lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix sql injection

Browse Source
This commit is contained in:
Laurent Destailleur 2019-09-06 15:20:04 +02:00
parent cad9a59d2a
commit 348ab4765c
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/categories/viewcat.php
View File

@ -40,7 +40,7 @@ $type = GETPOST('type', 'az09');
$action=GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
$removeelem = GETPOST('removeelem', 'int');
$elemid = GETPOST('elemid', 'alpha');
$elemid = GETPOST('elemid', 'int');
if ($id == "" && $label == "")
{

6
htdocs/product/class/product.class.php
View File

@ -284,14 +284,14 @@ class Product extends CommonObject
* @var int
*/
public $barcode_type;
/**
* Main Barcode type code
*
* @var string
*/
public $barcode_type_code;
/**
* Additional barcodes (Some products have different barcodes according to the country of origin of manufacture)
*
@ -2052,7 +2052,7 @@ class Product extends CommonObject
$sql.= " fk_price_expression, price_autogen";
$sql.= " FROM ".MAIN_DB_PREFIX."product";
if ($id) {
$sql.= " WHERE rowid = ".$this->db->escape($id);
$sql.= " WHERE rowid = ".(int) $id;
} else {
$sql.= " WHERE entity IN (".getEntity($this->element).")";
if ($ref) {