Merge branch 'develop' of https://github.com/Dolibarr/dolibarr into develop

This commit is contained in:
Peter Fontaine 2013-10-18 18:52:28 +02:00
commit 200ec5ab06
42 changed files with 500 additions and 157 deletions

View File

@ -1788,8 +1788,8 @@ class Facture extends CommonInvoice
// Rename directory if dir was a temporary ref
if (preg_match('/^[\(]?PROV/i', $this->ref))
{
// On renomme repertoire facture ($this->ref = ancienne ref, $num = nouvelle ref)
// afin de ne pas perdre les fichiers attaches
// Rename of object directory ($this->ref = old ref, $num = new ref)
// to not lose the linked files
$facref = dol_sanitizeFileName($this->ref);
$snumfa = dol_sanitizeFileName($num);
$dirsource = $conf->facture->dir_output.'/'.$facref;
@ -1977,7 +1977,7 @@ class Facture extends CommonInvoice
function addline($desc, $pu_ht, $qty, $txtva, $txlocaltax1=0, $txlocaltax2=0, $fk_product=0, $remise_percent=0, $date_start='', $date_end='', $ventil=0, $info_bits=0, $fk_remise_except='', $price_base_type='HT', $pu_ttc=0, $type=0, $rang=-1, $special_code=0, $origin='', $origin_id=0, $fk_parent_line=0, $fk_fournprice=null, $pa_ht=0, $label='',$array_option=0)
{
global $mysoc;
$facid=$this->id;
dol_syslog(get_class($this)."::Addline facid=$facid,desc=$desc,pu_ht=$pu_ht,qty=$qty,txtva=$txtva, txlocaltax1=$txlocaltax1, txlocaltax2=$txlocaltax2, fk_product=$fk_product,remise_percent=$remise_percent,date_start=$date_start,date_end=$date_end,ventil=$ventil,info_bits=$info_bits,fk_remise_except=$fk_remise_except,price_base_type=$price_base_type,pu_ttc=$pu_ttc,type=$type", LOG_DEBUG);
@ -2023,9 +2023,9 @@ class Facture extends CommonInvoice
// qty, pu, remise_percent et txtva
// TRES IMPORTANT: C'est au moment de l'insertion ligne qu'on doit stocker
// la part ht, tva et ttc, et ce au niveau de la ligne qui a son propre taux tva.
$localtaxes_type=getLocalTaxesFromRate($txtva,0,$mysoc);
$tabprice = calcul_price_total($qty, $pu, $remise_percent, $txtva, $txlocaltax1, $txlocaltax2, 0, $price_base_type, $info_bits, $type,'',$localtaxes_type);
$total_ht = $tabprice[0];
$total_tva = $tabprice[1];
@ -2148,7 +2148,7 @@ class Facture extends CommonInvoice
function updateline($rowid, $desc, $pu, $qty, $remise_percent, $date_start, $date_end, $txtva, $txlocaltax1=0, $txlocaltax2=0, $price_base_type='HT', $info_bits=0, $type=0, $fk_parent_line=0, $skip_update_total=0, $fk_fournprice=null, $pa_ht=0, $label='', $special_code=0, $array_option=0)
{
include_once DOL_DOCUMENT_ROOT.'/core/lib/price.lib.php';
global $mysoc;
dol_syslog(get_class($this)."::updateline $rowid, $desc, $pu, $qty, $remise_percent, $date_start, $date_end, $txtva, $txlocaltax1, $txlocaltax2, $price_base_type, $info_bits, $type, $fk_parent_line", LOG_DEBUG);
@ -2176,9 +2176,9 @@ class Facture extends CommonInvoice
// Calculate total with, without tax and tax from qty, pu, remise_percent and txtva
// TRES IMPORTANT: C'est au moment de l'insertion ligne qu'on doit stocker
// la part ht, tva et ttc, et ce au niveau de la ligne qui a son propre taux tva.
$localtaxes_type=getLocalTaxesFromRate($txtva,0,$mysoc);
$tabprice=calcul_price_total($qty, $pu, $remise_percent, $txtva, $txlocaltax1, $txlocaltax2, 0, $price_base_type, $info_bits, $type,'',$localtaxes_type);
$total_ht = $tabprice[0];
$total_tva = $tabprice[1];

View File

@ -274,54 +274,63 @@ class Contrat extends CommonObject
}
/**
* Validate a contract
* Validate a contract
*
* @param User $user Objet User
* @return int <0 if KO, >0 if OK
* @param User $user Objet User
* @param string $force_number Reference to force on contract (not implemented yet)
* @return int <0 if KO, >0 if OK
*/
function validate($user)
function validate($user, $force_number='')
{
require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
global $langs, $conf;
$now=dol_now();
$error=0;
dol_syslog(get_class($this).'::validate user='.$user->id.', force_number='.$force_number);
// Definition du nom de module de numerotation de commande
$soc = new Societe($this->db);
$soc->fetch($this->socid);
// Class of company linked to order
$result=$soc->set_as_client();
$this->db->begin();
$this->fetch_thirdparty();
// A contract is validated so we can move thirdparty to status customer
$result=$this->thirdparty->set_as_client();
// Define new ref
if (! $error && (preg_match('/^[\(]?PROV/i', $this->ref)))
{
$num = $this->getNextNumRef($soc);
$num = $this->getNextNumRef($this->thirdparty);
}
else
{
$num = $this->ref;
}
$sql = "UPDATE ".MAIN_DB_PREFIX."contrat SET ref = '".$num."', statut = 1";
$sql .= " WHERE rowid = ".$this->id . " AND statut = 0";
$resql = $this->db->query($sql);
if ($resql)
if ($num)
{
// Appel des triggers
include_once DOL_DOCUMENT_ROOT . '/core/class/interfaces.class.php';
$interface=new Interfaces($this->db);
$result=$interface->run_triggers('CONTRACT_VALIDATE',$this,$user,$langs,$conf);
if ($result < 0) { $error++; $this->errors=$interface->errors; }
// Fin appel triggers
$sql = "UPDATE ".MAIN_DB_PREFIX."contrat SET ref = '".$num."', statut = 1";
//$sql.= ", fk_user_valid = ".$user->id.", date_valid = '".$this->db->idate($now)."'";
$sql .= " WHERE rowid = ".$this->id . " AND statut = 0";
dol_syslog(get_class($this)."::validate sql=".$sql);
$resql = $this->db->query($sql);
if (! $resql)
{
dol_syslog(get_class($this)."::validate Echec update - 10 - sql=".$sql, LOG_ERR);
dol_print_error($this->db);
$error++;
}
if (! $error)
{
$this->oldref = '';
// Rename directory if dir was a temporary ref
if (preg_match('/^[\(]?PROV/i', $this->ref))
{
// Rename of propal directory ($this->ref = old ref, $num = new ref)
// Rename of object directory ($this->ref = old ref, $num = new ref)
// to not lose the linked files
$facref = dol_sanitizeFileName($this->ref);
$snumfa = dol_sanitizeFileName($num);
@ -330,28 +339,56 @@ class Contrat extends CommonObject
if (file_exists($dirsource))
{
dol_syslog(get_class($this)."::validate rename dir ".$dirsource." into ".$dirdest);
if (@rename($dirsource, $dirdest))
{
$this->oldref = $facref;
dol_syslog("Rename ok");
// Deleting old PDF in new rep
dol_delete_file($conf->contract->dir_output.'/'.$snumfa.'/'.$facref.'*.*');
}
}
}
return 1;
}
else
// Set new ref and define current statut
if (! $error)
{
return -1;
$this->ref = $num;
$this->statut=1;
$this->brouillon=0;
$this->date_validation=$now;
}
// Trigger calls
if (! $error)
{
// Appel des triggers
include_once DOL_DOCUMENT_ROOT . '/core/class/interfaces.class.php';
$interface=new Interfaces($this->db);
$result=$interface->run_triggers('CONTRACT_VALIDATE',$this,$user,$langs,$conf);
if ($result < 0) { $error++; $this->errors=$interface->errors; }
// Fin appel triggers
}
}
else
{
$this->error=$this->db->error();
$error++;
}
if (! $error)
{
$this->db->commit();
return 1;
}
else
{
$this->db->rollback();
$this->error=$this->db->lasterror();
return -1;
}
}
@ -966,19 +1003,19 @@ class Contrat extends CommonObject
// qty, pu, remise_percent et txtva
// TRES IMPORTANT: C'est au moment de l'insertion ligne qu'on doit stocker
// la part ht, tva et ttc, et ce au niveau de la ligne qui a son propre taux tva.
$localtaxes_type=getLocalTaxesFromRate($txtva,0,$mysoc);
$tabprice=calcul_price_total($qty, $pu, $remise_percent, $txtva, $txlocaltax1, $txlocaltax2, 0, $price_base_type, $info_bits, 1,'', $localtaxes_type);
$total_ht = $tabprice[0];
$total_tva = $tabprice[1];
$total_ttc = $tabprice[2];
$total_localtax1= $tabprice[9];
$total_localtax2= $tabprice[10];
$localtax1_type=$localtaxes_type[0];
$localtax2_type=$localtaxes_type[2];
// TODO A virer
// Anciens indicateurs: $price, $remise (a ne plus utiliser)
$remise = 0;
@ -1114,19 +1151,19 @@ class Contrat extends CommonObject
// qty, pu, remise_percent et txtva
// TRES IMPORTANT: C'est au moment de l'insertion ligne qu'on doit stocker
// la part ht, tva et ttc, et ce au niveau de la ligne qui a son propre taux tva.
$localtaxes_type=getLocalTaxesFromRate($txtva,0,$mysoc);
$tabprice=calcul_price_total($qty, $pu, $remise_percent, $tvatx, $localtaxtx1, $txlocaltaxtx2, 0, $price_base_type, $info_bits, 1, '', $localtaxes_type);
$total_ht = $tabprice[0];
$total_tva = $tabprice[1];
$total_ttc = $tabprice[2];
$total_localtax1= $tabprice[9];
$total_localtax2= $tabprice[10];
$localtax1_type=$localtaxes_type[0];
$localtax2_type=$localtaxes_type[2];
// TODO A virer
// Anciens indicateurs: $price, $remise (a ne plus utiliser)
$remise = 0;

View File

@ -2329,7 +2329,7 @@ function print_liste_field_titre($name, $file="", $field="", $begin="", $morepar
* Get title line of an array
*
* @param string $name Label of field
* @param int $thead For thead format (0 by default)
* @param int $thead 0=To use with standard table forat, 1=To use inside <thead><tr>, 2=To use with <div>
* @param string $file Url used when we click on sort picto
* @param string $field Field to use for new sorting. Empty if this field is not sortable.
* @param string $begin ("" by defaut)
@ -2347,10 +2347,13 @@ function getTitleFieldOfList($name, $thead=0, $file="", $field="", $begin="", $m
$sortorder=strtoupper($sortorder);
$out='';
$tag='th';
if ($thead==2) $tag='div';
// If field is used as sort criteria we use a specific class
// Example if (sortfield,field)=("nom","xxx.nom") or (sortfield,field)=("nom","nom")
if ($field && ($sortfield == $field || $sortfield == preg_replace("/^[^\.]+\./","",$field))) $out.= '<th class="liste_titre_sel" '. $moreattrib.'>';
else $out.= '<th class="liste_titre" '. $moreattrib.'>';
if ($field && ($sortfield == $field || $sortfield == preg_replace("/^[^\.]+\./","",$field))) $out.= '<'.$tag.' class="liste_titre_sel" '. $moreattrib.'>';
else $out.= '<'.$tag.' class="liste_titre" '. $moreattrib.'>';
if (! empty($conf->dol_optimize_smallscreen) && empty($thead) && $field) // If this is a sort field
{
@ -2397,7 +2400,7 @@ function getTitleFieldOfList($name, $thead=0, $file="", $field="", $begin="", $m
}
}
}
$out.='</th>';
$out.='</'.$tag.'>';
return $out;
}

View File

@ -515,22 +515,7 @@ function quotedPrintEncode($str,$forcal=0)
function quotedPrintDecode($str)
{
$out = preg_replace('/=\r?\n/', '', $str);
/*
* preg_replace /e modifier is deprecated in PHP 5.5
* but anonymous functions for use in preg_replace_callback are only available from 5.3.0
*/
if (version_compare(PHP_VERSION, '5.3.0') >= 0) {
$out = preg_replace_callback(
'/=([A-F0-9]{2})/',
function ($m) {
return chr(hexdec($m[1]));
},
$out
);
} else {
$out = preg_replace('/=([A-F0-9]{2})/e', chr(hexdec('\\1')), $out);
}
$out = quoted_printable_decode($out); // Available with PHP 4+
return trim($out);
}

View File

@ -301,6 +301,7 @@ ALTER TABLE llx_facture_fourn MODIFY COLUMN fk_cond_reglement integer NULL;
insert into llx_c_action_trigger (rowid,code,label,description,elementtype,rang) values (9,'COMPANY_SENTBYMAIL','Mails sent from third party card','Executed when you send email from third party card','societe',1);
ALTER TABLE llx_contratdet ADD column product_type integer DEFAULT 1 after total_ttc;
create table llx_contrat_extrafields
(

View File

@ -52,6 +52,7 @@ create table llx_contratdet
total_localtax1 double(24,8) DEFAULT 0, -- Total Local tax 1 de la ligne
total_localtax2 double(24,8) DEFAULT 0, -- Total Local tax 2 de la ligne
total_ttc double(24,8) DEFAULT 0, -- Total TTC de la ligne toute quantite et incluant remise ligne et globale
product_type integer DEFAULT 1, -- Product type (1=service by default)
info_bits integer DEFAULT 0, -- TVA NPR ou non
buy_price_ht double(24,8) DEFAULT NULL, -- buying price

View File

@ -34,8 +34,10 @@ LastMovements=Last movements
Units=Units
Unit=Unit
StockCorrection=Correct stock
StockTransfer=Stock transfer
StockMovement=Transfer
StockMovements=Stock transfers
LabelMovement=Movement label
NumberOfUnit=Number of units
UnitPurchaseValue=Unit purchase price
TotalStock=Total in stock
@ -106,5 +108,5 @@ Replenishments=Replenishments
NbOfProductBeforePeriod=Quantity of product %s in stock before selected period (< %s)
NbOfProductAfterPeriod=Quantity of product %s in stock after selected period (> %s)
MassStockMovement=Mass stock movement
SelectProductInAndOutWareHouse=Select a product, a quantity, a source warehouse and a target warehouse, then click "Add". Once this is done for all required movements, click onto "Record Tranferts".
SelectProductInAndOutWareHouse=Select a product, a quantity, a source warehouse and a target warehouse, then click "%s". Once this is done for all required movements, click onto "%s".
RecordMovement=Record transfert

View File

@ -34,8 +34,10 @@ LastMovements=Derniers mouvements
Units=Unités
Unit=Unité
StockCorrection=Corriger le stock
StockTransfer=Transfert de stock
StockMovement=Transférer
StockMovements=Mouvements de stock
LabelMovement=Libellé du mouvement
NumberOfUnit=Nombre de pièces
UnitPurchaseValue=Prix d'achat unitaire
TotalStock=Total en stock
@ -106,5 +108,5 @@ Replenishments=Réapprovisionnement
NbOfProductBeforePeriod=Quantité du produit <b>%s</b> en stock avant la période sélectionnée (< <b>%s</b>)
NbOfProductAfterPeriod=Quantité du produit <b>%s</b> en stock après la période sélectionnée (> <b>%s</b>)
MassStockMovement=Mouvement de stock en masse
SelectProductInAndOutWareHouse=Sélectionner un produit, une quantité à transférer, un entrepôt source et destination et cliquer sur ajouter. Une fois tous les mouvements enregistrés, cliquer sur "Enregistrer transferts".
SelectProductInAndOutWareHouse=Sélectionner un produit, une quantité à transférer, un entrepôt source et destination et cliquer sur "%s". Une fois tous les mouvements choisis, cliquer sur "%s".
RecordMovement=Enregistrer transferts

View File

@ -72,7 +72,7 @@ if (function_exists('get_magic_quotes_gpc')) // magic_quotes_* removed in PHP6
*
* @param string $val Value
* @param string $type 1=GET, 0=POST, 2=PHP_SELF
* @return boolean true if there is an injection
* @return int >0 if there is an injection
*/
function test_sql_and_script_inject($val, $type)
{
@ -102,7 +102,7 @@ function test_sql_and_script_inject($val, $type)
}
// For XSS Injection done by adding javascript closing html tags like with onmousemove, etc... (closing a src or href tag with not cleaned param)
if ($type == 1) $sql_inj += preg_match('/"/i', $val); // We refused " in GET parameters value
if ($type == 2) $sql_inj += preg_match('/[\s;"]/', $val); // PHP_SELF is an url and must match url syntax
if ($type == 2) $sql_inj += preg_match('/[;"]/', $val); // PHP_SELF is a file system path. It can contains spaces.
return $sql_inj;
}
@ -111,7 +111,7 @@ function test_sql_and_script_inject($val, $type)
*
* @param string &$var Variable name
* @param string $type 1=GET, 0=POST, 2=PHP_SELF
* @return boolean true if ther is an injection
* @return boolean true if there is an injection
*/
function analyse_sql_and_script(&$var, $type)
{
@ -124,8 +124,8 @@ function analyse_sql_and_script(&$var, $type)
$var[$key] = $value;
}
else
{
print 'Access refused by SQL/Script injection protection in main.inc.php';
{
print 'Access refused by SQL/Script injection protection in main.inc.php (type='.htmlentities($type).' key='.htmlentities($key).' value='.htmlentities($value).' page='.htmlentities($_SERVER["REQUEST_URI"]).')';
exit;
}
}

View File

@ -103,17 +103,21 @@ if ($action == 'addline')
if (! $error)
{
$id=count($listofdata);
if (count(array_keys($listofdata)) > 0) $id=max(array_keys($listofdata)) + 1;
else $id=1;
$listofdata[$id]=array('id'=>$id, 'id_product'=>$id_product, 'qty'=>$qty, 'id_sw'=>$id_sw, 'id_tw'=>$id_tw);
$_SESSION['massstockmove']=dol_json_encode($listofdata);
unset($id_product);
//unset($id_sw);
//unset($id_tw);
unset($qty);
}
}
if ($action == 'delline' && $idline != '')
{
if (! empty($listofdata[$idline])) unset($listofdata[$idline]);
var_dump($listofdata);
var_dump(dol_json_encode($listofdata)); exit;
if (count($listofdata) > 0) $_SESSION['massstockmove']=dol_json_encode($listofdata);
else unset($_SESSION['massstockmove']);
}
@ -132,6 +136,8 @@ if ($action == 'createmovement' && isset($_POST['valid']))
* View
*/
$now=dol_now();
$form=new Form($db);
$formproduct=new FormProduct($db);
$productstatic = new Product($db);
@ -144,8 +150,14 @@ llxHeader('', $title, $helpurl, '');
print_fiche_titre($langs->trans("MassStockMovement")).'<br><br>';
print $langs->trans("SelectProductInAndOutWareHouse").'<br>';
$titletoadd=$langs->trans("Select");
$titletoaddnoent=$langs->transnoentitiesnoconv("Select");
$buttonrecord=$langs->trans("RecordMovement");
$buttonrecordnoent=$langs->trans("RecordMovement");
print $langs->trans("SelectProductInAndOutWareHouse",$titletoaddnoent,$buttonrecordnoent).'<br>';
print '<br>'."\n";
$var=true;
// Form to add a line
print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST" name="formulaire">';
@ -153,56 +165,41 @@ print '<input type="hidden" name="token" value="' .$_SESSION['newtoken'] . '">';
print '<input type="hidden" name="action" value="addline">';
print '<table class="liste" width="100%">';
//print '<div class="tagtable centpercent">';
print '<tr class="liste_titre">';
print_liste_field_titre($langs->trans('Product'),$_SERVER["PHP_SELF"],'',$param,'','',$sortfield,$sortorder);
print_liste_field_titre($langs->trans('Qty'),$_SERVER["PHP_SELF"],'',$param,'','align="center"',$sortfield,$sortorder);
print_liste_field_titre($langs->trans('WarehouseSource'),$_SERVER["PHP_SELF"],'',$param,'','align="center"',$sortfield,$sortorder);
print_liste_field_titre($langs->trans('WarehouseTarget'),$_SERVER["PHP_SELF"],'',$param,'','align="center"',$sortfield,$sortorder);
print_liste_field_titre('');
print getTitleFieldOfList($langs->trans('ProductRef'),0,$_SERVER["PHP_SELF"],'',$param,'','class="tagtd"',$sortfield,$sortorder);
print getTitleFieldOfList($langs->trans('ProductLabel'),0,$_SERVER["PHP_SELF"],'',$param,'','class="tagtd"',$sortfield,$sortorder);
print getTitleFieldOfList($langs->trans('WarehouseSource'),0,$_SERVER["PHP_SELF"],'',$param,'','class="tagtd"',$sortfield,$sortorder);
print getTitleFieldOfList($langs->trans('WarehouseTarget'),0,$_SERVER["PHP_SELF"],'',$param,'','class="tagtd"',$sortfield,$sortorder);
print getTitleFieldOfList($langs->trans('Qty'),0,$_SERVER["PHP_SELF"],'',$param,'','align="center" class="tagtd"',$sortfield,$sortorder);
print getTitleFieldOfList('',0);
print '</tr>';
print '<tr>';
print '<tr '.$bc[$var].'>';
// Product
print '<td>';
print '<td colspan="2">';
$filtertype=0;
if (! empty($conf->global->STOCK_SUPPORTS_SERVICES)) $filtertype='';
print $form->select_produits($id_product,'productid',$filtertype);
print '</td>';
// Qty
print '<td align="center"><input type="input" size="4" class="flat" name="qty" value="'.$qty.'"></td>';
// In warehouse
print '<td align="center">';
print '<td>';
print $formproduct->selectWarehouses($id_sw,'id_sw','',1);
print '</td>';
// Out warehouse
print '<td align="center">';
print '<td>';
print $formproduct->selectWarehouses($id_tw,'id_tw','',1);
print '</td>';
// Qty
print '<td align="center"><input type="text" size="4" class="flat" name="qty" value="'.$qty.'"></td>';
// Button to add line
print '<td align="right"><input type="submit" class="button" name="addline" value="'.dol_escape_htmltag($langs->trans("Add")).'"></td>';
print '<td align="right"><input type="submit" class="button" name="addline" value="'.dol_escape_htmltag($titletoadd).'"></td>';
print '</tr>';
print '</table>';
print '</form>';
print '<br>';
// List movement prepared
print '<table class="liste" width="100%">';
// Lignes des titres
print '<tr class="liste_titre">';
print_liste_field_titre($langs->trans('ProductRef'),$_SERVER["PHP_SELF"],'p.ref',$param,'','',$sortfield,$sortorder);
print_liste_field_titre($langs->trans('ProductLabel'),$_SERVER["PHP_SELF"],'p.label',$param,'','',$sortfield,$sortorder);
print_liste_field_titre($langs->trans('Qty'),$_SERVER["PHP_SELF"],'',$param,'','align="right"',$sortfield,$sortorder);
print_liste_field_titre($langs->trans('WarehouseSource'),$_SERVER["PHP_SELF"],'',$param,'','align="right"',$sortfield,$sortorder);
print_liste_field_titre($langs->trans('WarehouseTarget'),$_SERVER["PHP_SELF"],'',$param,'','align="right"',$sortfield,$sortorder);
print_liste_field_titre('');
print '</tr>';
$var=false;
foreach($listofdata as $key => $val)
{
$var=!$var;
@ -219,23 +216,35 @@ foreach($listofdata as $key => $val)
print $productstatic->getNomUrl(1);
$productstatic->ref=$oldref;
print '</td>';
print '<td align="right">'.$val['qty'].'</td>';
print '<td align="right">';
print '<td>';
print $warehousestatics->getNomUrl(1);
print '</td>';
print '<td align="right">';
print '<td>';
print $warehousestatict->getNomUrl(1);
print '</td>';
print '<td align="center">'.$val['qty'].'</td>';
print '<td align="right"><a href="'.$_SERVER["PHP_SELF"].'?action=delline&idline='.$val['id'].'">'.img_delete($langs->trans("Remove")).'</a></td>';
print '</tr>';
}
print '</table>';
// Generate
$value=$langs->trans("RecordMovement");
print '<div class="center"><input class="button" type="submit" name="valid" value="'.$value.'"></div>';
print '<br>';
// Button to record mass movement
$labelmovement=GETPOST("label")?GETPOST('label'):$langs->trans("MassStockMovement").' '.dol_print_date($now,'%Y-%m-%d %H:%M');
print '<table class="border" width="100%">';
print '<tr>';
print '<td width="20%">'.$langs->trans("LabelMovement").'</td>';
print '<td colspan="5">';
print '<input type="text" name="label" size="80" value="'.dol_escape_htmltag($labelmovement).'">';
print '</td>';
print '</tr>';
print '</table>';
print '<div class="center"><input class="button" type="submit" name="valid" value="'.dol_escape_htmltag($buttonrecord).'"></div>';
print '</form>';

View File

@ -429,7 +429,7 @@ if ($id > 0 || $ref)
*/
if ($action == "transfert")
{
print_titre($langs->trans("Transfer"));
print_titre($langs->trans("StockTransfer"));
print '<form action="'.$_SERVER["PHP_SELF"].'?id='.$product->id.'" method="post">'."\n";
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="transfert_stock">';
@ -442,21 +442,21 @@ if ($id > 0 || $ref)
print '<td width="20%" class="fieldrequired">'.$langs->trans("WarehouseTarget").'</td><td width="20%">';
print $formproduct->selectWarehouses(GETPOST('id_entrepot_destination'),'id_entrepot_destination','',1);
print '</td>';
print '<td width="20%" class="fieldrequired">'.$langs->trans("NumberOfUnit").'</td><td width="20%"><input name="nbpiece" size="10" value="'.GETPOST("nbpiece").'"></td>';
print '<td width="20%" class="fieldrequired">'.$langs->trans("NumberOfUnit").'</td><td width="20%"><input type="text" class="flat" name="nbpiece" size="10" value="'.dol_escape_htmltag(GETPOST("nbpiece")).'"></td>';
print '</tr>';
// Label
print '<tr>';
print '<td width="20%">'.$langs->trans("Label").'</td>';
print '<td width="20%">'.$langs->trans("LabelMovement").'</td>';
print '<td colspan="5">';
print '<input type="text" name="label" size="40" value="'.GETPOST("label").'">';
print '<input type="text" name="label" size="80" value="'.dol_escape_htmltag(GETPOST("label")).'">';
print '</td>';
print '</tr>';
print '</table>';
print '<center><input type="submit" class="button" value="'.$langs->trans('Save').'">&nbsp;';
print '<input type="submit" class="button" name="cancel" value="'.$langs->trans("Cancel").'"></center>';
print '<center><input type="submit" class="button" value="'.dol_escape_htmltag($langs->trans('Save')).'">&nbsp;';
print '<input type="submit" class="button" name="cancel" value="'.dol_escape_htmltag($langs->trans("Cancel")).'"></center>';
print '</form>';
}

View File

@ -16,38 +16,41 @@ if (empty($conf->global->MAIN_FEATURES_LEVEL))
<head>
<meta name="robots" content="noindex,nofollow" />
<meta name="author" content="Dolibarr Development Team">
<link rel="shortcut icon" type="image/x-icon" href="/dolibarrnew/theme/eldy/img/favicon.ico"/>
<link rel="shortcut icon" type="image/x-icon" href="<?php echo DOL_URL_ROOT ?>/theme/eldy/img/favicon.ico"/>
<title>Login Dolibarr 3.4.0-alpha</title>
<!-- Includes for JQuery (Ajax library) -->
<link rel="stylesheet" type="text/css" href="/dolibarrnew/includes/jquery/css/smoothness/jquery-ui-latest.custom.css" />
<link rel="stylesheet" type="text/css" href="/dolibarrnew/includes/jquery/plugins/datatables/css/jquery.dataTables.css" />
<link rel="stylesheet" type="text/css" href="/dolibarrnew/includes/jquery/plugins/mobile/jquery.mobile-latest.min.css" />
<link rel="stylesheet" type="text/css" title="default" href="/dolibarrnew/theme/eldy/style.css.php?dol_use_jmobile=1" />
<link rel="stylesheet" type="text/css" href="<?php echo DOL_URL_ROOT ?>/includes/jquery/css/smoothness/jquery-ui-latest.custom.css" />
<link rel="stylesheet" type="text/css" href="<?php echo DOL_URL_ROOT ?>/includes/jquery/plugins/datatables/css/jquery.dataTables.css" />
<link rel="stylesheet" type="text/css" href="<?php echo DOL_URL_ROOT ?>/includes/jquery/plugins/mobile/jquery.mobile-latest.min.css" />
<link rel="stylesheet" type="text/css" title="default" href="<?php echo DOL_URL_ROOT ?>/theme/eldy/style.css.php?dol_use_jmobile=1" />
<!-- Includes JS for JQuery -->
<script type="text/javascript" src="/dolibarrnew/includes/jquery/js/jquery-latest.min.js"></script>
<script type="text/javascript" src="/dolibarrnew/includes/jquery/plugins/datatables/js/jquery.dataTables.js"></script>
<!--<script type="text/javascript" src="/dolibarrnew/includes/jquery/plugins/mobile/jquery.mobile-latest.min.js"></script>-->
<script type="text/javascript" src="<?php echo DOL_URL_ROOT ?>/includes/jquery/js/jquery-latest.min.js"></script>
<script type="text/javascript" src="<?php echo DOL_URL_ROOT ?>/includes/jquery/plugins/datatables/js/jquery.dataTables.js"></script>
<!--<script type="text/javascript" src="<?php echo DOL_URL_ROOT ?>/includes/jquery/plugins/mobile/jquery.mobile-latest.min.js"></script>-->
</head>
<body>
<body style="margin: 4px;">
<div data-role="page">
<br>
This page is a sample of page using tables. To make test with<br>
- css (edit page to change)<br>
- jmobile (edit page to enable/disable)<br>
- dataTables.<br><br>
- dataTables.<br>
<br>
<br>
Example 1 : Table using tags: div+form<br>
Example 1 : Table using tags: div.tagtable+form+div or div.tagtable+div.tagtr+div.tagtd<br>
<div class="tagtable centpercent" id="abc">
<form class="liste_titre" method="POST" action="1.php">
<div>snake<input type="hidden" name="cartitem" value="1"></div>
<div><label><input type="checkbox" name="hidedetails" value="2"> A checkbox inside a cell</label></div>
<div><input name="count" value="4"></div>
<div><input type="submit" name="count" value="aaa"></div>
<div><input type="submit" name="count" class="button noshadow" value="aaa"></div>
</form>
<form class="impair" method="POST" action="2.php">
<div>snagfdgfd gd fgf ke<input type="hidden" name="cartitem" value="2"></div>
@ -55,12 +58,12 @@ Example 1 : Table using tags: div+form<br>
<div><input name="count" value="4"></div>
<div><input type="submit" value="xxx" class="button"></div>
</form>
<form class="pair" method="GET" action="3.php">
<div class="pair tagtr" method="GET" action="3.php">
<div>snagfdgfd gd fgf ke<input type="hidden" name="cartitem" value="3"></div>
<div>dfsdf</div>
<div><input name="count" value="4"></div>
<div><input type="submit" value="zzz" class="button"></div>
</form>
</div>
</div>
@ -69,7 +72,7 @@ Example 1 : Table using tags: div+form<br>
Example 2 : Table using tags: table/thead/tbdoy/tr/td + dataTable<br>
Example 2 : Table using tags: table/thead/tbody/tr/td + dataTable<br>
<script type="text/javascript">
/*$(document).ready(function(){
@ -123,9 +126,9 @@ $('xxxth').replaceWith(
<table id="def">
<thead>
<tr>
<td>snake</td>
<td><label><input type="checkbox" name="hidedetails" value="2"> A checkbox inside a cell</label></td>
<td>dddd</td>
<th>snake</th>
<th><label><input type="checkbox" name="hidedetails" value="2"> A checkbox inside a cell</label></th>
<?php print getTitleFieldOfList($langs->trans('zzz'),1,$_SERVER["PHP_SELF"],'','','','align="center" class="tagtd"',$sortfield,$sortorder); ?>
</tr>
</thead>
<tbody>

View File

@ -65,7 +65,6 @@ class Societe extends CommonObject
var $country_code;
var $country;
var $tel; // deprecated
var $phone;
var $fax;
var $email;
@ -402,7 +401,7 @@ class Societe extends CommonObject
$this->zip = $this->zip?trim($this->zip):trim($this->zip);
$this->town = $this->town?trim($this->town):trim($this->town);
$this->state_id = trim($this->state_id);
$this->country_id = ($this->country_id > 0)?$this->country_id:$this->country_id;
$this->country_id = ($this->country_id > 0)?$this->country_id:0;
$this->phone = trim($this->phone);
$this->phone = preg_replace("/\s/","",$this->phone);
$this->phone = preg_replace("/\./","",$this->phone);

View File

@ -174,6 +174,7 @@ if (empty($reshook))
// Fill array 'array_options' with data from add form
$ret = $extrafields->setOptionalsFromPost($extralabels,$object);
if (GETPOST('deletephoto')) $object->logo = '';
else if (! empty($_FILES['photo']['name'])) $object->logo = dol_sanitizeFileName($_FILES['photo']['name']);
@ -200,7 +201,7 @@ if (empty($reshook))
}
// We set country_id, country_code and country for the selected country
$object->country_id=GETPOST('country_id')?GETPOST('country_id'):$mysoc->country_id;
$object->country_id=GETPOST('country_id')!=''?GETPOST('country_id'):$mysoc->country_id;
if ($object->country_id)
{
$tmparray=getCountry($object->country_id,'all');
@ -827,7 +828,7 @@ else
// Country
print '<tr><td width="25%">'.$langs->trans('Country').'</td><td colspan="3">';
print $form->select_country($object->country_id,'country_id');
print $form->select_country((GETPOST('country_id')!=''?GETPOST('country_id'):$object->country_id),'country_id');
if ($user->admin) print info_admin($langs->trans("YouCanChangeValuesForThisListFromDictionnarySetup"),1);
print '</td></tr>';
@ -1207,7 +1208,7 @@ else
print '<input type="text" name="code_fournisseur" size="16" value="'.$object->code_fournisseur.'" maxlength="15">';
}
else
{
{
print $object->code_fournisseur;
print '<input type="hidden" name="code_fournisseur" value="'.$object->code_fournisseur.'">';
}
@ -1245,7 +1246,7 @@ else
// Country
print '<tr><td>'.$langs->trans('Country').'</td><td colspan="3">';
print $form->select_country($object->country_id,'country_id');
print $form->select_country((GETPOST('country_id')!=''?GETPOST('country_id'):$object->country_id),'country_id');
if ($user->admin) print info_admin($langs->trans("YouCanChangeValuesForThisListFromDictionnarySetup"),1);
print '</td></tr>';
@ -1548,9 +1549,12 @@ else
// Country
print '<tr><td>'.$langs->trans("Country").'</td><td colspan="'.(2+(($showlogo || $showbarcode)?0:1)).'" class="nowrap">';
$img=picto_from_langcode($object->country_code);
if ($object->isInEEC()) print $form->textwithpicto(($img?$img.' ':'').$object->country,$langs->trans("CountryIsInEEC"),1,0);
else print ($img?$img.' ':'').$object->country;
if ($object->country_code)
{
$img=picto_from_langcode($object->country_code);
if ($object->isInEEC()) print $form->textwithpicto(($img?$img.' ':'').$object->country,$langs->trans("CountryIsInEEC"),1,0);
else print ($img?$img.' ':'').$object->country;
}
print '</td></tr>';
// State

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.1 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.0 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.1 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.0 KiB

View File

@ -252,6 +252,7 @@ input:disabled {background:#b6b6b6;}
input[type=checkbox] { background-color: transparent; border: none; box-shadow: none; }
input[type=radio] { background-color: transparent; border: none; box-shadow: none; }
input[type=image] { background-color: transparent; border: none; box-shadow: none; }
input[type=text] { min-width: 20px; }
input:-webkit-autofill {
background-color: <?php echo empty($dol_use_jmobile)?'#FBFFEA':'#FFFFFF' ?> !important;
background-image:none !important;
@ -1247,8 +1248,8 @@ table.liste td {padding:1px 2px 1px 0px;}
.tagtable, .table-border { display: table; }
.tagtr, .table-border-row { display: table-row; }
.tagtd, .table-border-col, .table-key-border-col, .table-val-border-col { display: table-cell; }
.tagtable form { display: table-row; }
.tagtable form div { display: table-cell; }
.tagtable form, .tagtable div { display: table-row; }
.tagtable form div, .tagtable div div { display: table-cell; }
tr.liste_titre, tr.liste_titre_sel, form.liste_titre, form.liste_titre_sel
{
@ -2087,6 +2088,27 @@ div.jnotify-background {
}
/* ============================================================================== */
/* Maps */
/* ============================================================================== */
.divmap, #google-visualization-geomap-embed-0, #google-visualization-geomap-embed-1, google-visualization-geomap-embed-2 {
-moz-box-shadow: 0px 0px 10px #AAA;
-webkit-box-shadow: 0px 0px 10px #AAA;
box-shadow: 0px 0px 10px #AAA;
}
/* ============================================================================== */
/* Datatable */
/* ============================================================================== */
.sorting_asc { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_asc.png',1); ?>') no-repeat center right;
.sorting_desc { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_desc.png',1); ?>') no-repeat center right;
.sorting_asc_disabled { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_asc_disabled',1); ?>') no-repeat center right;
.sorting_desc_disabled { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_desc_disabled',1); ?>') no-repeat center right;
/* ============================================================================== */
/* JMobile */
/* ============================================================================== */

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.1 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.0 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.1 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.0 KiB

View File

@ -149,6 +149,7 @@ textarea:disabled {
input[type=checkbox] { background-color: transparent; border: none; box-shadow: none; }
input[type=radio] { background-color: transparent; border: none; box-shadow: none; }
input[type=image] { background-color: transparent; border: none; box-shadow: none; }
input[type=text] { min-width: 20px; }
input:-webkit-autofill {
background-color: <?php echo empty($dol_use_jmobile)?'#FBFFEA':'#FFFFFF' ?> !important;
background-image:none !important;
@ -1359,8 +1360,8 @@ table.liste td {
.tagtable, .table-border { display: table; }
.tagtr, .table-border-row { display: table-row; }
.tagtd, .table-border-col, .table-key-border-col, .table-val-border-col { display: table-cell; }
.tagtable form { display: table-row; }
.tagtable form div { display: table-cell; }
.tagtable form, .tagtable div { display: table-row; }
.tagtable form div, .tagtable div div { display: table-cell; }
tr.liste_titre, tr.liste_titre_sel, form.liste_titre, form.liste_titre_sel
{
@ -2277,6 +2278,16 @@ div.ecmjqft {
}
/* ============================================================================== */
/* Datatable */
/* ============================================================================== */
.sorting_asc { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_asc.png',1); ?>') no-repeat center right;
.sorting_desc { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_desc.png',1); ?>') no-repeat center right;
.sorting_asc_disabled { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_asc_disabled',1); ?>') no-repeat center right;
.sorting_desc_disabled { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_desc_disabled',1); ?>') no-repeat center right;
/* ============================================================================== */
/* JMobile */
/* ============================================================================== */

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.1 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.0 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.1 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.0 KiB

View File

@ -161,6 +161,7 @@ textarea:disabled {
input[type=checkbox] { background-color: transparent; border: none; box-shadow: none; }
input[type=radio] { background-color: transparent; border: none; box-shadow: none; }
input[type=image] { background-color: transparent; border: none; box-shadow: none; }
input[type=text] { min-width: 20px; }
input:-webkit-autofill {
background-color: <?php echo empty($dol_use_jmobile)?'#FBFFEA':'#FFFFFF' ?> !important;
background-image:none !important;
@ -1469,8 +1470,8 @@ table.noborder {
.tagtable, .table-border { display: table; }
.tagtr, .table-border-row { display: table-row; }
.tagtd, .table-border-col, .table-key-border-col, .table-val-border-col { display: table-cell; }
.tagtable form { display: table-row; }
.tagtable form div { display: table-cell; }
.tagtable form, .tagtable div { display: table-row; }
.tagtable form div, .tagtable div div { display: table-cell; }
tr.liste_titre, form.liste_titre {
height: 25px;
@ -2443,6 +2444,27 @@ div.ecmjqft {
}
/* ============================================================================== */
/* Maps */
/* ============================================================================== */
.divmap, #google-visualization-geomap-embed-0, #google-visualization-geomap-embed-1, google-visualization-geomap-embed-2 {
-moz-box-shadow: 0px 0px 10px #AAA;
-webkit-box-shadow: 0px 0px 10px #AAA;
box-shadow: 0px 0px 10px #AAA;
}
/* ============================================================================== */
/* Datatable */
/* ============================================================================== */
.sorting_asc { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_asc.png',1); ?>') no-repeat center right;
.sorting_desc { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_desc.png',1); ?>') no-repeat center right;
.sorting_asc_disabled { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_asc_disabled',1); ?>') no-repeat center right;
.sorting_desc_disabled { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_desc_disabled',1); ?>') no-repeat center right;
/* ============================================================================== */
/* JMobile */
/* ============================================================================== */

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.1 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.0 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.1 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.0 KiB

View File

@ -127,6 +127,7 @@ textarea:disabled {
input[type=checkbox] { background-color: transparent; border: none; box-shadow: none; }
input[type=radio] { background-color: transparent; border: none; box-shadow: none; }
input[type=image] { background-color: transparent; border: none; box-shadow: none; }
input[type=text] { min-width: 20px; }
input:-webkit-autofill {
background-color: <?php echo empty($dol_use_jmobile)?'#FBFFEA':'#FFFFFF' ?> !important;
background-image:none !important;
@ -1496,8 +1497,8 @@ table.liste td {
.tagtable, .table-border { display: table; }
.tagtr, .table-border-row { display: table-row; }
.tagtd, .table-border-col, .table-key-border-col, .table-val-border-col { display: table-cell; }
.tagtable form { display: table-row; }
.tagtable form div { display: table-cell; }
.tagtable form, .tagtable div { display: table-row; }
.tagtable form div, .tagtable div div { display: table-cell; }
tr.liste_titre, tr.liste_titre_sel, form.liste_titre, form.liste_titre_sel
{
@ -2337,6 +2338,26 @@ div.ecmjqft {
}
/* ============================================================================== */
/* Maps */
/* ============================================================================== */
.divmap, #google-visualization-geomap-embed-0, #google-visualization-geomap-embed-1, google-visualization-geomap-embed-2 {
-moz-box-shadow: 0px 0px 10px #AAA;
-webkit-box-shadow: 0px 0px 10px #AAA;
box-shadow: 0px 0px 10px #AAA;
}
/* ============================================================================== */
/* Datatable */
/* ============================================================================== */
.sorting_asc { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_asc.png',1); ?>') no-repeat center right;
.sorting_desc { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_desc.png',1); ?>') no-repeat center right;
.sorting_asc_disabled { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_asc_disabled',1); ?>') no-repeat center right;
.sorting_desc_disabled { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_desc_disabled',1); ?>') no-repeat center right;
/* ============================================================================== */
/* JMobile */

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.1 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.0 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.1 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.0 KiB

View File

@ -292,6 +292,7 @@ textarea:disabled {
input[type=checkbox] { background-color: transparent; border: none; box-shadow: none; }
input[type=radio] { background-color: transparent; border: none; box-shadow: none; }
input[type=image] { background-color: transparent; border: none; box-shadow: none; }
input[type=text] { min-width: 20px; }
input:-webkit-autofill {
background-color: <?php echo empty($dol_use_jmobile)?'#FBFFEA':'#FFFFFF' ?> !important;
background-image:none !important;
@ -1723,8 +1724,8 @@ table.liste td {
.tagtable, .table-border { display: table; }
.tagtr, .table-border-row { display: table-row; }
.tagtd, .table-border-col, .table-key-border-col, .table-val-border-col { display: table-cell; }
.tagtable form { display: table-row; }
.tagtable form div { display: table-cell; }
.tagtable form, .tagtable div { display: table-row; }
.tagtable form div, .tagtable div div { display: table-cell; }
tr.liste_titre, tr.liste_titre_sel, form.liste_titre, form.liste_titre_sel, table.dataTable.tr
{
@ -2677,6 +2678,14 @@ div.dolEventError h1, div.dolEventError h2 {
}
/* ============================================================================== */
/* Datatable */
/* ============================================================================== */
.sorting_asc { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_asc.png',1); ?>') no-repeat center right;
.sorting_desc { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_desc.png',1); ?>') no-repeat center right;
.sorting_asc_disabled { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_asc_disabled',1); ?>') no-repeat center right;
.sorting_desc_disabled { background: url('<?php echo dol_buildpath('/theme/'.$theme.'/img/sort_desc_disabled',1); ?>') no-repeat center right;
/* ============================================================================== */

View File

@ -78,6 +78,8 @@ class AllTests
$suite->addTestSuite('FunctionsTest');
require_once dirname(__FILE__).'/Functions2Test.php';
$suite->addTestSuite('Functions2Test');
require_once dirname(__FILE__).'/XCalLibTest.php';
$suite->addTestSuite('XCalLibTest');
require_once dirname(__FILE__).'/SecurityTest.php';
$suite->addTestSuite('SecurityTest');

View File

@ -206,10 +206,79 @@ class CoreTest extends PHPUnit_Framework_TestCase
print __METHOD__." DOL_MAIN_URL_ROOT=".DOL_MAIN_URL_ROOT."\n";
print __METHOD__." DOL_URL_ROOT=".DOL_URL_ROOT."\n";
$this->assertEquals(DOL_URL_ROOT,$expectedresult);
// $this->assertEquals(DOL_URL_ROOT,$expectedresult);
return true;
}
/**
* testSqlAndScriptInject
*
* return void
*/
public function testSqlAndScriptInject()
{
global $dolibarr_main_prod;
global $dolibarr_main_url_root;
global $dolibarr_main_data_root;
global $dolibarr_main_document_root;
global $dolibarr_main_data_root_alt;
global $dolibarr_main_document_root_alt;
global $dolibarr_main_db_host;
global $dolibarr_main_db_port;
global $dolibarr_main_db_type;
global $dolibarr_main_db_prefix;
// This is code copied from main.inc.php
/**
* Security: SQL Injection and XSS Injection (scripts) protection (Filters on GET, POST, PHP_SELF).
*
* @param string $val Value
* @param string $type 1=GET, 0=POST, 2=PHP_SELF
* @return int >0 if there is an injection
*/
function test_sql_and_script_inject($val, $type)
{
$sql_inj = 0;
// For SQL Injection (only GET and POST are used to be included into bad escaped SQL requests)
if ($type != 2)
{
$sql_inj += preg_match('/delete[\s]+from/i', $val);
$sql_inj += preg_match('/create[\s]+table/i', $val);
$sql_inj += preg_match('/update.+set.+=/i', $val);
$sql_inj += preg_match('/insert[\s]+into/i', $val);
$sql_inj += preg_match('/select.+from/i', $val);
$sql_inj += preg_match('/union.+select/i', $val);
$sql_inj += preg_match('/(\.\.%2f)+/i', $val);
}
// For XSS Injection done by adding javascript with script
// This is all cases a browser consider text is javascript:
// When it found '<script', 'javascript:', '<style', 'onload\s=' on body tag, '="&' on a tag size with old browsers
// All examples on page: http://ha.ckers.org/xss.html#XSScalc
$sql_inj += preg_match('/<script/i', $val);
if (! defined('NOSTYLECHECK')) $sql_inj += preg_match('/<style/i', $val);
$sql_inj += preg_match('/base[\s]+href/i', $val);
if ($type == 1)
{
$sql_inj += preg_match('/javascript:/i', $val);
$sql_inj += preg_match('/vbscript:/i', $val);
}
// For XSS Injection done by adding javascript closing html tags like with onmousemove, etc... (closing a src or href tag with not cleaned param)
if ($type == 1) $sql_inj += preg_match('/"/i', $val); // We refused " in GET parameters value
if ($type == 2) $sql_inj += preg_match('/[\s;"]/', $val); // PHP_SELF is an url and must match url syntax
return $sql_inj;
}
//type=2 key=0 value=/DIR WITH SPACE/htdocs/admin/index.php?mainmenu=home&leftmenu=setup&username=weservices
$_SERVER["PHP_SELF"]='/DIR WITH SPACE/htdocs/admin/index.php?mainmenu=home&leftmenu=setup&username=weservices';
$result=test_sql_and_script_inject($_SERVER["PHP_SELF"],2);
$expectedresult=1;
$this->assertEquals($result,$expectedresult);
}
}
?>

View File

@ -0,0 +1,141 @@
<?php
/* Copyright (C) 2010-2012 Laurent Destailleur <eldy@users.sourceforge.net>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
* or see http://www.gnu.org/
*/
/**
* \file test/phpunit/XCalLibTest.php
* \ingroup test
* \brief PHPUnit test
* \remarks To run this script as CLI: phpunit filename.php
*/
global $conf,$user,$langs,$db;
//define('TEST_DB_FORCE_TYPE','mysql'); // This is to force using mysql driver
require_once 'PHPUnit/Autoload.php';
require_once dirname(__FILE__).'/../../htdocs/master.inc.php';
require_once dirname(__FILE__).'/../../htdocs/core/lib/xcal.lib.php';
if (empty($user->id))
{
print "Load permissions for admin user nb 1\n";
$user->fetch(1);
$user->getrights();
}
$conf->global->MAIN_DISABLE_ALL_MAILS=1;
/**
* Class for PHPUnit tests
*
* @backupGlobals disabled
* @backupStaticAttributes enabled
* @remarks backupGlobals must be disabled to have db,conf,user and lang not erased.
*/
class XCalLibTest extends PHPUnit_Framework_TestCase
{
protected $savconf;
protected $savuser;
protected $savlangs;
protected $savdb;
/**
* Constructor
* We save global variables into local variables
*
* @return FilesLibTest
*/
function __construct()
{
//$this->sharedFixture
global $conf,$user,$langs,$db;
$this->savconf=$conf;
$this->savuser=$user;
$this->savlangs=$langs;
$this->savdb=$db;
print __METHOD__." db->type=".$db->type." user->id=".$user->id;
//print " - db ".$db->db;
print "\n";
}
// Static methods
public static function setUpBeforeClass()
{
global $conf,$user,$langs,$db;
$db->begin(); // This is to have all actions inside a transaction even if test launched without suite.
print __METHOD__."\n";
}
public static function tearDownAfterClass()
{
global $conf,$user,$langs,$db;
$db->rollback();
print __METHOD__."\n";
}
/**
* Init phpunit tests
*
* @return void
*/
protected function setUp()
{
global $conf,$user,$langs,$db;
$conf=$this->savconf;
$user=$this->savuser;
$langs=$this->savlangs;
$db=$this->savdb;
print __METHOD__."\n";
}
/**
* End phpunit tests
*
* @return void
*/
protected function tearDown()
{
print __METHOD__."\n";
}
/**
* testQuotedPrintEncodeDecode
*
* @return void
*/
public function testQuotedPrintEncodeDecode()
{
global $conf,$user,$langs,$db;
$conf=$this->savconf;
$user=$this->savuser;
$langs=$this->savlangs;
$db=$this->savdb;
$stringtoencode='ABCD=1234;';
$result=quotedPrintEncode($stringtoencode);
print __METHOD__." result=".$result."\n";
$this->assertEquals('ABCD=3D1234;',$result);
$resultback=quotedPrintDecode($result);
print __METHOD__." result=".$resultback."\n";
$this->assertEquals($stringtoencode,$resultback);
}
}
?>