lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX sql bad request in product buying price extrafields

Browse Source
This commit is contained in:
VESSILLER 2019-12-26 16:18:26 +01:00 committed by Laurent Destailleur
parent 15ad41ee6d
commit 6e9bb5d7da
1 changed files with 76 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

132
htdocs/product/fournisseurs.php
View File

@ -265,32 +265,31 @@ if (empty($reshook))
$extralabels = $extrafields->fetch_name_optionals_label("product_fournisseur_price"); $extralabels = $extrafields->fetch_name_optionals_label("product_fournisseur_price");
$extrafield_values = $extrafields->getOptionalsFromPost("product_fournisseur_price"); $extrafield_values = $extrafields->getOptionalsFromPost("product_fournisseur_price");
if (!empty($extrafield_values)) {
$resql = $db->query("SELECT fk_object FROM " . MAIN_DB_PREFIX . "product_fournisseur_price_extrafields WHERE fk_object = " . $object->product_fourn_price_id);
// Insert a new extrafields row, if none exists
if ($db->num_rows($resql) != 1) {
$sql = "INSERT INTO " . MAIN_DB_PREFIX . "product_fournisseur_price_extrafields (fk_object, ";
foreach ($extrafield_values as $key => $value) {
$sql .= str_replace('options_', '', $key) . ', ';
}
$sql = substr($sql, 0, strlen($sql) - 2) . ") VALUES (" . $object->product_fourn_price_id . ", ";
foreach ($extrafield_values as $key => $value) {
$sql .= '"' . $value . '", ';
}
$sql = substr($sql, 0, strlen($sql) - 2) . ')';
} // else update the existing one
else {
$sql = "UPDATE " . MAIN_DB_PREFIX . "product_fournisseur_price_extrafields SET ";
foreach ($extrafield_values as $key => $value) {
$sql .= str_replace('options_', '', $key) . ' = "' . $value . '", ';
}
$sql = substr($sql, 0, strlen($sql) - 2) . ' WHERE fk_object = ' . $object->product_fourn_price_id;
}
$sql = ""; // Execute the sql command from above
$resql = $db->query("SELECT * FROM ".MAIN_DB_PREFIX."product_fournisseur_price_extrafields WHERE fk_object = ".$object->product_fourn_price_id); $db->query($sql);
// Insert a new extrafields row, if none exists }
if ($db->num_rows($resql) != 1) {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."product_fournisseur_price_extrafields (fk_object, ";
foreach ($extrafield_values as $key => $value) {
$sql .= str_replace('options_', '', $key).', ';
}
$sql = substr($sql, 0, strlen($sql) - 2).") VALUES (".$object->product_fourn_price_id.", ";
foreach ($extrafield_values as $key => $value) {
$sql .= '"'.$value.'", ';
}
$sql = substr($sql, 0, strlen($sql) - 2).')';
}
// else update the existing one
else {
$sql = "UPDATE ".MAIN_DB_PREFIX."product_fournisseur_price_extrafields SET ";
foreach ($extrafield_values as $key => $value) {
$sql .= str_replace('options_', '', $key).' = "'.$value.'", ';
}
$sql = substr($sql, 0, strlen($sql) - 2).' WHERE fk_object = '.$object->product_fourn_price_id;
}
// Execute the sql command from above
$db->query($sql);
$newprice = price2num(GETPOST("price", "alpha")); $newprice = price2num(GETPOST("price", "alpha"));
@ -765,25 +764,36 @@ SCRIPT;
print '</tr>'; print '</tr>';
} }
// Extrafields
$extrafields->fetch_name_optionals_label("product_fournisseur_price"); $extrafields->fetch_name_optionals_label("product_fournisseur_price");
$extralabels = $extrafields->attributes["product_fournisseur_price"]['label']; $extralabels = $extrafields->attributes["product_fournisseur_price"]['label'];
// Extrafields $extrafield_values = $extrafields->getOptionalsFromPost("product_fournisseur_price");
$resql = $db->query("SELECT * FROM ".MAIN_DB_PREFIX."product_fournisseur_price_extrafields WHERE fk_object = ".$rowid);
if (!empty($extralabels)) { if (!empty($extralabels)) {
if ($db->num_rows($resql) != 1) { if (empty($rowid)) {
foreach ($extralabels as $key => $value) { foreach ($extralabels as $key => $value) {
if (!empty($extrafields->attributes["product_fournisseur_price"]['list'][$key]) && ($extrafields->attributes["product_fournisseur_price"]['list'][$key] == 1 || $extrafields->attributes["product_fournisseur_price"]['list'][$key] == 3 || ($action == "update_price" && $extrafields->attributes["product_fournisseur_price"]['list'][$key] == 4))) { if (!empty($extrafields->attributes["product_fournisseur_price"]['list'][$key]) && ($extrafields->attributes["product_fournisseur_price"]['list'][$key] == 1 || $extrafields->attributes["product_fournisseur_price"]['list'][$key] == 3 || ($action == "update_price" && $extrafields->attributes["product_fournisseur_price"]['list'][$key] == 4))) {
print '<tr><td'.($extrafields->attributes["product_fournisseur_price"]['required'][$key] ? ' class="fieldrequired"' : '').'>'.$langs->trans($value).'</td><td>'.$extrafields->showInputField($key, '', '', '', '', '', 0, 'product_fournisseur_price').'</td></tr>'; print '<tr><td'.($extrafields->attributes["product_fournisseur_price"]['required'][$key] ? ' class="fieldrequired"' : '').'>'.$langs->trans($value).'</td><td>'.$extrafields->showInputField($key, GETPOSTISSET('options_' . $key) ? $extrafield_values['options_' . $key] : '', '', '', '', '', 0, 'product_fournisseur_price').'</td></tr>';
} }
} }
} else { } else {
$resql = $db->fetch_object($resql); $sql = "SELECT";
foreach ($extralabels as $key => $value) { $sql .= " fk_object";
if (!empty($extrafields->attributes["product_fournisseur_price"]['list'][$key]) && ($extrafields->attributes["product_fournisseur_price"]['list'][$key] == 1 || $extrafields->attributes["product_fournisseur_price"]['list'][$key] == 3 || ($action == "update_price" && $extrafields->attributes["product_fournisseur_price"]['list'][$key] == 4))) { foreach ($extralabels as $key => $value) {
print '<tr><td'.($extrafields->attributes["product_fournisseur_price"]['required'][$key] ? ' class="fieldrequired"' : '').'>'.$langs->trans($value).'</td><td>'.$extrafields->showInputField($key, $resql->{$key}, '', '', '', '', 0, 'product_fournisseur_price').'</td></tr>'; $sql .= ", " . $key;
} }
} $sql .= " FROM " . MAIN_DB_PREFIX . "product_fournisseur_price_extrafields";
} $sql .= " WHERE fk_object = " . $rowid;
$resql = $db->query($sql);
if ($resql) {
$obj = $db->fetch_object($resql);
foreach ($extralabels as $key => $value) {
if (!empty($extrafields->attributes["product_fournisseur_price"]['list'][$key]) && ($extrafields->attributes["product_fournisseur_price"]['list'][$key] == 1 || $extrafields->attributes["product_fournisseur_price"]['list'][$key] == 3 || ($action == "update_price" && $extrafields->attributes["product_fournisseur_price"]['list'][$key] == 4))) {
print '<tr><td'.($extrafields->attributes["product_fournisseur_price"]['required'][$key] ? ' class="fieldrequired"' : '').'>'.$langs->trans($value).'</td><td>'.$extrafields->showInputField($key, GETPOSTISSET('options_' . $key) ? $extrafield_values['options_' . $key] : $obj->{$key}, '', '', '', '', 0, 'product_fournisseur_price').'</td></tr>';
}
}
$db->free($resql);
}
}
} }
if (is_object($hookmanager)) if (is_object($hookmanager))
@ -1008,22 +1018,32 @@ SCRIPT;
print '</td>'; print '</td>';
// Extrafields // Extrafields
$resql = $db->query("SELECT * FROM ".MAIN_DB_PREFIX."product_fournisseur_price_extrafields WHERE fk_object = ".$productfourn->product_fourn_price_id);
if (!empty($extralabels)) { if (!empty($extralabels)) {
if ($db->num_rows($resql) != 1) { $sql = "SELECT";
foreach ($extralabels as $key => $value) { $sql .= " fk_object";
if (!empty($extrafields->attributes["product_fournisseur_price"]['list'][$key]) && $extrafields->attributes["product_fournisseur_price"]['list'][$key] != 3) { foreach ($extralabels as $key => $value) {
print "<td></td>"; $sql .= ", " . $key;
} }
} $sql .= " FROM " . MAIN_DB_PREFIX . "product_fournisseur_price_extrafields";
} else { $sql .= " WHERE fk_object = " . $productfourn->product_fourn_price_id;
$resql = $db->fetch_object($resql); $resql = $db->query($sql);
foreach ($extralabels as $key => $value) { if ($resql) {
if (!empty($extrafields->attributes["product_fournisseur_price"]['list'][$key]) && $extrafields->attributes["product_fournisseur_price"]['list'][$key] != 3) { if ($db->num_rows($resql) != 1) {
print '<td align="right">'.$extrafields->showOutputField($key, $resql->{$key})."</td>"; foreach ($extralabels as $key => $value) {
} if (!empty($extrafields->attributes["product_fournisseur_price"]['list'][$key]) && $extrafields->attributes["product_fournisseur_price"]['list'][$key] != 3) {
} print "<td></td>";
} }
}
} else {
$obj = $db->fetch_object($resql);
foreach ($extralabels as $key => $value) {
if (!empty($extrafields->attributes["product_fournisseur_price"]['list'][$key]) && $extrafields->attributes["product_fournisseur_price"]['list'][$key] != 3) {
print '<td align="right">'.$extrafields->showOutputField($key, $obj->{$key})."</td>";
}
}
}
$db->free($resql);
}
} }
if (is_object($hookmanager)) if (is_object($hookmanager))