From 92a4314779f7c33994779670820dfe33849b75ba Mon Sep 17 00:00:00 2001 From: ATM john Date: Wed, 6 Jan 2021 10:45:54 +0100 Subject: [PATCH 1/4] Fix security mecanism generating data loss --- htdocs/core/lib/functions.lib.php | 1 + 1 file changed, 1 insertion(+) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index c6fd80f72d0..fccb019a730 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -602,6 +602,7 @@ function GETPOST($paramname, $check = 'none', $method = 0, $filter = null, $opti $out = trim($out); // '"' is dangerous because param in url can close the href= or src= and add javascript functions. // '../' is dangerous because it allows dir transversals + $out = str_replace('"', "''", trim($out)); if (preg_match('/"/', $out)) $out = ''; elseif (preg_match('/\.\.\//', $out)) $out = ''; $out = dol_string_nohtmltag($out); From e44b14364a30f116cdebec4bc2453b096c00163b Mon Sep 17 00:00:00 2001 From: quentin Date: Wed, 6 Jan 2021 14:17:06 +0100 Subject: [PATCH 2/4] FIX useless tracking number displayed on pdf if empty --- htdocs/core/modules/expedition/doc/pdf_rouget.modules.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/htdocs/core/modules/expedition/doc/pdf_rouget.modules.php b/htdocs/core/modules/expedition/doc/pdf_rouget.modules.php index 506e72ba1b0..7fc3d622254 100644 --- a/htdocs/core/modules/expedition/doc/pdf_rouget.modules.php +++ b/htdocs/core/modules/expedition/doc/pdf_rouget.modules.php @@ -373,14 +373,15 @@ class pdf_rouget extends ModelePdfExpedition $tab_top_alt = $tab_top; $pdf->SetFont('', 'B', $default_font_size - 2); - $pdf->writeHTMLCell(60, 4, $this->posxdesc - 1, $tab_top - 1, $outputlangs->transnoentities("TrackingNumber")." : ".$object->tracking_number, 0, 1, false, true, 'L'); - $tab_top_alt = $pdf->GetY(); //$tab_top_alt += 1; // Tracking number if (!empty($object->tracking_number)) { + $pdf->writeHTMLCell(60, 4, $this->posxdesc - 1, $tab_top - 1, $outputlangs->transnoentities("TrackingNumber")." : ".$object->tracking_number, 0, 1, false, true, 'L'); + $tab_top_alt = $pdf->GetY(); + $object->getUrlTrackingStatus($object->tracking_number); if (!empty($object->tracking_url)) { From ca557cfacd7ba5e4adad85c8ff9254de8020848d Mon Sep 17 00:00:00 2001 From: stickler-ci Date: Wed, 6 Jan 2021 13:22:35 +0000 Subject: [PATCH 3/4] Fixing style errors. --- htdocs/core/modules/expedition/doc/pdf_rouget.modules.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/core/modules/expedition/doc/pdf_rouget.modules.php b/htdocs/core/modules/expedition/doc/pdf_rouget.modules.php index 7fc3d622254..af2cbbca8cc 100644 --- a/htdocs/core/modules/expedition/doc/pdf_rouget.modules.php +++ b/htdocs/core/modules/expedition/doc/pdf_rouget.modules.php @@ -381,7 +381,7 @@ class pdf_rouget extends ModelePdfExpedition { $pdf->writeHTMLCell(60, 4, $this->posxdesc - 1, $tab_top - 1, $outputlangs->transnoentities("TrackingNumber")." : ".$object->tracking_number, 0, 1, false, true, 'L'); $tab_top_alt = $pdf->GetY(); - + $object->getUrlTrackingStatus($object->tracking_number); if (!empty($object->tracking_url)) { From 170814c718cfdad0615753029853f72f6e0442e2 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Wed, 6 Jan 2021 20:21:22 +0100 Subject: [PATCH 4/4] Fix missing rollback --- htdocs/societe/class/societe.class.php | 1 + 1 file changed, 1 insertion(+) diff --git a/htdocs/societe/class/societe.class.php b/htdocs/societe/class/societe.class.php index 2fcfaecb19e..8de2ab23baf 100644 --- a/htdocs/societe/class/societe.class.php +++ b/htdocs/societe/class/societe.class.php @@ -3699,6 +3699,7 @@ class Societe extends CommonObject if ($result < 0) { setEventMessages($this->error, $this->errors, 'errors'); + $this->db->rollback(); return -1; } }