lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX #21128

Browse Source
This commit is contained in:
Laurent Destailleur 2022-06-07 09:48:20 +02:00
parent fc0f624445
commit 418bd481f3
1 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
htdocs/admin/dict.php
View File

@ -846,12 +846,15 @@ if (empty($reshook)) {
$_POST["code"] = preg_replace('/[^a-zA-Z0-9\-\+]/', '', GETPOST("code")); $_POST["code"] = preg_replace('/[^a-zA-Z0-9\-\+]/', '', GETPOST("code"));
} }
$tablename = $tabname[$id];
$tablename = preg_replace('/^'.preg_quote(MAIN_DB_PREFIX, '/').'/', '', $tablename);
// If check ok and action add, add the line // If check ok and action add, add the line
if ($ok && GETPOST('actionadd')) { if ($ok && GETPOST('actionadd')) {
if ($tabrowid[$id]) { if ($tabrowid[$id]) {
// Get free id for insert // Get free id for insert
$newid = 0; $newid = 0;
$sql = "SELECT MAX(".$tabrowid[$id].") as newid FROM ".MAIN_DB_PREFIX.$tabname[$id]; $sql = "SELECT MAX(".$tabrowid[$id].") as newid FROM ".MAIN_DB_PREFIX.$tablename;
$result = $db->query($sql); $result = $db->query($sql);
if ($result) { if ($result) {
$obj = $db->fetch_object($result); $obj = $db->fetch_object($result);
@ -862,7 +865,7 @@ if (empty($reshook)) {
} }
// Add new entry // Add new entry
$sql = "INSERT INTO ".MAIN_DB_PREFIX.$tabname[$id]." ("; $sql = "INSERT INTO ".MAIN_DB_PREFIX.$tablename." (";
// List of fields // List of fields
if ($tabrowid[$id] && !in_array($tabrowid[$id], $listfieldinsert)) { if ($tabrowid[$id] && !in_array($tabrowid[$id], $listfieldinsert)) {
$sql .= $tabrowid[$id].","; $sql .= $tabrowid[$id].",";
@ -887,7 +890,7 @@ if (empty($reshook)) {
} elseif ($value == 'taux' || $value == 'localtax1') { } elseif ($value == 'taux' || $value == 'localtax1') {
$_POST[$keycode] = price2num(GETPOST($keycode), 8); // Note that localtax2 can be a list of rates separated by coma like X:Y:Z $_POST[$keycode] = price2num(GETPOST($keycode), 8); // Note that localtax2 can be a list of rates separated by coma like X:Y:Z
} elseif ($value == 'entity') { } elseif ($value == 'entity') {
$_POST[$keycode] = getEntity($tabname[$id]); $_POST[$keycode] = getEntity($tablename);
} }
if ($i) { if ($i) {
@ -938,7 +941,7 @@ if (empty($reshook)) {
} }
// Modify entry // Modify entry
$sql = "UPDATE ".MAIN_DB_PREFIX.$tabname[$id]." SET "; $sql = "UPDATE ".MAIN_DB_PREFIX.$tablename." SET ";
// Modifie valeur des champs // Modifie valeur des champs
if ($tabrowid[$id] && !in_array($tabrowid[$id], $listfieldmodify)) { if ($tabrowid[$id] && !in_array($tabrowid[$id], $listfieldmodify)) {
$sql .= $tabrowid[$id]."="; $sql .= $tabrowid[$id]."=";
@ -956,7 +959,7 @@ if (empty($reshook)) {
} elseif ($field == 'taux' || $field == 'localtax1') { } elseif ($field == 'taux' || $field == 'localtax1') {
$_POST[$keycode] = price2num(GETPOST($keycode), 8); // Note that localtax2 can be a list of rates separated by coma like X:Y:Z $_POST[$keycode] = price2num(GETPOST($keycode), 8); // Note that localtax2 can be a list of rates separated by coma like X:Y:Z
} elseif ($field == 'entity') { } elseif ($field == 'entity') {
$_POST[$keycode] = getEntity($tabname[$id]); $_POST[$keycode] = getEntity($tablename);
} }
if ($i) { if ($i) {
@ -983,7 +986,7 @@ if (empty($reshook)) {
$sql .= " WHERE ".$rowidcol." = ".((int) $rowid); $sql .= " WHERE ".$rowidcol." = ".((int) $rowid);
} }
if (in_array('entity', $listfieldmodify)) { if (in_array('entity', $listfieldmodify)) {
$sql .= " AND entity = ".((int) getEntity($tabname[$id], 0)); $sql .= " AND entity = ".((int) getEntity($tablename, 0));
} }
dol_syslog("actionmodify", LOG_DEBUG); dol_syslog("actionmodify", LOG_DEBUG);
@ -1002,7 +1005,10 @@ if (empty($reshook)) {
$rowidcol = "rowid"; $rowidcol = "rowid";
} }
$sql = "DELETE FROM ".MAIN_DB_PREFIX.$tabname[$id]." WHERE ".$rowidcol." = '".$db->escape($rowid)."'".($entity != '' ? " AND entity = ".(int) $entity : ''); $tablename = $tabname[$id];
$tablename = preg_replace('/^'.preg_quote(MAIN_DB_PREFIX, '/').'/', '', $tablename);
$sql = "DELETE FROM ".MAIN_DB_PREFIX.$tablename." WHERE ".$rowidcol." = '".$db->escape($rowid)."'".($entity != '' ? " AND entity = ".(int) $entity : '');
dol_syslog("delete", LOG_DEBUG); dol_syslog("delete", LOG_DEBUG);
$result = $db->query($sql); $result = $db->query($sql);