diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 4439a38509b..0c7bb3f08dc 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -353,12 +353,14 @@ function GETPOSTISSET($paramname) } } } - // If there is saved contextpage, page or limit + // If there is saved contextpage, limit, page or mode if ($paramname == 'contextpage' && !empty($_SESSION['lastsearch_contextpage_'.$relativepathstring])) { $isset = true; + } elseif ($paramname == 'limit' && !empty($_SESSION['lastsearch_limit_'.$relativepathstring])) { + $isset = true; } elseif ($paramname == 'page' && !empty($_SESSION['lastsearch_page_'.$relativepathstring])) { $isset = true; - } elseif ($paramname == 'limit' && !empty($_SESSION['lastsearch_limit_'.$relativepathstring])) { + } elseif ($paramname == 'mode' && !empty($_SESSION['lastsearch_mode_'.$relativepathstring])) { $isset = true; } } else { @@ -448,10 +450,12 @@ function GETPOST($paramname, $check = 'alphanohtml', $method = 0, $filter = null // If there is saved contextpage, page or limit if ($paramname == 'contextpage' && !empty($_SESSION['lastsearch_contextpage_'.$relativepathstring])) { $out = $_SESSION['lastsearch_contextpage_'.$relativepathstring]; - } elseif ($paramname == 'page' && !empty($_SESSION['lastsearch_page_'.$relativepathstring])) { - $out = $_SESSION['lastsearch_page_'.$relativepathstring]; } elseif ($paramname == 'limit' && !empty($_SESSION['lastsearch_limit_'.$relativepathstring])) { $out = $_SESSION['lastsearch_limit_'.$relativepathstring]; + } elseif ($paramname == 'page' && !empty($_SESSION['lastsearch_page_'.$relativepathstring])) { + $out = $_SESSION['lastsearch_page_'.$relativepathstring]; + } elseif ($paramname == 'mode' && !empty($_SESSION['lastsearch_mode_'.$relativepathstring])) { + $out = $_SESSION['lastsearch_mode_'.$relativepathstring]; } } elseif (!isset($_GET['sortfield'])) { // Else, retrieve default values if we are not doing a sort diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php index 0547eba7782..2d977e5a288 100644 --- a/htdocs/main.inc.php +++ b/htdocs/main.inc.php @@ -934,7 +934,7 @@ if (!defined('NOLOGIN')) { $relativepathstring = preg_replace('/^custom\//', '', $relativepathstring); //var_dump($relativepathstring); - // We click on a link that leave a page we have to save search criteria, contextpage, limit and page. We save them from tmp to no tmp + // We click on a link that leave a page we have to save search criteria, contextpage, limit and page and mode. We save them from tmp to no tmp if (!empty($_SESSION['lastsearch_values_tmp_'.$relativepathstring])) { $_SESSION['lastsearch_values_'.$relativepathstring] = $_SESSION['lastsearch_values_tmp_'.$relativepathstring]; unset($_SESSION['lastsearch_values_tmp_'.$relativepathstring]); @@ -943,13 +943,17 @@ if (!defined('NOLOGIN')) { $_SESSION['lastsearch_contextpage_'.$relativepathstring] = $_SESSION['lastsearch_contextpage_tmp_'.$relativepathstring]; unset($_SESSION['lastsearch_contextpage_tmp_'.$relativepathstring]); } + if (!empty($_SESSION['lastsearch_limit_tmp_'.$relativepathstring]) && $_SESSION['lastsearch_limit_tmp_'.$relativepathstring] != $conf->liste_limit) { + $_SESSION['lastsearch_limit_'.$relativepathstring] = $_SESSION['lastsearch_limit_tmp_'.$relativepathstring]; + unset($_SESSION['lastsearch_limit_tmp_'.$relativepathstring]); + } if (!empty($_SESSION['lastsearch_page_tmp_'.$relativepathstring]) && $_SESSION['lastsearch_page_tmp_'.$relativepathstring] > 0) { $_SESSION['lastsearch_page_'.$relativepathstring] = $_SESSION['lastsearch_page_tmp_'.$relativepathstring]; unset($_SESSION['lastsearch_page_tmp_'.$relativepathstring]); } - if (!empty($_SESSION['lastsearch_limit_tmp_'.$relativepathstring]) && $_SESSION['lastsearch_limit_tmp_'.$relativepathstring] != $conf->liste_limit) { - $_SESSION['lastsearch_limit_'.$relativepathstring] = $_SESSION['lastsearch_limit_tmp_'.$relativepathstring]; - unset($_SESSION['lastsearch_limit_tmp_'.$relativepathstring]); + if (!empty($_SESSION['lastsearch_mode_tmp_'.$relativepathstring])) { + $_SESSION['lastsearch_mode_'.$relativepathstring] = $_SESSION['lastsearch_mode_tmp_'.$relativepathstring]; + unset($_SESSION['lastsearch_mode_tmp_'.$relativepathstring]); } } @@ -3110,7 +3114,7 @@ if (!function_exists("llxFooter")) { { global $conf, $db, $langs, $user, $mysoc, $object, $hookmanager; global $delayedhtmlcontent; - global $contextpage, $page, $limit; + global $contextpage, $page, $limit, $mode; global $dolibarr_distrib; $ext = 'layout='.$conf->browser->layout.'&version='.urlencode(DOL_VERSION); @@ -3150,6 +3154,7 @@ if (!function_exists("llxFooter")) { unset($_SESSION['lastsearch_contextpage_tmp_'.$relativepathstring]); unset($_SESSION['lastsearch_page_tmp_'.$relativepathstring]); unset($_SESSION['lastsearch_limit_tmp_'.$relativepathstring]); + unset($_SESSION['lastsearch_mode_tmp_'.$relativepathstring]); if (!empty($contextpage)) { $_SESSION['lastsearch_contextpage_tmp_'.$relativepathstring] = $contextpage; @@ -3160,10 +3165,14 @@ if (!function_exists("llxFooter")) { if (!empty($limit) && $limit != $conf->liste_limit) { $_SESSION['lastsearch_limit_tmp_'.$relativepathstring] = $limit; } + if (!empty($mode)) { + $_SESSION['lastsearch_mode_tmp_'.$relativepathstring] = $mode; + } unset($_SESSION['lastsearch_contextpage_'.$relativepathstring]); unset($_SESSION['lastsearch_page_'.$relativepathstring]); unset($_SESSION['lastsearch_limit_'.$relativepathstring]); + unset($_SESSION['lastsearch_mode_'.$relativepathstring]); } // Core error message diff --git a/htdocs/modulebuilder/template/myobject_list.php b/htdocs/modulebuilder/template/myobject_list.php index 79e11006116..f45072bc607 100644 --- a/htdocs/modulebuilder/template/myobject_list.php +++ b/htdocs/modulebuilder/template/myobject_list.php @@ -304,17 +304,17 @@ foreach ($search as $key => $val) { $mode_search = 2; } if ($search[$key] != '') { - $sql .= natural_search('t.'.$key, $search[$key], (($key == 'status') ? 2 : $mode_search)); + $sql .= natural_search("t.".$db->escape($key), $search[$key], (($key == 'status') ? 2 : $mode_search)); } } else { if (preg_match('/(_dtstart|_dtend)$/', $key) && $search[$key] != '') { $columnName = preg_replace('/(_dtstart|_dtend)$/', '', $key); if (preg_match('/^(date|timestamp|datetime)/', $object->fields[$columnName]['type'])) { if (preg_match('/_dtstart$/', $key)) { - $sql .= " AND t.".$columnName." >= '".$db->idate($search[$key])."'"; + $sql .= " AND t.".$db->escape($columnName)." >= '".$db->idate($search[$key])."'"; } if (preg_match('/_dtend$/', $key)) { - $sql .= " AND t." . $columnName . " <= '" . $db->idate($search[$key]) . "'"; + $sql .= " AND t.".$db->escape($columnName)." <= '" . $db->idate($search[$key])."'"; } } }