';
-/*
- * Statistics
- */
-
-$sql = "SELECT count(c.rowid) as nb, c.fk_statut as status";
-$sql .= " FROM ".MAIN_DB_PREFIX."societe as s";
-$sql .= ", ".MAIN_DB_PREFIX."commande as c";
-if (!$user->rights->societe->client->voir && !$socid) {
- $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
-}
-$sql .= " WHERE c.fk_soc = s.rowid";
-$sql .= " AND c.entity IN (".getEntity('societe').")";
-if ($user->socid) {
- $sql .= ' AND c.fk_soc = '.$user->socid;
-}
-if (!$user->rights->societe->client->voir && !$socid) {
- $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
-}
-$sql .= " GROUP BY c.fk_statut";
-
-$resql = $db->query($sql);
-if ($resql) {
- $num = $db->num_rows($resql);
- $i = 0;
-
- $total = 0;
- $totalinprocess = 0;
- $dataseries = array();
- $colorseries = array();
- $vals = array();
- // -1=Canceled, 0=Draft, 1=Validated, 2=Accepted/On process, 3=Closed (Sent/Received, billed or not)
- while ($i < $num) {
- $row = $db->fetch_row($resql);
- if ($row) {
- //if ($row[1]!=-1 && ($row[1]!=3 || $row[2]!=1))
- {
- if (!isset($vals[$row[1]])) {
- $vals[$row[1]] = 0;
- }
- $vals[$row[1]] += $row[0];
- $totalinprocess += $row[0];
- }
- $total += $row[0];
- }
- $i++;
- }
- $db->free($resql);
-
- include DOL_DOCUMENT_ROOT.'/theme/'.$conf->theme.'/theme_vars.inc.php';
-
- print '
";
-} else {
- dol_print_error($db);
-}
+print getCustomerOrderPieChart($socid);
+print '
';
/*
diff --git a/htdocs/commande/list.php b/htdocs/commande/list.php
index db6bba130b1..d59983925ce 100644
--- a/htdocs/commande/list.php
+++ b/htdocs/commande/list.php
@@ -359,7 +359,7 @@ if ($search_product_category > 0) {
$sql .= " AND cp.fk_categorie = ".$search_product_category;
}
if ($socid > 0) {
- $sql .= ' AND s.rowid = '.$socid;
+ $sql .= ' AND s.rowid = '.((int) $socid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
@@ -374,7 +374,7 @@ if ($sall) {
$sql .= natural_search(array_keys($fieldstosearchall), $sall);
}
if ($search_billed != '' && $search_billed >= 0) {
- $sql .= ' AND c.facture = '.$search_billed;
+ $sql .= ' AND c.facture = '.((int) $search_billed);
}
if ($search_status <> '') {
if ($search_status < 4 && $search_status > -3) {
diff --git a/htdocs/compta/bank/account_statement_document.php b/htdocs/compta/bank/account_statement_document.php
index 6103df38f66..4f317c1a9ed 100644
--- a/htdocs/compta/bank/account_statement_document.php
+++ b/htdocs/compta/bank/account_statement_document.php
@@ -129,7 +129,7 @@ if (!empty($numref)) {
$object->fetch_thirdparty();
$upload_dir = $conf->bank->dir_output."/".$id."/statement/".dol_sanitizeFileName($numref);
}
-$backtopage = $_SERVER['PHP_SELF']."?account=".$id."&num=".$numref;
+$backtopage = $_SERVER['PHP_SELF']."?account=".urlencode($id)."&num=".urlencode($numref);
include DOL_DOCUMENT_ROOT.'/core/actions_linkedfiles.inc.php';
diff --git a/htdocs/compta/bank/bankentries_list.php b/htdocs/compta/bank/bankentries_list.php
index f6b719515cc..0a9784fce75 100644
--- a/htdocs/compta/bank/bankentries_list.php
+++ b/htdocs/compta/bank/bankentries_list.php
@@ -791,7 +791,7 @@ if ($resql) {
$nbmax = 12; // We show last 12 receipts (so we can have more than one year)
$liste = "";
$sql = "SELECT DISTINCT num_releve FROM ".MAIN_DB_PREFIX."bank";
- $sql .= " WHERE fk_account=".$object->id." AND num_releve IS NOT NULL";
+ $sql .= " WHERE fk_account = ".((int) $object->id)." AND num_releve IS NOT NULL";
$sql .= $db->order("num_releve", "DESC");
$sql .= $db->plimit($nbmax + 1);
print '
';
@@ -967,7 +967,7 @@ if ($resql) {
$moreforfilter = '';
$moreforfilter .= '
';
- $moreforfilter .= $langs->trans('DateValueShort').' : ';
+ $moreforfilter .= $langs->trans('DateValueShort').' ';
$moreforfilter .= ($conf->browser->layout == 'phone' ? '
' : ' ');
$moreforfilter .= '
';
$moreforfilter .= $form->selectDate($search_dv_start, 'search_start_dv', 0, 0, 1, "search_form", 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From')).'
';
@@ -1329,21 +1329,22 @@ if ($resql) {
// Description
if (!empty($arrayfields['b.label']['checked'])) {
- print "
";
-
- //print "rowid."&account=".$objp->fk_account."\">";
+ $labeltoshow = '';
+ $titletoshow = '';
$reg = array();
preg_match('/\((.+)\)/i', $objp->label, $reg); // Si texte entoure de parenthee on tente recherche de traduction
if ($reg[1] && $langs->trans($reg[1]) != $reg[1]) {
- print $langs->trans($reg[1]);
+ $labeltoshow = $langs->trans($reg[1]);
} else {
if ($objp->label == '(payment_salary)') {
- print dol_trunc($langs->trans("SalaryPayment", 40));
+ $labeltoshow = dol_trunc($langs->trans("SalaryPayment", 40));
} else {
- print dol_trunc($objp->label, 40);
+ $labeltoshow = dol_escape_htmltag($objp->label);
+ $titletoshow = $objp->label;
}
}
- //print " ";
+ print ' | ';
+ print $labeltoshow; // Already escaped
// Add links after description
$cachebankaccount = array();
@@ -1498,7 +1499,7 @@ if ($resql) {
// Num cheque
if (!empty($arrayfields['b.num_chq']['checked'])) {
- print ' | '.($objp->num_chq ? $objp->num_chq : "")." | \n";
+ print '
'.($objp->num_chq ? dol_escape_htmltag($objp->num_chq) : "")." | \n";
if (!$i) {
$totalarray['nbfield']++;
}
@@ -1605,7 +1606,8 @@ if ($resql) {
$totalarray['nbfield']++;
}
}
- // Balance
+
+ // Balance after
if (!empty($arrayfields['balance']['checked'])) {
if ($mode_balance_ok) {
if ($balance >= 0) {
@@ -1626,7 +1628,7 @@ if ($resql) {
// Transaction reconciliated or edit link
if ($bankaccount->canBeConciliated() > 0) {
if ($objp->num_releve) {
- print '
'.$objp->num_releve.'';
+ print '
'.dol_escape_htmltag($objp->num_releve).'';
}
if (!$objp->conciliated && $action == 'reconcile') {
if ($objp->num_releve) {
@@ -1644,7 +1646,7 @@ if ($resql) {
if (!empty($arrayfields['b.conciliated']['checked'])) {
print '
';
- print $objp->conciliated ? $langs->trans("Yes") : $langs->trans("No");
+ print yn($objp->conciliated);
print ' | ';
if (!$i) {
$totalarray['nbfield']++;
diff --git a/htdocs/compta/bank/class/account.class.php b/htdocs/compta/bank/class/account.class.php
index 943fef0c32a..5a00e93e83f 100644
--- a/htdocs/compta/bank/class/account.class.php
+++ b/htdocs/compta/bank/class/account.class.php
@@ -508,15 +508,20 @@ class Account extends CommonObject
dol_syslog(__METHOD__.": using numeric operations is deprecated", LOG_WARNING);
}
+ if (empty($this->id) && !empty($this->rowid)) { // For backward compatibility
+ $this->id = $this->rowid;
+ }
+
// Clean parameters
$emetteur = trim($emetteur);
$banque = trim($banque);
+ $label = trim($label);
$now = dol_now();
if (is_numeric($oper)) { // Clean operation to have a code instead of a rowid
$sql = "SELECT code FROM ".MAIN_DB_PREFIX."c_paiement";
- $sql .= " WHERE id=".$oper;
+ $sql .= " WHERE id = ".((int) $oper);
$sql .= " AND entity IN (".getEntity('c_paiement').")";
$resql = $this->db->query($sql);
if ($resql) {
@@ -533,8 +538,8 @@ class Account extends CommonObject
$this->error = "oper not defined";
return -1;
}
- if (!$this->rowid) {
- $this->error = "this->rowid not defined";
+ if (!$this->id) {
+ $this->error = "this->id not defined";
return -2;
}
if ($this->courant == Account::TYPE_CASH && $oper != 'LIQ') {
@@ -555,7 +560,7 @@ class Account extends CommonObject
$accline->label = $label;
$accline->amount = $amount;
$accline->fk_user_author = $user->id;
- $accline->fk_account = $this->rowid;
+ $accline->fk_account = $this->id;
$accline->fk_type = $oper;
$accline->numero_compte = $accountancycode;
$accline->num_releve = $num_releve;
@@ -574,10 +579,10 @@ class Account extends CommonObject
if ($accline->insert() > 0) {
if ($categorie > 0) {
- $sql = "INSERT INTO ".MAIN_DB_PREFIX."bank_class (";
+ $sql = "INSERT INTO ".MAIN_DB_PREFIX."bank_class(";
$sql .= "lineid, fk_categ";
$sql .= ") VALUES (";
- $sql .= $accline->id.", ".$categorie;
+ $sql .= ((int) $accline->id).", '".$this->db->escape($categorie)."'";
$sql .= ")";
$result = $this->db->query($sql);
@@ -610,7 +615,7 @@ class Account extends CommonObject
*/
public function create(User $user, $notrigger = 0)
{
- global $langs, $conf, $hookmanager;
+ global $langs, $conf;
$error = 0;
@@ -769,7 +774,7 @@ class Account extends CommonObject
*/
public function update(User $user, $notrigger = 0)
{
- global $langs, $conf, $hookmanager;
+ global $langs, $conf;
$error = 0;
@@ -795,9 +800,9 @@ class Account extends CommonObject
$sql .= " ref = '".$this->db->escape($this->ref)."'";
$sql .= ",label = '".$this->db->escape($this->label)."'";
- $sql .= ",courant = ".$this->courant;
- $sql .= ",clos = ".$this->clos;
- $sql .= ",rappro = ".$this->rappro;
+ $sql .= ",courant = ".((int) $this->courant);
+ $sql .= ",clos = ".((int) $this->clos);
+ $sql .= ",rappro = ".((int) $this->rappro);
$sql .= ",url = ".($this->url ? "'".$this->db->escape($this->url)."'" : "null");
$sql .= ",account_number = '".$this->db->escape($this->account_number)."'";
$sql .= ",fk_accountancy_journal = ".($this->fk_accountancy_journal > 0 ? $this->db->escape($this->fk_accountancy_journal) : "null");
@@ -823,7 +828,7 @@ class Account extends CommonObject
$sql .= ",ics = '".$this->db->escape($this->ics)."'";
$sql .= ",ics_transfer = '".$this->db->escape($this->ics_transfer)."'";
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::update", LOG_DEBUG);
$result = $this->db->query($sql);
@@ -1223,7 +1228,7 @@ class Account extends CommonObject
$sql .= " AND (ba.rappro = 1 AND ba.courant != 2)"; // Compte rapprochable
$sql .= " AND clos = 0";
if ($filteraccountid) {
- $sql .= " AND ba.rowid = ".$filteraccountid;
+ $sql .= " AND ba.rowid = ".((int) $filteraccountid);
}
$resql = $this->db->query($sql);
@@ -1278,7 +1283,7 @@ class Account extends CommonObject
$sql .= " AND (ba.rappro = 1 AND ba.courant != 2)"; // Compte rapprochable
$sql .= " AND clos = 0";
if ($filteraccountid) {
- $sql .= " AND ba.rowid = ".$filteraccountid;
+ $sql .= " AND ba.rowid = ".((int) $filteraccountid);
}
$resql = $this->db->query($sql);
diff --git a/htdocs/compta/bank/class/api_bankaccounts.class.php b/htdocs/compta/bank/class/api_bankaccounts.class.php
index 04ef9543867..8cdd33425d6 100644
--- a/htdocs/compta/bank/class/api_bankaccounts.class.php
+++ b/htdocs/compta/bank/class/api_bankaccounts.class.php
@@ -249,6 +249,10 @@ class BankAccounts extends DolibarrApi
$typeto = 'LIQ';
}
+ // Clean data
+ $description = checkVal($description, 'alphanohtml');
+
+
/**
* Creating bank line records
*/
@@ -295,7 +299,9 @@ class BankAccounts extends DolibarrApi
return array(
'success' => array(
'code' => 201,
- 'message' => 'Internal wire transfer created successfully.'
+ 'message' => 'Internal wire transfer created successfully.',
+ 'bank_id_from' => $bank_line_id_from,
+ 'bank_id_to' => $bank_line_id_to,
)
);
} else {
@@ -475,7 +481,7 @@ class BankAccounts extends DolibarrApi
* @param string $accountancycode Accountancy code {@from body}
* @param int $datev Payment date value (timestamp) {@from body} {@type timestamp}
* @param string $num_releve Bank statement numero {@from body}
- * @return int ID of line
+ * @return int ID of line
*
* @url POST {id}/lines
*/
@@ -491,6 +497,14 @@ class BankAccounts extends DolibarrApi
throw new RestException(404, 'account not found');
}
+ $type = checkVal($type);
+ $label = checkVal($label);
+ $cheque_number = checkVal($cheque_number);
+ $cheque_writer = checkVal($cheque_writer);
+ $cheque_bank = checkVal($cheque_bank);
+ $accountancycode = checkVal($accountancycode);
+ $num_releve = checkVal($num_releve);
+
$result = $account->addline(
$date,
$type,
@@ -542,6 +556,10 @@ class BankAccounts extends DolibarrApi
throw new RestException(404, 'account line not found');
}
+ $url = checkVal($url);
+ $label = checkVal($label);
+ $type = checkVal($type);
+
$result = $account->add_url_line($line_id, $url_id, $url, $label, $type);
if ($result < 0) {
throw new RestException(503, 'Error when adding link to account line: '.$account->error);
diff --git a/htdocs/compta/bank/line.php b/htdocs/compta/bank/line.php
index bfea7c74b60..c84f52ffee1 100644
--- a/htdocs/compta/bank/line.php
+++ b/htdocs/compta/bank/line.php
@@ -268,7 +268,7 @@ $sql = "SELECT b.rowid,b.dateo as do,b.datev as dv, b.amount, b.label, b.rappro,
$sql .= " b.num_releve, b.fk_user_author, b.num_chq, b.fk_type, b.fk_account, b.fk_bordereau as receiptid,";
$sql .= " b.emetteur,b.banque";
$sql .= " FROM ".MAIN_DB_PREFIX."bank as b";
-$sql .= " WHERE rowid=".$rowid;
+$sql .= " WHERE rowid=".((int) $rowid);
$sql .= " ORDER BY dateo ASC";
$result = $db->query($sql);
if ($result) {
@@ -291,7 +291,7 @@ if ($result) {
// Confirmations
if ($action == 'delete_categ') {
- print $form->formconfirm($_SERVER['PHP_SELF']."?rowid=".$rowid."&cat1=".GETPOST("fk_categ")."&orig_account=".$orig_account, $langs->trans("RemoveFromRubrique"), $langs->trans("RemoveFromRubriqueConfirm"), "confirm_delete_categ", '', 'yes', 1);
+ print $form->formconfirm($_SERVER['PHP_SELF']."?rowid=".urlencode($rowid)."&cat1=".urlencode(GETPOST("fk_categ", 'int'))."&orig_account=".urlencode($orig_account), $langs->trans("RemoveFromRubrique"), $langs->trans("RemoveFromRubriqueConfirm"), "confirm_delete_categ", '', 'yes', 1);
}
print '