lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Escape to avoid false positive, even if it should be useless.

Browse Source
This commit is contained in:
Laurent Destailleur 2021-11-07 17:35:43 +01:00
parent 4247275465
commit 1934a37676
2 changed files with 2 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
htdocs/core/class/commonobject.class.php
View File

@ -7874,11 +7874,6 @@ abstract class CommonObject
$out .= ($display_type=='card' ? '</td>' : '</div>'); $out .= ($display_type=='card' ? '</td>' : '</div>');
/*for($ii = 0; $ii < ($colspan - 1); $ii++)
{
$out .='<td class="'.$this->element.'_extras_'.$key.'"></td>';
}*/
if (!empty($conf->global->MAIN_EXTRAFIELDS_USE_TWO_COLUMS) && (($e % 2) == 1)) { if (!empty($conf->global->MAIN_EXTRAFIELDS_USE_TWO_COLUMS) && (($e % 2) == 1)) {
$out .= ($display_type=='card' ? '</tr>' : '</div>'); $out .= ($display_type=='card' ? '</tr>' : '</div>');
} else { } else {
@ -8887,7 +8882,7 @@ abstract class CommonObject
$sql = "SELECT ".$objectline->getFieldList('l'); $sql = "SELECT ".$objectline->getFieldList('l');
$sql .= " FROM ".MAIN_DB_PREFIX.$objectline->table_element." as l"; $sql .= " FROM ".MAIN_DB_PREFIX.$objectline->table_element." as l";
$sql .= " WHERE l.fk_".$this->element." = ".((int) $this->id); $sql .= " WHERE l.fk_".$this->db->escape($this->element)." = ".((int) $this->id);
if ($morewhere) { if ($morewhere) {
$sql .= $morewhere; $sql .= $morewhere;
} }

2
htdocs/core/class/fileupload.class.php
View File

@ -222,7 +222,7 @@ class FileUpload
protected function setFileDeleteUrl($file) protected function setFileDeleteUrl($file)
{ {
$file->delete_url = $this->options['script_url'] $file->delete_url = $this->options['script_url']
.'?file='.rawurlencode($file->name).'&fk_element='.$this->fk_element.'&element='.$this->element; .'?file='.urlencode($file->name).'&fk_element='.urlencode($this->fk_element).'&element='.urlencode($this->element);
$file->delete_type = $this->options['delete_type']; $file->delete_type = $this->options['delete_type'];
if ($file->delete_type !== 'DELETE') { if ($file->delete_type !== 'DELETE') {
$file->delete_url .= '&_method=DELETE'; $file->delete_url .= '&_method=DELETE';