.dolEscapeXML(dol_trunc(dol_string_nospecial(dol_string_unaccent($addressline1), ''), 70, 'right', 'UTF-8', 1)).''.$CrLf; + $XML_SEPA_INFO .= ' '.dolEscapeXML(dol_trunc(dol_string_nospecial(dol_string_unaccent($addressline1), ' '), 70, 'right', 'UTF-8', 1)).''.$CrLf; } if ($addressline2) { - $XML_SEPA_INFO .= ' '.dolEscapeXML(dol_trunc(dol_string_nospecial(dol_string_unaccent($addressline2), ''), 70, 'right', 'UTF-8', 1)).''.$CrLf; + $XML_SEPA_INFO .= ' '.dolEscapeXML(dol_trunc(dol_string_nospecial(dol_string_unaccent($addressline2), ' '), 70, 'right', 'UTF-8', 1)).''.$CrLf; } $XML_SEPA_INFO .= ' '.$CrLf; $XML_SEPA_INFO .= ' '.$CrLf; @@ -2120,11 +2120,11 @@ class BonPrelevement extends CommonObject $XML_SEPA_INFO .= ' '.$CrLf; $XML_SEPA_INFO .= ' '.$CrLf; /* $XML_SEPA_INFO .= ' '.$CrLf; - $XML_SEPA_INFO .= ' '.dolEscapeXML(strtoupper(dol_string_nospecial(dol_string_unaccent($this->raison_sociale)))).''.$CrLf; + $XML_SEPA_INFO .= ' '.dolEscapeXML(strtoupper(dol_string_nospecial(dol_string_unaccent($this->raison_sociale), ' '))).''.$CrLf; $XML_SEPA_INFO .= ' '.$CrLf; $XML_SEPA_INFO .= ' '.$country[1].''.$CrLf; - $XML_SEPA_INFO .= ' '.dolEscapeXML(dol_string_nospecial(dol_string_unaccent($conf->global->MAIN_INFO_SOCIETE_ADDRESS), '')).''.$CrLf; - $XML_SEPA_INFO .= ' '.dolEscapeXML(dol_string_nospecial(dol_string_unaccent($conf->global->MAIN_INFO_SOCIETE_ZIP.' '.$conf->global->MAIN_INFO_SOCIETE_TOWN), '')).''.$CrLf; + $XML_SEPA_INFO .= ' '.dolEscapeXML(dol_string_nospecial(dol_string_unaccent($conf->global->MAIN_INFO_SOCIETE_ADDRESS), ' ')).''.$CrLf; + $XML_SEPA_INFO .= ' '.dolEscapeXML(dol_string_nospecial(dol_string_unaccent($conf->global->MAIN_INFO_SOCIETE_ZIP.' '.$conf->global->MAIN_INFO_SOCIETE_TOWN), ' ')).''.$CrLf; $XML_SEPA_INFO .= ' '.$CrLf; $XML_SEPA_INFO .= ' '.$CrLf;*/ $XML_SEPA_INFO .= ' SLEV'.$CrLf; // Field "Responsible of fees". Must be SLEV @@ -2162,16 +2162,16 @@ class BonPrelevement extends CommonObject } $XML_SEPA_INFO .= ' '.dol_print_date($dateTime_ETAD, 'dayrfc').''.$CrLf; $XML_SEPA_INFO .= ' '.$CrLf; - $XML_SEPA_INFO .= ' '.dolEscapeXML(strtoupper(dol_string_nospecial(dol_string_unaccent($this->raison_sociale), ''))).''.$CrLf; + $XML_SEPA_INFO .= ' '.dolEscapeXML(strtoupper(dol_string_nospecial(dol_string_unaccent($this->raison_sociale), ' '))).''.$CrLf; $XML_SEPA_INFO .= ' '.$CrLf; $XML_SEPA_INFO .= ' '.$country[1].''.$CrLf; $addressline1 = strtr($configuration->global->MAIN_INFO_SOCIETE_ADDRESS, array(CHR(13) => ", ", CHR(10) => "")); $addressline2 = strtr($configuration->global->MAIN_INFO_SOCIETE_ZIP.(($configuration->global->MAIN_INFO_SOCIETE_ZIP || ' '.$configuration->global->MAIN_INFO_SOCIETE_TOWN) ? ' ' : '').$configuration->global->MAIN_INFO_SOCIETE_TOWN, array(CHR(13) => ", ", CHR(10) => "")); if ($addressline1) { - $XML_SEPA_INFO .= ' '.dolEscapeXML(dol_trunc(dol_string_nospecial(dol_string_unaccent($addressline1), ''), 70, 'right', 'UTF-8', 1)).''.$CrLf; + $XML_SEPA_INFO .= ' '.dolEscapeXML(dol_trunc(dol_string_nospecial(dol_string_unaccent($addressline1), ' '), 70, 'right', 'UTF-8', 1)).''.$CrLf; } if ($addressline2) { - $XML_SEPA_INFO .= ' '.dolEscapeXML(dol_trunc(dol_string_nospecial(dol_string_unaccent($addressline2), ''), 70, 'right', 'UTF-8', 1)).''.$CrLf; + $XML_SEPA_INFO .= ' '.dolEscapeXML(dol_trunc(dol_string_nospecial(dol_string_unaccent($addressline2), ' '), 70, 'right', 'UTF-8', 1)).''.$CrLf; } $XML_SEPA_INFO .= ' '.$CrLf; $XML_SEPA_INFO .= ' '.$CrLf; @@ -2186,26 +2186,26 @@ class BonPrelevement extends CommonObject $XML_SEPA_INFO .= ' '.$CrLf; $XML_SEPA_INFO .= ' '.$CrLf; /* $XML_SEPA_INFO .= ' '.$CrLf; - $XML_SEPA_INFO .= ' '.dolEscapeXML(strtoupper(dol_string_nospecial(dol_string_unaccent($this->raison_sociale)))).''.$CrLf; + $XML_SEPA_INFO .= ' '.dolEscapeXML(strtoupper(dol_string_nospecial(dol_string_unaccent($this->raison_sociale), ' '))).''.$CrLf; $XML_SEPA_INFO .= ' '.$CrLf; $XML_SEPA_INFO .= ' '.$country[1].''.$CrLf; - $XML_SEPA_INFO .= ' '.dolEscapeXML(dol_string_nospecial(dol_string_unaccent($conf->global->MAIN_INFO_SOCIETE_ADDRESS), '')).''.$CrLf; - $XML_SEPA_INFO .= ' '.dolEscapeXML(dol_string_nospecial(dol_string_unaccent($conf->global->MAIN_INFO_SOCIETE_ZIP.' '.$conf->global->MAIN_INFO_SOCIETE_TOWN), '')).''.$CrLf; + $XML_SEPA_INFO .= ' '.dolEscapeXML(dol_string_nospecial(dol_string_unaccent($conf->global->MAIN_INFO_SOCIETE_ADDRESS), ' ')).''.$CrLf; + $XML_SEPA_INFO .= ' '.dolEscapeXML(dol_string_nospecial(dol_string_unaccent($conf->global->MAIN_INFO_SOCIETE_ZIP.' '.$conf->global->MAIN_INFO_SOCIETE_TOWN), ' ')).''.$CrLf; $XML_SEPA_INFO .= ' '.$CrLf; $XML_SEPA_INFO .= ' '.$CrLf;*/ $XML_SEPA_INFO .= ' SLEV'.$CrLf; // Field "Responsible of fees". Must be SLEV /*$XML_SEPA_INFO .= ' '.$CrLf; - $XML_SEPA_INFO .= ' '.$CrLf; - $XML_SEPA_INFO .= ' '.$CrLf; - $XML_SEPA_INFO .= ' '.$CrLf; - $XML_SEPA_INFO .= ' '.$this->emetteur_ics.''.$CrLf; - $XML_SEPA_INFO .= ' '.$CrLf; - $XML_SEPA_INFO .= ' SEPA'.$CrLf; - $XML_SEPA_INFO .= ' '.$CrLf; - $XML_SEPA_INFO .= ' '.$CrLf; - $XML_SEPA_INFO .= ' '.$CrLf; - $XML_SEPA_INFO .= ' '.$CrLf; - $XML_SEPA_INFO .= ' '.$CrLf;*/ + $XML_SEPA_INFO .= ' '.$CrLf; + $XML_SEPA_INFO .= ' '.$CrLf; + $XML_SEPA_INFO .= ' '.$CrLf; + $XML_SEPA_INFO .= ' '.$this->emetteur_ics.''.$CrLf; + $XML_SEPA_INFO .= ' '.$CrLf; + $XML_SEPA_INFO .= ' SEPA'.$CrLf; + $XML_SEPA_INFO .= ' '.$CrLf; + $XML_SEPA_INFO .= ' '.$CrLf; + $XML_SEPA_INFO .= ' '.$CrLf; + $XML_SEPA_INFO .= ' '.$CrLf; + $XML_SEPA_INFO .= ' '.$CrLf;*/ } } else { fputs($this->file, 'INCORRECT EMETTEUR '.$XML_SEPA_INFO.$CrLf); @@ -2343,59 +2343,59 @@ class BonPrelevement extends CommonObject } /* - if ($mode == 'direct_debit') { - $sql = "SELECT b.rowid, f.datedue as datefin"; - $sql .= " FROM ".MAIN_DB_PREFIX."facture as f"; - $sql .= " WHERE f.entity IN (".getEntity('facture').")"; - $sql .= " AND f.total_ttc > 0"; - } else { - $sql = "SELECT b.rowid, f.datedue as datefin"; - $sql .= " FROM ".MAIN_DB_PREFIX."facture_fourn as f"; - $sql .= " WHERE f.entity IN (".getEntity('facture_fourn').")"; - $sql .= " AND f.total_ttc > 0"; - } + if ($mode == 'direct_debit') { + $sql = "SELECT b.rowid, f.datedue as datefin"; + $sql .= " FROM ".MAIN_DB_PREFIX."facture as f"; + $sql .= " WHERE f.entity IN (".getEntity('facture').")"; + $sql .= " AND f.total_ttc > 0"; + } else { + $sql = "SELECT b.rowid, f.datedue as datefin"; + $sql .= " FROM ".MAIN_DB_PREFIX."facture_fourn as f"; + $sql .= " WHERE f.entity IN (".getEntity('facture_fourn').")"; + $sql .= " AND f.total_ttc > 0"; + } - $resql = $this->db->query($sql); - if ($resql) { - $langs->load("banks"); - $now = dol_now(); + $resql = $this->db->query($sql); + if ($resql) { + $langs->load("banks"); + $now = dol_now(); - $response = new WorkboardResponse(); - if ($mode == 'direct_debit') { - $response->warning_delay = $conf->prelevement->warning_delay / 60 / 60 / 24; - $response->label = $langs->trans("PendingDirectDebitToComplete"); - $response->labelShort = $langs->trans("PendingDirectDebitToCompleteShort"); - $response->url = DOL_URL_ROOT.'/compta/prelevement/index.php?leftmenu=checks&mainmenu=bank'; - } else { - $response->warning_delay = $conf->paymentbybanktransfer->warning_delay / 60 / 60 / 24; - $response->label = $langs->trans("PendingCreditTransferToComplete"); - $response->labelShort = $langs->trans("PendingCreditTransferToCompleteShort"); - $response->url = DOL_URL_ROOT.'/compta/paymentbybanktransfer/index.php?leftmenu=checks&mainmenu=bank'; - } - $response->img = img_object('', "payment"); + $response = new WorkboardResponse(); + if ($mode == 'direct_debit') { + $response->warning_delay = $conf->prelevement->warning_delay / 60 / 60 / 24; + $response->label = $langs->trans("PendingDirectDebitToComplete"); + $response->labelShort = $langs->trans("PendingDirectDebitToCompleteShort"); + $response->url = DOL_URL_ROOT.'/compta/prelevement/index.php?leftmenu=checks&mainmenu=bank'; + } else { + $response->warning_delay = $conf->paymentbybanktransfer->warning_delay / 60 / 60 / 24; + $response->label = $langs->trans("PendingCreditTransferToComplete"); + $response->labelShort = $langs->trans("PendingCreditTransferToCompleteShort"); + $response->url = DOL_URL_ROOT.'/compta/paymentbybanktransfer/index.php?leftmenu=checks&mainmenu=bank'; + } + $response->img = img_object('', "payment"); - while ($obj = $this->db->fetch_object($resql)) { - $response->nbtodo++; + while ($obj = $this->db->fetch_object($resql)) { + $response->nbtodo++; - if ($this->db->jdate($obj->datefin) < ($now - $conf->withdraw->warning_delay)) { - $response->nbtodolate++; - } - } + if ($this->db->jdate($obj->datefin) < ($now - $conf->withdraw->warning_delay)) { + $response->nbtodolate++; + } + } - $response->nbtodo = 0; - $response->nbtodolate = 0; - // Return workboard only if quantity is not 0 - if ($response->nbtodo) { - return $response; - } else { - return 0; - } - } else { - dol_print_error($this->db); - $this->error = $this->db->error(); - return -1; - } - */ + $response->nbtodo = 0; + $response->nbtodolate = 0; + // Return workboard only if quantity is not 0 + if ($response->nbtodo) { + return $response; + } else { + return 0; + } + } else { + dol_print_error($this->db); + $this->error = $this->db->error(); + return -1; + } + */ return 0; } } From cbaa8b4304c7f725af4d90be3233c21aa0046b37 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Wed, 29 Jun 2022 16:40:19 +0200 Subject: [PATCH 4/4] FIX False alert of WAF when there is "set" into some URL action=update. --- htdocs/main.inc.php | 2 +- test/phpunit/SecurityTest.php | 10 +++++++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php index 1d09b9f9887..b97312859b9 100644 --- a/htdocs/main.inc.php +++ b/htdocs/main.inc.php @@ -130,7 +130,7 @@ function testSqlAndScriptInject($val, $type) $inj += preg_match('/user\s*\(/i', $val); // avoid to use function user() or mysql_user() that return current database login $inj += preg_match('/information_schema/i', $val); // avoid to use request that read information_schema database $inj += preg_match('/assertEquals($expectedresult, $result, 'Error on testSqlAndScriptInject for SQL1b. Should find an attack on GET param and did not.'); + $test = '... update ... set ... ='; + $result=testSqlAndScriptInject($test, 1); + $this->assertEquals($expectedresult, $result, 'Error on testSqlAndScriptInject for SQL2a. Should find an attack on GET param and did not.'); + + $test = 'action=update& ... set ... ='; + $result=testSqlAndScriptInject($test, 1); + $this->assertEquals(0, $result, 'Error on testSqlAndScriptInject for SQL2b. Should not find an attack on GET param and did.'); + $test = '... union ... selection '; $result=testSqlAndScriptInject($test, 1); - $this->assertEquals($expectedresult, $result, 'Error on testSqlAndScriptInject for SQL2. Should find an attack on GET param and did not.'); + $this->assertEquals($expectedresult, $result, 'Error on testSqlAndScriptInject for SQL2c. Should find an attack on GET param and did not.'); $test = 'javascript:'; $result=testSqlAndScriptInject($test, 0);