lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Protection against bad parameters

Browse Source
This commit is contained in:
Laurent Destailleur 2009-02-18 20:48:49 +00:00
parent 4940d95e9d
commit 0a8402fe64
3 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
htdocs/commande/commande.class.php
View File

@ -813,6 +813,9 @@ class Commande extends CommonObject
*/ */
function fetch($id,$ref='') function fetch($id,$ref='')
{ {
// Check parameters
if (empty($id) && empty($ref)) return -1;
$sql = 'SELECT c.rowid, c.date_creation, c.ref, c.fk_soc, c.fk_user_author, c.fk_statut'; $sql = 'SELECT c.rowid, c.date_creation, c.ref, c.fk_soc, c.fk_user_author, c.fk_statut';
$sql.= ', c.amount_ht, c.total_ht, c.total_ttc, c.tva as total_tva, c.fk_cond_reglement, c.fk_mode_reglement'; $sql.= ', c.amount_ht, c.total_ht, c.total_ttc, c.tva as total_tva, c.fk_cond_reglement, c.fk_mode_reglement';
$sql.= ', '.$this->db->pdate('c.date_commande').' as date_commande'; $sql.= ', '.$this->db->pdate('c.date_commande').' as date_commande';
@ -829,7 +832,7 @@ class Commande extends CommonObject
if ($ref) $sql.= " WHERE c.ref='".$ref."'"; if ($ref) $sql.= " WHERE c.ref='".$ref."'";
else $sql.= " WHERE c.rowid=".$id; else $sql.= " WHERE c.rowid=".$id;
dolibarr_syslog("Commande::fetch sql=$sql"); dolibarr_syslog("Commande::fetch sql=".$sql, LOG_DEBUG);
$result = $this->db->query($sql) ; $result = $this->db->query($sql) ;
if ($result) if ($result)
{ {

3
htdocs/contrat/contrat.class.php
View File

@ -1490,6 +1490,9 @@ class ContratLigne
{ {
global $langs,$user; global $langs,$user;
// Check parameters
if (empty($id) && empty($ref)) return -1;
$sql = "SELECT"; $sql = "SELECT";
$sql.= " t.rowid,"; $sql.= " t.rowid,";

5
htdocs/public/paybox/newpayment.php
View File

@ -60,6 +60,11 @@ if (is_numeric($amount) && empty($_REQUEST["tag"]))
dolibarr_print_error('','ErrorBadParameters'); dolibarr_print_error('','ErrorBadParameters');
exit; exit;
} }
if (! is_numeric($amount) && empty($_REQUEST["ref"]))
{
dolibarr_print_error('','ErrorBadParameters');
exit;
}