From 2bb7e4818ca3e41aff945c35888b5e926547c405 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sat, 25 Feb 2006 12:25:26 +0000 Subject: [PATCH] Fix: bug #15799 --- htdocs/commande/liste.php | 12 ++++++------ htdocs/compta/clients.php | 14 +++++++------- htdocs/contrat/services.php | 10 +++++----- htdocs/expedition/liste.php | 6 +++--- htdocs/fourn/facture/index.php | 18 +++++++++--------- htdocs/projet/liste.php | 28 +++++++++++----------------- 6 files changed, 41 insertions(+), 47 deletions(-) diff --git a/htdocs/commande/liste.php b/htdocs/commande/liste.php index 959dc236a7a..0894ddad9b7 100644 --- a/htdocs/commande/liste.php +++ b/htdocs/commande/liste.php @@ -1,6 +1,6 @@ - * Copyright (C) 2004-2005 Laurent Destailleur + * Copyright (C) 2004-2006 Laurent Destailleur * Copyright (C) 2005 Marc Barilley / Ocebo * * This program is free software; you can redistribute it and/or modify @@ -67,11 +67,11 @@ $sql.= ' FROM '.MAIN_DB_PREFIX.'societe as s, '.MAIN_DB_PREFIX.'commande as c'; $sql.= ' WHERE c.fk_soc = s.idp'; if ($sref) { - $sql .= " AND c.ref like '%".$sref."%'"; + $sql .= " AND c.ref like '%".addslashes($sref)."%'"; } if ($sall) { - $sql .= " AND (c.ref like '%".$sall."%' OR c.note like '%".$sall."%')"; + $sql .= " AND (c.ref like '%".addslashes($sall)."%' OR c.note like '%".addslashes($sall)."%')"; } if ($socidp) { @@ -95,15 +95,15 @@ if (isset($_GET['afacturer'])) } if (strlen($_POST['sf_ref']) > 0) { - $sql .= " AND c.ref like '%".$_POST['sf_ref'] . "%'"; + $sql .= " AND c.ref like '%".addslashes($_POST['sf_ref']) . "%'"; } if (!empty($snom)) { - $sql .= ' AND s.nom like \'%'.$snom.'%\''; + $sql .= ' AND s.nom like \'%'.addslashes($snom).'%\''; } if (!empty($sref_client)) { - $sql .= ' AND c.ref_client like \'%'.$sref_client.'%\''; + $sql .= ' AND c.ref_client like \'%'.addslashes($sref_client).'%\''; } $sql .= ' ORDER BY '.$sortfield.' '.$sortorder; diff --git a/htdocs/compta/clients.php b/htdocs/compta/clients.php index c8cdbcc5a54..2e80dec44e8 100644 --- a/htdocs/compta/clients.php +++ b/htdocs/compta/clients.php @@ -118,7 +118,7 @@ if ($action == 'stcomm') if ($mode == 'search') { if ($mode-search == 'soc') { $sql = "SELECT s.idp FROM ".MAIN_DB_PREFIX."societe as s "; - $sql .= " WHERE lower(s.nom) like '%".strtolower($socname)."%'"; + $sql .= " WHERE lower(s.nom) like '%".addslashes(strtolower($socname))."%'"; } if ( $db->query($sql) ) { @@ -147,29 +147,29 @@ if (strlen($stcomm)) if ($socname) { - $sql .= " AND lower(s.nom) like '%".strtolower($socname)."%'"; - $sortfield = "lower(s.nom)"; + $sql .= " AND s.nom like '%".addslashes(strtolower($socname))."%'"; + $sortfield = "s.nom"; $sortorder = "ASC"; } if ($_GET["search_nom"]) { - $sql .= " AND lower(s.nom) like '%".strtolower($_GET["search_nom"])."%'"; + $sql .= " AND s.nom like '%".addslashes(strtolower($_GET["search_nom"]))."%'"; } if ($_GET["search_compta"]) { - $sql .= " AND s.code_compta like '%".$_GET["search_compta"]."%'"; + $sql .= " AND s.code_compta like '%".addslashes($_GET["search_compta"])."%'"; } if ($_GET["search_code_client"]) { - $sql .= " AND s.code_client like '%".$_GET["search_code_client"]."%'"; + $sql .= " AND s.code_client like '%".addslashes($_GET["search_code_client"])."%'"; } if (strlen($begin)) { - $sql .= " AND upper(s.nom) like '$begin%'"; + $sql .= " AND s.nom like '".addslashes($begin)."'"; } if ($user->societe_id) diff --git a/htdocs/contrat/services.php b/htdocs/contrat/services.php index bf0c0af55a7..ca2c86bbf37 100644 --- a/htdocs/contrat/services.php +++ b/htdocs/contrat/services.php @@ -1,6 +1,6 @@ - * Copyright (C) 2004-2005 Laurent Destailleur + * Copyright (C) 2004-2006 Laurent Destailleur * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -77,10 +77,10 @@ if ($mode == "0") $sql.= " AND cd.statut = 0"; if ($mode == "4") $sql.= " AND cd.statut = 4"; if ($mode == "5") $sql.= " AND cd.statut = 5"; if ($filter == "expired") $sql.= " AND date_fin_validite < sysdate()"; -if ($search_nom) $sql.= " AND s.nom like '%".$search_nom."%'"; -if ($search_contract) $sql.= " AND c.rowid = '".$search_contract."'"; -if ($search_service) $sql.= " AND (p.ref like '%".$search_service."%' OR p.label like '%".$search_service."%')"; -if ($socid > 0) $sql.= " AND s.idp = $socid"; +if ($search_nom) $sql.= " AND s.nom like '%".addslashes($search_nom)."%'"; +if ($search_contract) $sql.= " AND c.rowid = '".addslashes($search_contract)."'"; +if ($search_service) $sql.= " AND (p.ref like '%".addslashes($search_service)."%' OR p.label like '%".addslashes($search_service)."%')"; +if ($socid > 0) $sql.= " AND s.idp = ".$socid; $sql .= " ORDER BY $sortfield $sortorder"; $sql .= $db->plimit($limit + 1 ,$offset); diff --git a/htdocs/expedition/liste.php b/htdocs/expedition/liste.php index 910122caa3a..2aec9282c77 100644 --- a/htdocs/expedition/liste.php +++ b/htdocs/expedition/liste.php @@ -1,6 +1,6 @@ - * Copyright (C) 2004-2005 Laurent Destailleur + * Copyright (C) 2004-2006 Laurent Destailleur * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -65,9 +65,9 @@ if ($socidp) $sql.= $sql_add . " e.fk_commande = c.rowid AND c.fk_soc = ".$socidp; $sql_add = " AND "; } -if (strlen($_POST["sf_ref"]) > 0) +if ($_POST["sf_ref"]) { - $sql.= $sql_add . " e.ref like '%".$_POST["sf_ref"] . "%'"; + $sql.= $sql_add . " e.ref like '%".addslashes($_POST["sf_ref"])."%'"; } $expedition = new Expedition($db); diff --git a/htdocs/fourn/facture/index.php b/htdocs/fourn/facture/index.php index 9bc99843e0e..5007b769e52 100644 --- a/htdocs/fourn/facture/index.php +++ b/htdocs/fourn/facture/index.php @@ -1,6 +1,6 @@ - * Copyright (C) 2004-2005 Laurent Destailleur + * Copyright (C) 2004-2006 Laurent Destailleur * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -18,7 +18,6 @@ * * $Id$ * $Source$ - * */ /** @@ -73,7 +72,7 @@ if ($_POST["mode"] == 'search') if ($_POST["mode-search"] == 'soc') { $sql = "SELECT s.idp FROM ".MAIN_DB_PREFIX."societe as s "; - $sql .= " WHERE lower(s.nom) like '%".strtolower($socname)."%'"; + $sql.= " WHERE s.nom like '%".addslashes(strtolower($socname))."%'"; } if ( $db->query($sql) ) @@ -88,7 +87,6 @@ if ($_POST["mode"] == 'search') } -llxHeader(); /* @@ -96,6 +94,8 @@ llxHeader(); * */ +llxHeader(); + $sql = "SELECT s.idp as socid, s.nom, ".$db->pdate("fac.date_lim_reglement")." as date_echeance, fac.total_ht, fac.total_ttc, fac.paye as paye, fac.fk_statut as fk_statut, fac.libelle, fac.rowid as facid, fac.facnumber"; $sql .= " FROM ".MAIN_DB_PREFIX."societe as s, ".MAIN_DB_PREFIX."facture_fourn as fac "; $sql .= " WHERE fac.fk_soc = s.idp"; @@ -115,27 +115,27 @@ if ($_GET["filtre"]) if ($_GET["search_ref"]) { - $sql .= " AND fac.facnumber like '%".$_GET["search_ref"]."%'"; + $sql .= " AND fac.facnumber like '%".addslashes($_GET["search_ref"])."%'"; } if ($_GET["search_libelle"]) { - $sql .= " AND fac.libelle like '%".$_GET["search_libelle"]."%'"; + $sql .= " AND fac.libelle like '%".addslashes($_GET["search_libelle"])."%'"; } if ($_GET["search_societe"]) { - $sql .= " AND s.nom like '%".$_GET["search_societe"]."%'"; + $sql .= " AND s.nom like '%".addslashes($_GET["search_societe"])."%'"; } if ($_GET["search_montant_ht"]) { - $sql .= " AND fac.total_ht = '".$_GET["search_montant_ht"]."'"; + $sql .= " AND fac.total_ht = '".addslashes($_GET["search_montant_ht"])."'"; } if ($_GET["search_montant_ttc"]) { - $sql .= " AND fac.total_ttc = '".$_GET["search_montant_ttc"]."'"; + $sql .= " AND fac.total_ttc = '".addslashes($_GET["search_montant_ttc"])."'"; } $sql .= " ORDER BY $sortfield $sortorder " . $db->plimit( $limit+1, $offset); diff --git a/htdocs/projet/liste.php b/htdocs/projet/liste.php index 9a24912cfc1..21ec37104b3 100644 --- a/htdocs/projet/liste.php +++ b/htdocs/projet/liste.php @@ -1,6 +1,6 @@ - * Copyright (C) 2004-2005 Laurent Destailleur + * Copyright (C) 2004-2006 Laurent Destailleur * Copyright (C) 2005 Marc Bariley / Ocebo * * This program is free software; you can redistribute it and/or modify @@ -53,46 +53,40 @@ $page = isset($_GET["page"])? $_GET["page"]:$_POST["page"]; $page = is_numeric($page) ? $page : 0; $page = $page == -1 ? 0 : $page; -if ($sortfield == "") -{ - $sortfield="p.ref"; -} -if ($sortorder == "") -{ - $sortorder="ASC"; -} - +if (! $sortfield) $sortfield="p.ref"; +if (! $sortorder) $sortorder="ASC"; $offset = $conf->liste_limit * $page ; $pageprev = $page - 1; $pagenext = $page + 1; -llxHeader(); -/* - * +/** * Affichage de la liste des projets * */ + +llxHeader(); + $sql = "SELECT p.rowid as projectid, p.ref, p.title, ".$db->pdate("p.dateo")." as do"; $sql .= " , s.nom, s.idp, s.client"; $sql .= " FROM ".MAIN_DB_PREFIX."societe as s, ".MAIN_DB_PREFIX."projet as p"; $sql .= " WHERE p.fk_soc = s.idp"; if ($socid) { - $sql .= " AND s.idp = $socid"; + $sql .= " AND s.idp = ".$socid; } if ($_GET["search_ref"]) { - $sql .= " AND p.ref LIKE '%".$_GET["search_ref"]."%'"; + $sql .= " AND p.ref LIKE '%".addslashes($_GET["search_ref"])."%'"; } if ($_GET["search_label"]) { - $sql .= " AND p.title LIKE '%".$_GET["search_label"]."%'"; + $sql .= " AND p.title LIKE '%".addslashes($_GET["search_label"])."%'"; } if ($_GET["search_societe"]) { - $sql .= " AND s.nom LIKE '%".$_GET["search_societe"]."%'"; + $sql .= " AND s.nom LIKE '%".addslashes($_GET["search_societe"])."%'"; } $sql .= " ORDER BY $sortfield $sortorder " . $db->plimit($conf->liste_limit+1, $offset);