From a0579d115d72df4947fa7744e9030a78473c6a75 Mon Sep 17 00:00:00 2001
From: jpb <jean-pascal.boudet@atm-consulting>
Date: Wed, 21 Sep 2022 11:02:00 +0200
Subject: [PATCH 1/5] add element_element rowid

---
 htdocs/mrp/tpl/linkedobjectblock.tpl.php | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/htdocs/mrp/tpl/linkedobjectblock.tpl.php b/htdocs/mrp/tpl/linkedobjectblock.tpl.php
index 516e4eddf51..3738ddfa867 100644
--- a/htdocs/mrp/tpl/linkedobjectblock.tpl.php
+++ b/htdocs/mrp/tpl/linkedobjectblock.tpl.php
@@ -63,8 +63,25 @@ foreach ($TMoChilds as $key => $objectlink) {
 	echo '<td class="linkedcol-amount right">-</td>';
 	echo '<td class="linkedcol-statut right">'.$objectlink->getLibStatut(3).'</td>';
 	echo '<td class="linkedcol-action right">';
-	// For now, shipments must stay linked to order, so link is not deletable
-	echo '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&action=dellink&token='.newToken().'&dellinkid='.$key.'">'.img_picto($langs->transnoentitiesnoconv("RemoveLink"), 'unlink').'</a>';
+
+	// we want to make the link via element_element for delete action
+	$sql = ' Select rowid from ' . MAIN_DB_PREFIX . 'element_element';
+	$sql .= ' WHERE  fk_source = '. $object->id . ' and fk_target = ' . $key;
+
+	$resql = $db->query($sql);
+	$k = 0;
+	if ($resql){
+		$obj = $db->fetch_object($resql);
+		if ($obj->rowid && $obj->rowid > 0 ) $k = $obj->rowid;
+	}
+
+	echo '<a class="reposition" href="' . $_SERVER["PHP_SELF"] . '?id=' . $object->id . '&action=dellink&token=' . newToken() . '&dellinkid=' . $k . '">' . img_picto($langs->transnoentitiesnoconv("RemoveLink"), 'unlink') . '</a>';
+	echo '</td>';
+	echo "</tr>\n";
+}
+
+echo "<!-- END PHP TEMPLATE -->\n";
+
 	echo '</td>';
 	echo "</tr>\n";
 }

From 78adf501b396cb89ca0dce30772708841799a87a Mon Sep 17 00:00:00 2001
From: jpb <jean-pascal.boudet@atm-consulting>
Date: Wed, 21 Sep 2022 11:08:46 +0200
Subject: [PATCH 2/5] stickler

---
 htdocs/mrp/tpl/linkedobjectblock.tpl.php | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/htdocs/mrp/tpl/linkedobjectblock.tpl.php b/htdocs/mrp/tpl/linkedobjectblock.tpl.php
index 3738ddfa867..9f07a9048c2 100644
--- a/htdocs/mrp/tpl/linkedobjectblock.tpl.php
+++ b/htdocs/mrp/tpl/linkedobjectblock.tpl.php
@@ -70,11 +70,10 @@ foreach ($TMoChilds as $key => $objectlink) {
 
 	$resql = $db->query($sql);
 	$k = 0;
-	if ($resql){
+	if ($resql) {
 		$obj = $db->fetch_object($resql);
 		if ($obj->rowid && $obj->rowid > 0 ) $k = $obj->rowid;
 	}
-
 	echo '<a class="reposition" href="' . $_SERVER["PHP_SELF"] . '?id=' . $object->id . '&action=dellink&token=' . newToken() . '&dellinkid=' . $k . '">' . img_picto($langs->transnoentitiesnoconv("RemoveLink"), 'unlink') . '</a>';
 	echo '</td>';
 	echo "</tr>\n";

From 70a1815b9c1090d94bf45b108a64f2f36194a5b5 Mon Sep 17 00:00:00 2001
From: jpb <jean-pascal.boudet@atm-consulting>
Date: Wed, 21 Sep 2022 14:12:55 +0200
Subject: [PATCH 3/5] remove code

---
 htdocs/mrp/tpl/linkedobjectblock.tpl.php | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/htdocs/mrp/tpl/linkedobjectblock.tpl.php b/htdocs/mrp/tpl/linkedobjectblock.tpl.php
index 9f07a9048c2..7a9d4a2dd73 100644
--- a/htdocs/mrp/tpl/linkedobjectblock.tpl.php
+++ b/htdocs/mrp/tpl/linkedobjectblock.tpl.php
@@ -79,10 +79,4 @@ foreach ($TMoChilds as $key => $objectlink) {
 	echo "</tr>\n";
 }
 
-echo "<!-- END PHP TEMPLATE -->\n";
-
-	echo '</td>';
-	echo "</tr>\n";
-}
-
 echo "<!-- END PHP TEMPLATE -->\n";

From 8f29d5c0eb10d928d3b3dd28422d4b03c634f5af Mon Sep 17 00:00:00 2001
From: jpb <jean-pascal.boudet@atm-consulting>
Date: Wed, 21 Sep 2022 15:58:41 +0200
Subject: [PATCH 4/5] add cast and quoted

---
 htdocs/mrp/tpl/linkedobjectblock.tpl.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/mrp/tpl/linkedobjectblock.tpl.php b/htdocs/mrp/tpl/linkedobjectblock.tpl.php
index 7a9d4a2dd73..31a0af8a10c 100644
--- a/htdocs/mrp/tpl/linkedobjectblock.tpl.php
+++ b/htdocs/mrp/tpl/linkedobjectblock.tpl.php
@@ -66,7 +66,7 @@ foreach ($TMoChilds as $key => $objectlink) {
 
 	// we want to make the link via element_element for delete action
 	$sql = ' Select rowid from ' . MAIN_DB_PREFIX . 'element_element';
-	$sql .= ' WHERE  fk_source = '. $object->id . ' and fk_target = ' . $key;
+	$sql .= ' WHERE  fk_source = '. (int) $object->id . ' and fk_target = "' . $key .'"';
 
 	$resql = $db->query($sql);
 	$k = 0;

From 64c92cc66dcc4c1c39c7bff86c9dbd4f74eb5476 Mon Sep 17 00:00:00 2001
From: jpb <jean-pascal.boudet@atm-consulting>
Date: Wed, 21 Sep 2022 16:11:18 +0200
Subject: [PATCH 5/5] add escape

---
 htdocs/mrp/tpl/linkedobjectblock.tpl.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/htdocs/mrp/tpl/linkedobjectblock.tpl.php b/htdocs/mrp/tpl/linkedobjectblock.tpl.php
index 31a0af8a10c..9374fc2e4d0 100644
--- a/htdocs/mrp/tpl/linkedobjectblock.tpl.php
+++ b/htdocs/mrp/tpl/linkedobjectblock.tpl.php
@@ -65,8 +65,8 @@ foreach ($TMoChilds as $key => $objectlink) {
 	echo '<td class="linkedcol-action right">';
 
 	// we want to make the link via element_element for delete action
-	$sql = ' Select rowid from ' . MAIN_DB_PREFIX . 'element_element';
-	$sql .= ' WHERE  fk_source = '. (int) $object->id . ' and fk_target = "' . $key .'"';
+	$sql = " Select rowid from " . MAIN_DB_PREFIX . "element_element";
+	$sql .= " WHERE  fk_source = ". (int) $object->id . " and fk_target = '" . dol_escape_htmltag($key) ."'";
 
 	$resql = $db->query($sql);
 	$k = 0;