lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #8040 from atm-florian/dev_fixsecu

Browse Source 
fix #7963
This commit is contained in:
Laurent Destailleur 2018-01-11 00:44:45 +01:00 committed by GitHub
commit 9827358002
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 39 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/accountancy/expensereport/lines.php
View File

@ -106,7 +106,7 @@ if (is_array($changeaccount) && count($changeaccount) > 0) {
$db->begin(); $db->begin();
$sql1 = "UPDATE " . MAIN_DB_PREFIX . "expensereport_det as erd"; $sql1 = "UPDATE " . MAIN_DB_PREFIX . "expensereport_det as erd";
$sql1 .= " SET erd.fk_code_ventilation=" . GETPOST('account_parent'); $sql1 .= " SET erd.fk_code_ventilation=" . GETPOST('account_parent','int');
$sql1 .= ' WHERE erd.rowid IN (' . implode(',', $changeaccount) . ')'; $sql1 .= ' WHERE erd.rowid IN (' . implode(',', $changeaccount) . ')';
dol_syslog('accountancy/expensereport/lines.php::changeaccount sql= ' . $sql1); dol_syslog('accountancy/expensereport/lines.php::changeaccount sql= ' . $sql1);

2
htdocs/accountancy/supplier/lines.php
View File

@ -114,7 +114,7 @@ if (is_array($changeaccount) && count($changeaccount) > 0) {
$db->begin(); $db->begin();
$sql1 = "UPDATE " . MAIN_DB_PREFIX . "facture_fourn_det as l"; $sql1 = "UPDATE " . MAIN_DB_PREFIX . "facture_fourn_det as l";
$sql1 .= " SET l.fk_code_ventilation=" . GETPOST('account_parent'); $sql1 .= " SET l.fk_code_ventilation=" . GETPOST('account_parent','int');
$sql1 .= ' WHERE l.rowid IN (' . implode(',', $changeaccount) . ')'; $sql1 .= ' WHERE l.rowid IN (' . implode(',', $changeaccount) . ')';
dol_syslog('accountancy/supplier/lines.php::changeaccount sql= ' . $sql1); dol_syslog('accountancy/supplier/lines.php::changeaccount sql= ' . $sql1);

2
htdocs/admin/external_rss.php
View File

@ -127,7 +127,7 @@ if ($_POST["delete"])
// Supprime boite box_external_rss de definition des boites // Supprime boite box_external_rss de definition des boites
$sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."boxes_def"; $sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."boxes_def";
$sql.= " WHERE file = 'box_external_rss.php' AND note LIKE '".GETPOST("norss")." %'"; $sql.= " WHERE file = 'box_external_rss.php' AND note LIKE '".$db->escape(GETPOST("norss"))." %'";
$resql=$db->query($sql); $resql=$db->query($sql);
if ($resql) if ($resql)

15
htdocs/compta/bank/ligne.php
View File

@ -92,11 +92,16 @@ if ($user->rights->banque->consolidate && $action == 'donext')
if ($action == 'confirm_delete_categ' && $confirm == "yes" && $user->rights->banque->modifier) if ($action == 'confirm_delete_categ' && $confirm == "yes" && $user->rights->banque->modifier)
{ {
$sql = "DELETE FROM ".MAIN_DB_PREFIX."bank_class WHERE lineid = ".$rowid." AND fk_categ = ".GETPOST("cat1"); $cat1=GETPOST("cat1",'int');
if (! $db->query($sql)) if (!empty($rowid) && !empty($cat1)) {
{ $sql = "DELETE FROM ".MAIN_DB_PREFIX."bank_class WHERE lineid = ".$rowid." AND fk_categ = ".$cat1;
dol_print_error($db); if (! $db->query($sql))
} {
dol_print_error($db);
}
} else {
setEventMessage('Missing ids','errors');
}
} }
if ($user->rights->banque->modifier && $action == "update") if ($user->rights->banque->modifier && $action == "update")

2
htdocs/fourn/facture/impayees.php
View File

@ -141,7 +141,7 @@ if ($user->rights->fournisseur->facture->lire)
if (dol_strlen(GETPOST('sf_re')) > 0) if (dol_strlen(GETPOST('sf_re')) > 0)
{ {
$sql .= " AND f.ref_supplier LIKE '%".GETPOST('sf_re')."%'"; $sql .= " AND f.ref_supplier LIKE '%".$db->escape(GETPOST('sf_re'))."%'";
} }
$sql.= " GROUP BY s.rowid, s.nom, f.rowid, f.ref, f.ref_supplier, f.total_ht, f.total_ttc, f.datef, f.date_lim_reglement, f.paye, f.fk_statut"; $sql.= " GROUP BY s.rowid, s.nom, f.rowid, f.ref, f.ref_supplier, f.total_ht, f.total_ttc, f.datef, f.date_lim_reglement, f.paye, f.fk_statut";

36
htdocs/product/price.php
View File

@ -409,12 +409,12 @@ if (empty($reshook))
if ($action == 'update_price_by_qty') if ($action == 'update_price_by_qty')
{ {
// Récupération des variables // Récupération des variables
$rowid = GETPOST('rowid'); $rowid = GETPOST('rowid','int');
$priceid = GETPOST('priceid'); $priceid = GETPOST('priceid','int');
$newprice = price2num(GETPOST("price"), 'MU'); $newprice = price2num(GETPOST("price",'alpha'), 'MU');
// $newminprice=price2num(GETPOST("price_min"),'MU'); // TODO : Add min price management // $newminprice=price2num(GETPOST("price_min"),'MU'); // TODO : Add min price management
$quantity = GETPOST('quantity'); $quantity = GETPOST('quantity','int');
$remise_percent = price2num(GETPOST('remise_percent')); $remise_percent = price2num(GETPOST('remise_percent','alpha'));
$remise = 0; // TODO : allow discount by amount when available on documents $remise = 0; // TODO : allow discount by amount when available on documents
if (empty($quantity)) { if (empty($quantity)) {
@ -442,7 +442,7 @@ if (empty($reshook))
$sql .= " quantity=" . $quantity . ","; $sql .= " quantity=" . $quantity . ",";
$sql .= " remise_percent=" . $remise_percent . ","; $sql .= " remise_percent=" . $remise_percent . ",";
$sql .= " remise=" . $remise; $sql .= " remise=" . $remise;
$sql .= " WHERE rowid = " . GETPOST('rowid'); $sql .= " WHERE rowid = " . $rowid;
$result = $db->query($sql); $result = $db->query($sql);
if (! $result) dol_print_error($db); if (! $result) dol_print_error($db);
@ -458,22 +458,28 @@ if (empty($reshook))
if ($action == 'delete_price_by_qty') if ($action == 'delete_price_by_qty')
{ {
$rowid = GETPOST('rowid'); $rowid = GETPOST('rowid','int');
if (!empty($rowid)) {
$sql = "DELETE FROM " . MAIN_DB_PREFIX . "product_price_by_qty";
$sql .= " WHERE rowid = " . $rowid;
$sql = "DELETE FROM " . MAIN_DB_PREFIX . "product_price_by_qty"; $result = $db->query($sql);
$sql .= " WHERE rowid = " . GETPOST('rowid'); } else {
setEventMessage('delete_price_by_qty Missing Ids','errors');
$result = $db->query($sql); }
} }
if ($action == 'delete_all_price_by_qty') if ($action == 'delete_all_price_by_qty')
{ {
$priceid = GETPOST('priceid'); $priceid = GETPOST('priceid','int');
if (!empty($rowid)) {
$sql = "DELETE FROM " . MAIN_DB_PREFIX . "product_price_by_qty"; $sql = "DELETE FROM " . MAIN_DB_PREFIX . "product_price_by_qty";
$sql .= " WHERE fk_product_price = " . $priceid; $sql .= " WHERE fk_product_price = " . $priceid;
$result = $db->query($sql); $result = $db->query($sql);
} else {
setEventMessage('delete_all_price_by_qty Missing Ids','errors');
}
} }
/** /**
@ -485,7 +491,7 @@ if (empty($reshook))
$maxpricesupplier = $object->min_recommended_price(); $maxpricesupplier = $object->min_recommended_price();
$update_child_soc = GETPOST('updatechildprice'); $update_child_soc = GETPOST('updatechildprice','int');
// add price by customer // add price by customer
$prodcustprice->fk_soc = GETPOST('socid', 'int'); $prodcustprice->fk_soc = GETPOST('socid', 'int');
@ -585,7 +591,7 @@ if (empty($reshook))
{ {
$maxpricesupplier = $object->min_recommended_price(); $maxpricesupplier = $object->min_recommended_price();
$update_child_soc = GETPOST('updatechildprice'); $update_child_soc = GETPOST('updatechildprice','int');
$prodcustprice->fetch(GETPOST('lineid', 'int')); $prodcustprice->fetch(GETPOST('lineid', 'int'));