lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix sanitize

Browse Source
This commit is contained in:
John BOTELLA 2022-05-20 19:01:25 +02:00
parent d50e0457f3
commit 1452e74431
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
htdocs/core/tpl/extrafields_list_search_sql.tpl.php
View File

@ -65,8 +65,8 @@ if (!empty($extrafieldsobjectkey) && !empty($search_array_options) && is_array($
if (is_array($crit)) { if (is_array($crit)) {
$crit = implode(' ', $crit); // natural_search() expects a string $crit = implode(' ', $crit); // natural_search() expects a string
} elseif ($typ === 'select' and is_string($crit) and strpos($crit, ',') === false) { } elseif ($typ === 'select' and is_string($crit) and strpos($crit, ',') === false) {
$critSelect = implode("','", array_map(array($db, 'escape'), explode(',', $crit))); $critSelect = "'".implode("','", array_map(array($db, 'escape'), explode(',', $crit)))."'";
$sql .= " AND (".$extrafieldsobjectprefix.$tmpkey." IN ('".$critSelect."') )"; $sql .= " AND (".$extrafieldsobjectprefix.$tmpkey." IN (".$db->sanitize($critSelect, 1).") )";
continue; continue;
} }
$sql .= natural_search($extrafieldsobjectprefix.$tmpkey, $crit, $mode_search); $sql .= natural_search($extrafieldsobjectprefix.$tmpkey, $crit, $mode_search);