lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX sql bad request in product buying price extrafields

Browse Source
This commit is contained in:
VESSILLER 2019-12-26 16:18:26 +01:00 committed by Laurent Destailleur
parent 15ad41ee6d
commit 6e9bb5d7da
1 changed files with 76 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
htdocs/product/fournisseurs.php
View File

@ -265,32 +265,31 @@ if (empty($reshook))
$extralabels = $extrafields->fetch_name_optionals_label("product_fournisseur_price"); $extralabels = $extrafields->fetch_name_optionals_label("product_fournisseur_price");
$extrafield_values = $extrafields->getOptionalsFromPost("product_fournisseur_price"); $extrafield_values = $extrafields->getOptionalsFromPost("product_fournisseur_price");
if (!empty($extrafield_values)) {
$sql = ""; $resql = $db->query("SELECT fk_object FROM " . MAIN_DB_PREFIX . "product_fournisseur_price_extrafields WHERE fk_object = " . $object->product_fourn_price_id);
$resql = $db->query("SELECT * FROM ".MAIN_DB_PREFIX."product_fournisseur_price_extrafields WHERE fk_object = ".$object->product_fourn_price_id);
// Insert a new extrafields row, if none exists // Insert a new extrafields row, if none exists
if ($db->num_rows($resql) != 1) { if ($db->num_rows($resql) != 1) {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."product_fournisseur_price_extrafields (fk_object, "; $sql = "INSERT INTO " . MAIN_DB_PREFIX . "product_fournisseur_price_extrafields (fk_object, ";
foreach ($extrafield_values as $key => $value) { foreach ($extrafield_values as $key => $value) {
$sql .= str_replace('options_', '', $key).', '; $sql .= str_replace('options_', '', $key) . ', ';
} }
$sql = substr($sql, 0, strlen($sql) - 2).") VALUES (".$object->product_fourn_price_id.", "; $sql = substr($sql, 0, strlen($sql) - 2) . ") VALUES (" . $object->product_fourn_price_id . ", ";
foreach ($extrafield_values as $key => $value) { foreach ($extrafield_values as $key => $value) {
$sql .= '"'.$value.'", '; $sql .= '"' . $value . '", ';
} }
$sql = substr($sql, 0, strlen($sql) - 2).')'; $sql = substr($sql, 0, strlen($sql) - 2) . ')';
} } // else update the existing one
// else update the existing one
else { else {
$sql = "UPDATE ".MAIN_DB_PREFIX."product_fournisseur_price_extrafields SET "; $sql = "UPDATE " . MAIN_DB_PREFIX . "product_fournisseur_price_extrafields SET ";
foreach ($extrafield_values as $key => $value) { foreach ($extrafield_values as $key => $value) {
$sql .= str_replace('options_', '', $key).' = "'.$value.'", '; $sql .= str_replace('options_', '', $key) . ' = "' . $value . '", ';
} }
$sql = substr($sql, 0, strlen($sql) - 2).' WHERE fk_object = '.$object->product_fourn_price_id; $sql = substr($sql, 0, strlen($sql) - 2) . ' WHERE fk_object = ' . $object->product_fourn_price_id;
} }
// Execute the sql command from above // Execute the sql command from above
$db->query($sql); $db->query($sql);
}
$newprice = price2num(GETPOST("price", "alpha")); $newprice = price2num(GETPOST("price", "alpha"));
@ -765,24 +764,35 @@ SCRIPT;
print '</tr>'; print '</tr>';
} }
// Extrafields
$extrafields->fetch_name_optionals_label("product_fournisseur_price"); $extrafields->fetch_name_optionals_label("product_fournisseur_price");
$extralabels = $extrafields->attributes["product_fournisseur_price"]['label']; $extralabels = $extrafields->attributes["product_fournisseur_price"]['label'];
// Extrafields $extrafield_values = $extrafields->getOptionalsFromPost("product_fournisseur_price");
$resql = $db->query("SELECT * FROM ".MAIN_DB_PREFIX."product_fournisseur_price_extrafields WHERE fk_object = ".$rowid);
if (!empty($extralabels)) { if (!empty($extralabels)) {
if ($db->num_rows($resql) != 1) { if (empty($rowid)) {
foreach ($extralabels as $key => $value) { foreach ($extralabels as $key => $value) {
if (!empty($extrafields->attributes["product_fournisseur_price"]['list'][$key]) && ($extrafields->attributes["product_fournisseur_price"]['list'][$key] == 1 || $extrafields->attributes["product_fournisseur_price"]['list'][$key] == 3 || ($action == "update_price" && $extrafields->attributes["product_fournisseur_price"]['list'][$key] == 4))) { if (!empty($extrafields->attributes["product_fournisseur_price"]['list'][$key]) && ($extrafields->attributes["product_fournisseur_price"]['list'][$key] == 1 || $extrafields->attributes["product_fournisseur_price"]['list'][$key] == 3 || ($action == "update_price" && $extrafields->attributes["product_fournisseur_price"]['list'][$key] == 4))) {
print '<tr><td'.($extrafields->attributes["product_fournisseur_price"]['required'][$key] ? ' class="fieldrequired"' : '').'>'.$langs->trans($value).'</td><td>'.$extrafields->showInputField($key, '', '', '', '', '', 0, 'product_fournisseur_price').'</td></tr>'; print '<tr><td'.($extrafields->attributes["product_fournisseur_price"]['required'][$key] ? ' class="fieldrequired"' : '').'>'.$langs->trans($value).'</td><td>'.$extrafields->showInputField($key, GETPOSTISSET('options_' . $key) ? $extrafield_values['options_' . $key] : '', '', '', '', '', 0, 'product_fournisseur_price').'</td></tr>';
} }
} }
} else { } else {
$resql = $db->fetch_object($resql); $sql = "SELECT";
$sql .= " fk_object";
foreach ($extralabels as $key => $value) {
$sql .= ", " . $key;
}
$sql .= " FROM " . MAIN_DB_PREFIX . "product_fournisseur_price_extrafields";
$sql .= " WHERE fk_object = " . $rowid;
$resql = $db->query($sql);
if ($resql) {
$obj = $db->fetch_object($resql);
foreach ($extralabels as $key => $value) { foreach ($extralabels as $key => $value) {
if (!empty($extrafields->attributes["product_fournisseur_price"]['list'][$key]) && ($extrafields->attributes["product_fournisseur_price"]['list'][$key] == 1 || $extrafields->attributes["product_fournisseur_price"]['list'][$key] == 3 || ($action == "update_price" && $extrafields->attributes["product_fournisseur_price"]['list'][$key] == 4))) { if (!empty($extrafields->attributes["product_fournisseur_price"]['list'][$key]) && ($extrafields->attributes["product_fournisseur_price"]['list'][$key] == 1 || $extrafields->attributes["product_fournisseur_price"]['list'][$key] == 3 || ($action == "update_price" && $extrafields->attributes["product_fournisseur_price"]['list'][$key] == 4))) {
print '<tr><td'.($extrafields->attributes["product_fournisseur_price"]['required'][$key] ? ' class="fieldrequired"' : '').'>'.$langs->trans($value).'</td><td>'.$extrafields->showInputField($key, $resql->{$key}, '', '', '', '', 0, 'product_fournisseur_price').'</td></tr>'; print '<tr><td'.($extrafields->attributes["product_fournisseur_price"]['required'][$key] ? ' class="fieldrequired"' : '').'>'.$langs->trans($value).'</td><td>'.$extrafields->showInputField($key, GETPOSTISSET('options_' . $key) ? $extrafield_values['options_' . $key] : $obj->{$key}, '', '', '', '', 0, 'product_fournisseur_price').'</td></tr>';
} }
} }
$db->free($resql);
}
} }
} }
@ -1008,8 +1018,16 @@ SCRIPT;
print '</td>'; print '</td>';
// Extrafields // Extrafields
$resql = $db->query("SELECT * FROM ".MAIN_DB_PREFIX."product_fournisseur_price_extrafields WHERE fk_object = ".$productfourn->product_fourn_price_id);
if (!empty($extralabels)) { if (!empty($extralabels)) {
$sql = "SELECT";
$sql .= " fk_object";
foreach ($extralabels as $key => $value) {
$sql .= ", " . $key;
}
$sql .= " FROM " . MAIN_DB_PREFIX . "product_fournisseur_price_extrafields";
$sql .= " WHERE fk_object = " . $productfourn->product_fourn_price_id;
$resql = $db->query($sql);
if ($resql) {
if ($db->num_rows($resql) != 1) { if ($db->num_rows($resql) != 1) {
foreach ($extralabels as $key => $value) { foreach ($extralabels as $key => $value) {
if (!empty($extrafields->attributes["product_fournisseur_price"]['list'][$key]) && $extrafields->attributes["product_fournisseur_price"]['list'][$key] != 3) { if (!empty($extrafields->attributes["product_fournisseur_price"]['list'][$key]) && $extrafields->attributes["product_fournisseur_price"]['list'][$key] != 3) {
@ -1017,12 +1035,14 @@ SCRIPT;
} }
} }
} else { } else {
$resql = $db->fetch_object($resql); $obj = $db->fetch_object($resql);
foreach ($extralabels as $key => $value) { foreach ($extralabels as $key => $value) {
if (!empty($extrafields->attributes["product_fournisseur_price"]['list'][$key]) && $extrafields->attributes["product_fournisseur_price"]['list'][$key] != 3) { if (!empty($extrafields->attributes["product_fournisseur_price"]['list'][$key]) && $extrafields->attributes["product_fournisseur_price"]['list'][$key] != 3) {
print '<td align="right">'.$extrafields->showOutputField($key, $resql->{$key})."</td>"; print '<td align="right">'.$extrafields->showOutputField($key, $obj->{$key})."</td>";
} }
} }
}
$db->free($resql);
} }
} }