lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Backport sql injection fix from develop

Browse Source
This commit is contained in:
Laurent Destailleur 2021-09-03 18:00:28 +02:00
parent 531037ddb6
commit 2e3b6b2fc8
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
htdocs/compta/facture/class/facture.class.php
View File

@ -678,8 +678,8 @@ class Facture extends CommonInvoice
$sql .= ", ".($this->fk_facture_source ? "'".$this->db->escape($this->fk_facture_source)."'" : "null");
$sql .= ", ".($user->id > 0 ? (int) $user->id : "null");
$sql .= ", ".($this->fk_project ? $this->fk_project : "null");
$sql .= ", ".$this->cond_reglement_id;
$sql .= ", ".$this->mode_reglement_id;
$sql .= ", ".((int) $this->cond_reglement_id);
$sql .= ", ".((int) $this->mode_reglement_id);
$sql .= ", '".$this->db->idate($this->date_lim_reglement)."'";
$sql .= ", ".(isset($this->model_pdf) ? "'".$this->db->escape($this->model_pdf)."'" : "null");
$sql .= ", ".($this->situation_cycle_ref ? "'".$this->db->escape($this->situation_cycle_ref)."'" : "null");

6
htdocs/fourn/facture/card.php
View File

@ -725,8 +725,8 @@ if (empty($reshook)) {
$object->date_echeance = $datedue;
$object->note_public = GETPOST('note_public', 'restricthtml');
$object->note_private = GETPOST('note_private', 'restricthtml');
$object->cond_reglement_id = GETPOST('cond_reglement_id');
$object->mode_reglement_id = GETPOST('mode_reglement_id');
$object->cond_reglement_id = GETPOST('cond_reglement_id', 'int');
$object->mode_reglement_id = GETPOST('mode_reglement_id', 'int');
$object->fk_account = GETPOST('fk_account', 'int');
$object->fk_project = ($tmpproject > 0) ? $tmpproject : null;
$object->fk_incoterms = GETPOST('incoterm_id', 'int');
@ -736,7 +736,7 @@ if (empty($reshook)) {
$object->transport_mode_id = GETPOST('transport_mode_id', 'int');
// Proprietes particulieres a facture de remplacement
$object->fk_facture_source = GETPOST('fac_replacement');
$object->fk_facture_source = GETPOST('fac_replacement', 'int');
$object->type = FactureFournisseur::TYPE_REPLACEMENT;
$id = $object->createFromCurrent($user);