';
/*
* Latest modified members
*/
-$max = 5;
+$max = $conf->global->MAIN_SIZE_SHORTLIST_LIMIT;
$sql = "SELECT a.rowid, a.statut, a.lastname, a.firstname, a.societe as company, a.fk_soc,";
$sql .= " a.tms as datem, datefin as date_end_subscription,";
@@ -337,7 +337,7 @@ if ($resql) {
/*
* Last modified subscriptions
*/
-$max = 5;
+$max = $conf->global->MAIN_SIZE_SHORTLIST_LIMIT;
$sql = "SELECT a.rowid, a.statut, a.lastname, a.firstname, a.societe as company, a.fk_soc,";
$sql .= " datefin as date_end_subscription,";
diff --git a/htdocs/adherents/list.php b/htdocs/adherents/list.php
index 4245bf2e74a..75c9c731810 100644
--- a/htdocs/adherents/list.php
+++ b/htdocs/adherents/list.php
@@ -281,7 +281,7 @@ if ($search_ref) {
if ($search_civility) $sql .= natural_search("d.civility", $search_civility);
if ($search_firstname) $sql .= natural_search("d.firstname", $search_firstname);
if ($search_lastname) $sql .= natural_search(array("d.firstname", "d.lastname", "d.societe"), $search_lastname);
-if ($search_gender != '' && $search_gender != '-1') $sql .= " AND d.gender = '".$search_gender."'";
+if ($search_gender != '' && $search_gender != '-1') $sql .= natural_search("d.gender", $search_gender);
if ($search_login) $sql .= natural_search("d.login", $search_login);
if ($search_company) $sql .= natural_search("s.nom", $search_company);
if ($search_email) $sql .= natural_search("d.email", $search_email);
@@ -370,6 +370,7 @@ if ($search_lastname) $param .= "&search_lastname=".urlencode($search_lastname)
if ($search_gender) $param .= "&search_gender=".urlencode($search_gender);
if ($search_login) $param .= "&search_login=".urlencode($search_login);
if ($search_email) $param .= "&search_email=".urlencode($search_email);
+if ($search_categ) $param .= "&search_categ=".urlencode($search_categ);
if ($search_company) $param .= "&search_company=".urlencode($search_company);
if ($search_address != '') $param .= "&search_address=".urlencode($search_address);
if ($search_town != '') $param .= "&search_town=".urlencode($search_town);
@@ -502,16 +503,16 @@ if (!empty($arrayfields['t.libelle']['checked'])) {
if (!empty($arrayfields['d.address']['checked'])) {
print '';
- print ' ';
+ print '';
}
if (!empty($arrayfields['d.zip']['checked'])) {
print '';
- print ' ';
+ print '';
}
if (!empty($arrayfields['d.town']['checked'])) {
print '';
- print ' ';
+ print '';
}
// State
if (!empty($arrayfields['state.nom']['checked'])) {
@@ -528,24 +529,24 @@ if (!empty($arrayfields['country.code_iso']['checked'])) {
// Phone pro
if (!empty($arrayfields['d.phone']['checked'])) {
print '';
- print ' ';
+ print '';
}
// Phone perso
if (!empty($arrayfields['d.phone_perso']['checked'])) {
print '';
- print ' ';
+ print '';
}
// Phone mobile
if (!empty($arrayfields['d.phone_mobile']['checked'])) {
print '';
- print ' ';
+ print '';
}
// Email
if (!empty($arrayfields['d.email']['checked'])) {
print '';
- print ' ';
+ print '';
}
-
+// End of subscription date
if (!empty($arrayfields['d.datefin']['checked'])) {
print '';
print ' ';
diff --git a/htdocs/adherents/stats/byproperties.php b/htdocs/adherents/stats/byproperties.php
index 90187e483dc..62e503f8170 100644
--- a/htdocs/adherents/stats/byproperties.php
+++ b/htdocs/adherents/stats/byproperties.php
@@ -141,10 +141,11 @@ if (!count($data)) {
}
// Print array
+print '';
+ // Print array
+ print '';
print ''.$langs->trans("EXPORTS_SHARE_MODELS").' ';
print ' ';
print '';
-echo ajax_constantonoff('EXPORTS_SHARE_MODELS');
+print ajax_constantonoff('EXPORTS_SHARE_MODELS');
print ' ';
print '';
diff --git a/htdocs/admin/external_rss.php b/htdocs/admin/external_rss.php
index 3d81ab01c43..7f5bcde4b3d 100644
--- a/htdocs/admin/external_rss.php
+++ b/htdocs/admin/external_rss.php
@@ -80,8 +80,8 @@ if ($action == 'add' || GETPOST("modify"))
{
// Supprime boite box_external_rss de definition des boites
/* $sql = "UPDATE ".MAIN_DB_PREFIX."boxes_def";
- $sql.= " SET name = '".$boxlabel."'";
- $sql.= " WHERE file ='box_external_rss.php' AND note like '".$_POST["norss"]." %'";
+ $sql.= " SET name = '".$db->escape($boxlabel)."'";
+ $sql.= " WHERE file ='box_external_rss.php' AND note like '".$db->escape($_POST["norss"])." %'";
$resql=$db->query($sql);
if (! $resql)
diff --git a/htdocs/admin/facture.php b/htdocs/admin/facture.php
index 7042f291828..fe84cf12478 100644
--- a/htdocs/admin/facture.php
+++ b/htdocs/admin/facture.php
@@ -421,7 +421,7 @@ $type = 'invoice';
$def = array();
$sql = "SELECT nom";
$sql .= " FROM ".MAIN_DB_PREFIX."document_model";
-$sql .= " WHERE type = '".$type."'";
+$sql .= " WHERE type = '".$db->escape($type)."'";
$sql .= " AND entity = ".$conf->entity;
$resql = $db->query($sql);
if ($resql)
diff --git a/htdocs/admin/fichinter.php b/htdocs/admin/fichinter.php
index a30a9d767a9..df97e9875a0 100644
--- a/htdocs/admin/fichinter.php
+++ b/htdocs/admin/fichinter.php
@@ -349,7 +349,7 @@ $type = 'ficheinter';
$def = array();
$sql = "SELECT nom";
$sql .= " FROM ".MAIN_DB_PREFIX."document_model";
-$sql .= " WHERE type = '".$type."'";
+$sql .= " WHERE type = '".$db->escape($type)."'";
$sql .= " AND entity = ".$conf->entity;
$resql = $db->query($sql);
if ($resql)
diff --git a/htdocs/admin/holiday.php b/htdocs/admin/holiday.php
index 067c0698a99..bac8e99e70f 100644
--- a/htdocs/admin/holiday.php
+++ b/htdocs/admin/holiday.php
@@ -299,7 +299,7 @@ print load_fiche_titre($langs->trans("TemplatePDFHolidays"), '', '');
$def = array();
$sql = "SELECT nom";
$sql .= " FROM ".MAIN_DB_PREFIX."document_model";
-$sql .= " WHERE type = '".$type."'";
+$sql .= " WHERE type = '".$db->escape($type)."'";
$sql .= " AND entity = ".$conf->entity;
$resql = $db->query($sql);
if ($resql)
diff --git a/htdocs/admin/limits.php b/htdocs/admin/limits.php
index 95a8d52bc57..db29deef9d7 100644
--- a/htdocs/admin/limits.php
+++ b/htdocs/admin/limits.php
@@ -243,7 +243,7 @@ if (empty($mysoc->country_code))
$sql = "SELECT taux as vat_rate, t.code as vat_code, t.localtax1 as localtax_rate1, t.localtax2 as localtax_rate2";
$sql .= " FROM ".MAIN_DB_PREFIX."c_tva as t, ".MAIN_DB_PREFIX."c_country as c";
- $sql .= " WHERE t.active=1 AND t.fk_pays = c.rowid AND c.code='".$mysoc->country_code."' AND (t.taux <> 0 OR t.localtax1 <>0 OR t.localtax2 <>0)";
+ $sql .= " WHERE t.active=1 AND t.fk_pays = c.rowid AND c.code='".$db->escape($mysoc->country_code)."' AND (t.taux <> 0 OR t.localtax1 <>0 OR t.localtax2 <>0)";
$sql .= " ORDER BY t.taux ASC";
$resql = $db->query($sql);
if ($resql)
diff --git a/htdocs/admin/livraison.php b/htdocs/admin/livraison.php
index ddd2b3f83c6..4073b0a59a9 100644
--- a/htdocs/admin/livraison.php
+++ b/htdocs/admin/livraison.php
@@ -291,7 +291,7 @@ $def = array();
$sql = "SELECT nom";
$sql .= " FROM ".MAIN_DB_PREFIX."document_model";
-$sql .= " WHERE type = '".$type."'";
+$sql .= " WHERE type = '".$db->escape($type)."'";
$sql .= " AND entity = ".$conf->entity;
$resql = $db->query($sql);
diff --git a/htdocs/admin/mails.php b/htdocs/admin/mails.php
index 27e64973ddf..feca9bf582e 100644
--- a/htdocs/admin/mails.php
+++ b/htdocs/admin/mails.php
@@ -77,6 +77,7 @@ if ($action == 'update' && empty($_POST["cancel"]))
dolibarr_set_const($db, "MAIN_MAIL_SMTPS_PW", GETPOST("MAIN_MAIL_SMTPS_PW", 'none'), 'chaine', 0, '', $conf->entity);
dolibarr_set_const($db, "MAIN_MAIL_EMAIL_TLS", GETPOST("MAIN_MAIL_EMAIL_TLS", 'int'), 'chaine', 0, '', $conf->entity);
dolibarr_set_const($db, "MAIN_MAIL_EMAIL_STARTTLS", GETPOST("MAIN_MAIL_EMAIL_STARTTLS", 'int'), 'chaine', 0, '', $conf->entity);
+ dolibarr_set_const($db, "MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED", GETPOST("MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED", 'int'), 'chaine', 0, '', $conf->entity);
dolibarr_set_const($db, "MAIN_MAIL_EMAIL_DKIM_ENABLED", GETPOST("MAIN_MAIL_EMAIL_DKIM_ENABLED", 'int'), 'chaine', 0, '', $conf->entity);
dolibarr_set_const($db, "MAIN_MAIL_EMAIL_DKIM_DOMAIN", GETPOST("MAIN_MAIL_EMAIL_DKIM_DOMAIN", 'alphanohtml'), 'chaine', 0, '', $conf->entity);
@@ -156,6 +157,8 @@ if ($action == 'edit')
jQuery("#MAIN_MAIL_EMAIL_TLS").prop("disabled", true);
jQuery("#MAIN_MAIL_EMAIL_STARTTLS").val(0);
jQuery("#MAIN_MAIL_EMAIL_STARTTLS").prop("disabled", true);
+ jQuery("#MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED").val(0);
+ jQuery("#MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED").prop("disabled", true);
jQuery("#MAIN_MAIL_EMAIL_DKIM_ENABLED").val(0);
jQuery("#MAIN_MAIL_EMAIL_DKIM_ENABLED").prop("disabled", true);
jQuery("#MAIN_MAIL_EMAIL_DKIM_DOMAIN").prop("disabled", true);
@@ -187,6 +190,8 @@ if ($action == 'edit')
jQuery("#MAIN_MAIL_EMAIL_TLS").removeAttr("disabled");
jQuery("#MAIN_MAIL_EMAIL_STARTTLS").val('.$conf->global->MAIN_MAIL_EMAIL_STARTTLS.');
jQuery("#MAIN_MAIL_EMAIL_STARTTLS").removeAttr("disabled");
+ jQuery("#MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED").val('.$conf->global->MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED.');
+ jQuery("#MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED").removeAttr("disabled");
jQuery("#MAIN_MAIL_EMAIL_DKIM_ENABLED").val(0);
jQuery("#MAIN_MAIL_EMAIL_DKIM_ENABLED").prop("disabled", true);
jQuery("#MAIN_MAIL_EMAIL_DKIM_DOMAIN").prop("disabled", true);
@@ -211,6 +216,8 @@ if ($action == 'edit')
jQuery("#MAIN_MAIL_EMAIL_TLS").removeAttr("disabled");
jQuery("#MAIN_MAIL_EMAIL_STARTTLS").val('.$conf->global->MAIN_MAIL_EMAIL_STARTTLS.');
jQuery("#MAIN_MAIL_EMAIL_STARTTLS").removeAttr("disabled");
+ jQuery("#MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED").val('.$conf->global->MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED.');
+ jQuery("#MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED").removeAttr("disabled");
jQuery("#MAIN_MAIL_EMAIL_DKIM_ENABLED").val('.$conf->global->MAIN_MAIL_EMAIL_DKIM_ENABLED.');
jQuery("#MAIN_MAIL_EMAIL_DKIM_ENABLED").removeAttr("disabled");
jQuery("#MAIN_MAIL_EMAIL_DKIM_DOMAIN").removeAttr("disabled");
@@ -233,12 +240,16 @@ if ($action == 'edit')
initfields();
});
jQuery("#MAIN_MAIL_EMAIL_TLS").change(function() {
- if (jQuery("#MAIN_MAIL_EMAIL_STARTTLS").val() == 1)
+ if (jQuery("#MAIN_MAIL_EMAIL_TLS").val() == 1)
jQuery("#MAIN_MAIL_EMAIL_STARTTLS").val(0);
+ else
+ jQuery("#MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED").val(0);
});
jQuery("#MAIN_MAIL_EMAIL_STARTTLS").change(function() {
- if (jQuery("#MAIN_MAIL_EMAIL_TLS").val() == 1)
+ if (jQuery("#MAIN_MAIL_EMAIL_STARTTLS").val() == 1)
jQuery("#MAIN_MAIL_EMAIL_TLS").val(0);
+ else
+ jQuery("#MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED").val(0);
});
})';
print ''."\n";
@@ -406,6 +417,17 @@ if ($action == 'edit')
} else print yn(0).' ('.$langs->trans("NotSupported").')';
print ' ';
+ // SMTP_ALLOW_SELF_SIGNED
+ print ''.$langs->trans("MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED").' ';
+ if (!empty($conf->use_javascript_ajax) || (isset($conf->global->MAIN_MAIL_SENDMODE) && in_array($conf->global->MAIN_MAIL_SENDMODE, array('smtps', 'swiftmailer'))))
+ {
+ if (function_exists('openssl_open'))
+ {
+ print $form->selectyesno('MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED', (!empty($conf->global->MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED) ? $conf->global->MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED : 0), 1);
+ } else print yn(0).' ('.$langs->trans("YourPHPDoesNotHaveSSLSupport").')';
+ } else print yn(0).' ('.$langs->trans("NotSupported").')';
+ print ' '.$langs->trans("MAIN_MAIL_EMAIL_DKIM_ENABLED").' ';
if (!empty($conf->use_javascript_ajax) || (isset($conf->global->MAIN_MAIL_SENDMODE) && in_array($conf->global->MAIN_MAIL_SENDMODE, array('swiftmailer'))))
@@ -571,6 +593,17 @@ if ($action == 'edit')
} else print ''.yn(0).' ('.$langs->trans("NotSupported").')';
print ' '.$langs->trans("MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED").' ';
+ if (isset($conf->global->MAIN_MAIL_SENDMODE) && in_array($conf->global->MAIN_MAIL_SENDMODE, array('smtps', 'swiftmailer')))
+ {
+ if (function_exists('openssl_open'))
+ {
+ print yn($conf->global->MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED);
+ } else print yn(0).' ('.$langs->trans("YourPHPDoesNotHaveSSLSupport").')';
+ } else print ''.yn(0).' ('.$langs->trans("NotSupported").')';
+ print '
';
dol_fiche_end();
@@ -437,6 +460,17 @@ if ($action == 'edit')
} else print yn(0).' ('.$langs->trans("YourPHPDoesNotHaveSSLSupport").')';
} else print yn(0).' ('.$langs->trans("NotSupported").')';
print '';
+
+ // SMTP_ALLOW_SELF_SIGNED_EMAILING
+ print '';
}
print '';
diff --git a/htdocs/admin/mails_senderprofile_list.php b/htdocs/admin/mails_senderprofile_list.php
index a471c0369a4..9a1a696e034 100644
--- a/htdocs/admin/mails_senderprofile_list.php
+++ b/htdocs/admin/mails_senderprofile_list.php
@@ -47,7 +47,7 @@ $rowid = GETPOST('rowid', 'alpha');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha') || (empty($toselect) && $massaction === '0')) { $page = 0; } // If $page is not defined, or '' or -1 or if we click on clear filters or if we select empty mass action
diff --git a/htdocs/admin/mails_templates.php b/htdocs/admin/mails_templates.php
index b33741cd571..610dd9c1ef2 100644
--- a/htdocs/admin/mails_templates.php
+++ b/htdocs/admin/mails_templates.php
@@ -341,7 +341,7 @@ if (empty($reshook))
$i++;
}
- $sql .= " WHERE ".$rowidcol." = '".$rowid."'";
+ $sql .= " WHERE ".$rowidcol." = ".((int) $rowid);
//print $sql;exit;
dol_syslog("actionmodify", LOG_DEBUG);
//print $sql;
@@ -359,7 +359,7 @@ if (empty($reshook))
{
$rowidcol = "rowid";
- $sql = "DELETE from ".$tabname[$id]." WHERE ".$rowidcol."='".$rowid."'";
+ $sql = "DELETE from ".$tabname[$id]." WHERE ".$rowidcol."=".((int) $rowid);
dol_syslog("delete", LOG_DEBUG);
$result = $db->query($sql);
@@ -379,7 +379,7 @@ if (empty($reshook))
{
$rowidcol = "rowid";
- $sql = "UPDATE ".$tabname[$id]." SET active = 1 WHERE ".$rowidcol."='".$rowid."'";
+ $sql = "UPDATE ".$tabname[$id]." SET active = 1 WHERE ".$rowidcol."=".((int) $rowid);
$result = $db->query($sql);
if (!$result)
@@ -393,7 +393,7 @@ if (empty($reshook))
{
$rowidcol = "rowid";
- $sql = "UPDATE ".$tabname[$id]." SET active = 0 WHERE ".$rowidcol."='".$rowid."'";
+ $sql = "UPDATE ".$tabname[$id]." SET active = 0 WHERE ".$rowidcol."=".((int) $rowid);
$result = $db->query($sql);
if (!$result)
@@ -443,7 +443,7 @@ if (!$user->admin)
}
if (empty($conf->global->MAIN_MULTILANGS))
{
- $sql .= " AND (lang = '".$langs->defaultlang."' OR lang IS NULL OR lang = '')";
+ $sql .= " AND (lang = '".$db->escape($langs->defaultlang)."' OR lang IS NULL OR lang = '')";
}
if ($search_label) $sql .= natural_search('label', $search_label);
if ($search_type_template != '' && $search_type_template != '-1') $sql .= natural_search('type_template', $search_type_template);
diff --git a/htdocs/admin/menus/edit.php b/htdocs/admin/menus/edit.php
index fbed05a1dbe..31e0f896633 100644
--- a/htdocs/admin/menus/edit.php
+++ b/htdocs/admin/menus/edit.php
@@ -32,6 +32,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/menubase.class.php';
$langs->loadLangs(array("other", "admin"));
$cancel = GETPOST('cancel', 'alphanohtml'); // We click on a Cancel button
+$confirm = GETPOST('confirm');
if (!$user->admin) accessforbidden();
@@ -231,26 +232,27 @@ if ($action == 'add')
}
// delete
-if ($action == 'confirm_delete' && $_POST["confirm"] == 'yes')
+if ($action == 'confirm_delete' && $confirm == 'yes')
{
- $this->db->begin();
+ $db->begin();
$sql = "DELETE FROM ".MAIN_DB_PREFIX."menu WHERE rowid = ".GETPOST('menuId', 'int');
$result = $db->query($sql);
if ($result == 0)
{
- $this->db->commit();
+ $db->commit();
llxHeader();
setEventMessages($langs->trans("MenuDeleted"), null, 'mesgs');
llxFooter();
exit;
} else {
- $this->db->rollback();
+ $db->rollback();
$reload = 0;
$_GET["action"] = '';
+ $action = '';
}
}
diff --git a/htdocs/admin/mrp.php b/htdocs/admin/mrp.php
index ffa4d8e7c6b..10e992c7ac2 100644
--- a/htdocs/admin/mrp.php
+++ b/htdocs/admin/mrp.php
@@ -293,7 +293,7 @@ print load_fiche_titre($langs->trans("MOsModelModule"), '', '');
$def = array();
$sql = "SELECT nom";
$sql .= " FROM ".MAIN_DB_PREFIX."document_model";
-$sql .= " WHERE type = '".$type."'";
+$sql .= " WHERE type = '".$db->escape($type)."'";
$sql .= " AND entity = ".$conf->entity;
$resql = $db->query($sql);
if ($resql)
diff --git a/htdocs/admin/paymentbybanktransfer.php b/htdocs/admin/paymentbybanktransfer.php
index c549e29443e..4056ce238e3 100644
--- a/htdocs/admin/paymentbybanktransfer.php
+++ b/htdocs/admin/paymentbybanktransfer.php
@@ -210,7 +210,7 @@ print load_fiche_titre($langs->trans("OrdersModelModule"),'','');
$def = array();
$sql = "SELECT nom";
$sql.= " FROM ".MAIN_DB_PREFIX."document_model";
-$sql.= " WHERE type = '".$type."'";
+$sql.= " WHERE type = '".$db->escape($type)."'";
$sql.= " AND entity = ".$conf->entity;
$resql=$db->query($sql);
if ($resql)
diff --git a/htdocs/admin/prelevement.php b/htdocs/admin/prelevement.php
index 0429fde6287..24d4a379f83 100644
--- a/htdocs/admin/prelevement.php
+++ b/htdocs/admin/prelevement.php
@@ -217,7 +217,7 @@ print load_fiche_titre($langs->trans("OrdersModelModule"),'','');
$def = array();
$sql = "SELECT nom";
$sql.= " FROM ".MAIN_DB_PREFIX."document_model";
-$sql.= " WHERE type = '".$type."'";
+$sql.= " WHERE type = '".$db->escape($type)."'";
$sql.= " AND entity = ".$conf->entity;
$resql=$db->query($sql);
if ($resql)
diff --git a/htdocs/admin/propal.php b/htdocs/admin/propal.php
index a0f9adb86d9..843cf0cfd55 100644
--- a/htdocs/admin/propal.php
+++ b/htdocs/admin/propal.php
@@ -316,7 +316,7 @@ print load_fiche_titre($langs->trans("ProposalsPDFModules"), '', '');
$def = array();
$sql = "SELECT nom";
$sql .= " FROM ".MAIN_DB_PREFIX."document_model";
-$sql .= " WHERE type = '".$type."'";
+$sql .= " WHERE type = '".$db->escape($type)."'";
$sql .= " AND entity = ".$conf->entity;
$resql = $db->query($sql);
if ($resql)
diff --git a/htdocs/admin/reception_setup.php b/htdocs/admin/reception_setup.php
index 4c33ee78ef7..60833669753 100644
--- a/htdocs/admin/reception_setup.php
+++ b/htdocs/admin/reception_setup.php
@@ -301,7 +301,7 @@ $def = array();
$sql = "SELECT nom";
$sql .= " FROM ".MAIN_DB_PREFIX."document_model";
-$sql .= " WHERE type = '".$type."'";
+$sql .= " WHERE type = '".$db->escape($type)."'";
$sql .= " AND entity = ".$conf->entity;
$resql = $db->query($sql);
diff --git a/htdocs/admin/stock.php b/htdocs/admin/stock.php
index 44ae6a82945..c7508e996ad 100644
--- a/htdocs/admin/stock.php
+++ b/htdocs/admin/stock.php
@@ -516,7 +516,7 @@ print load_fiche_titre($langs->trans("WarehouseModelModules"), '', '');
$def = array();
$sql = "SELECT nom";
$sql .= " FROM ".MAIN_DB_PREFIX."document_model";
-$sql .= " WHERE type = '".$type."'";
+$sql .= " WHERE type = '".$db->escape($type)."'";
$sql .= " AND entity = ".$conf->entity;
$resql = $db->query($sql);
if ($resql)
@@ -760,76 +760,6 @@ print '';
print '';
-/*
-print '
'; -if ($conf->global->MAIN_FEATURES_LEVEL >= 2) -{ - print '';
- print '
';
-}
-*/
-
-/* I keep the option/feature, but hidden to end users for the moment. If feature is used by module, no need to have users see it.
-If not used by a module, I still need to understand in which case user may need this now we can set rule on product page.
-if ($conf->global->PRODUIT_SOUSPRODUITS)
-{
- print '';
- print ''.$langs->trans("IndependantSubProductStock").' ';
- print '';
- print "';
- print " \n";
- print " \n";
-}
-*/
-
// End of page
llxFooter();
$db->close();
diff --git a/htdocs/admin/supplier_payment.php b/htdocs/admin/supplier_payment.php
index 27b3c023fcb..5541b8ff895 100644
--- a/htdocs/admin/supplier_payment.php
+++ b/htdocs/admin/supplier_payment.php
@@ -179,7 +179,7 @@ print load_fiche_titre($langs->trans("PaymentsNumberingModule"), '', '');
$def = array();
$sql = "SELECT nom";
$sql .= " FROM ".MAIN_DB_PREFIX."document_model";
-$sql .= " WHERE type = '".$type."'";
+$sql .= " WHERE type = '".$db->escape($type)."'";
$sql .= " AND entity = ".$conf->entity;
$resql = $db->query($sql);
if ($resql)
diff --git a/htdocs/admin/supplier_proposal.php b/htdocs/admin/supplier_proposal.php
index b0c5c4bff10..f2110687042 100644
--- a/htdocs/admin/supplier_proposal.php
+++ b/htdocs/admin/supplier_proposal.php
@@ -310,7 +310,7 @@ print load_fiche_titre($langs->trans("SupplierProposalPDFModules"), '', '');
$def = array();
$sql = "SELECT nom";
$sql .= " FROM ".MAIN_DB_PREFIX."document_model";
-$sql .= " WHERE type = '".$type."'";
+$sql .= " WHERE type = '".$db->escape($type)."'";
$sql .= " AND entity = ".$conf->entity;
$resql = $db->query($sql);
if ($resql)
diff --git a/htdocs/admin/syslog.php b/htdocs/admin/syslog.php
index 079fb3a6052..60de87d2d2e 100644
--- a/htdocs/admin/syslog.php
+++ b/htdocs/admin/syslog.php
@@ -212,6 +212,12 @@ foreach ($syslogModules as $moduleName)
print '';
print ' ';
print $module->getName();
+ if ($moduleName == 'mod_syslog_syslog') {
+ if (! $module->isActive()) {
+ $langs->load("errors");
+ print $form->textwithpicto('', $langs->trans("ErrorPHPNeedModule", 'SysLog'));
+ }
+ }
print ' ';
print '';
diff --git a/htdocs/admin/system/dolibarr.php b/htdocs/admin/system/dolibarr.php
index 55a46e9f347..57d288dfb4c 100644
--- a/htdocs/admin/system/dolibarr.php
+++ b/htdocs/admin/system/dolibarr.php
@@ -365,7 +365,12 @@ foreach ($configfileparameters as $key => $value)
print ' '.$newkey.' ';
// Value
print "";
- if ($newkey == 'dolibarr_main_db_pass') print preg_replace('/./i', '*', ${$newkey});
+ if ($newkey == 'dolibarr_main_db_pass') {
+ if (empty($dolibarr_main_prod)) {
+ print '';
+ }
+ print '**********';
+ }
elseif ($newkey == 'dolibarr_main_url_root' && preg_match('/__auto__/', ${$newkey})) print ${$newkey}.' => '.constant('DOL_MAIN_URL_ROOT');
elseif ($newkey == 'dolibarr_main_document_root_alt') {
$tmparray = explode(',', ${$newkey});
@@ -395,7 +400,14 @@ foreach ($configfileparameters as $key => $value)
$valuetoshow = ${$newkey};
if (empty($valuetoshow)) {
- print img_warning($langs->trans('SwitchThisForABetterSecurity'));
+ print img_warning($langs->trans('SwitchThisForABetterSecurity', 1));
+ }
+ } elseif ($newkey == 'dolibarr_nocsrfcheck') {
+ print ${$newkey};
+
+ $valuetoshow = ${$newkey};
+ if (!empty($valuetoshow)) {
+ print img_warning($langs->trans('SwitchThisForABetterSecurity', 0));
}
} else {
print ${$newkey};
@@ -451,7 +463,16 @@ if ($resql)
print ' ';
print ''.$obj->name.' '."\n";
- print ''.dol_escape_htmltag($obj->value).' '."\n";
+ print '';
+ if (preg_match('/(_pass|password|_pw|_key|securekey|serverkey|secret\d?|p12key|exportkey|_PW_[a-z]+|token)$/i', $obj->name)) {
+ if (empty($dolibarr_main_prod)) {
+ print '';
+ }
+ print '**********';
+ } else {
+ print dol_escape_htmltag($obj->value);
+ }
+ print ' '."\n";
if (empty($conf->multicompany->enabled) || !$user->entity) print ''.$obj->entity.' '."\n"; // If superadmin or multicompany disabled
print " \n";
diff --git a/htdocs/admin/tools/dolibarr_export.php b/htdocs/admin/tools/dolibarr_export.php
index b8e6dc8c15e..f1a95a48e9f 100644
--- a/htdocs/admin/tools/dolibarr_export.php
+++ b/htdocs/admin/tools/dolibarr_export.php
@@ -31,7 +31,7 @@ $langs->load("admin");
$action = GETPOST('action', 'aZ09');
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (!$sortorder) $sortorder = "DESC";
diff --git a/htdocs/admin/tools/export.php b/htdocs/admin/tools/export.php
index 3614e412318..cbe25f0ff75 100644
--- a/htdocs/admin/tools/export.php
+++ b/htdocs/admin/tools/export.php
@@ -37,7 +37,7 @@ $file = GETPOST('filename_template', 'alpha');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha') || (empty($toselect) && $massaction === '0')) { $page = 0; } // If $page is not defined, or '' or -1 or if we click on clear filters or if we select empty mass action
diff --git a/htdocs/admin/tools/export_files.php b/htdocs/admin/tools/export_files.php
index 45b02716524..485df8c318b 100644
--- a/htdocs/admin/tools/export_files.php
+++ b/htdocs/admin/tools/export_files.php
@@ -39,7 +39,7 @@ $compression = GETPOST('compression');
$file = dol_sanitizeFileName($file);
$file = preg_replace('/(\.zip|\.tar|\.tgz|\.gz|\.tar\.gz|\.bz2)$/i', '', $file);
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (!$sortorder) $sortorder = "DESC";
diff --git a/htdocs/admin/tools/listevents.php b/htdocs/admin/tools/listevents.php
index af55fcd1f16..84fe534f473 100644
--- a/htdocs/admin/tools/listevents.php
+++ b/htdocs/admin/tools/listevents.php
@@ -46,7 +46,7 @@ $langs->loadLangs(array("companies", "admin", "users", "other"));
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
@@ -235,6 +235,20 @@ if ($result)
print $form->formconfirm($_SERVER["PHP_SELF"].'?noparam=noparam', $langs->trans('PurgeAuditEvents'), $langs->trans('ConfirmPurgeAuditEvents'), 'confirm_purge', $formquestion, 'no', 1);
}
+ // Check some parameters
+ // TODO Add a tab with this and other information
+ /*
+ global $dolibarr_main_prod, $dolibarr_nocsrfcheck;
+ if (empty($dolibarr_main_prod)) {
+ print $langs->trans("Warning").' dolibarr_main_prod = '.$dolibarr_main_prod;
+ print ' '.img_warning($langs->trans('SwitchThisForABetterSecurity', 1)).'
'; + } + if (!empty($dolibarr_nocsrfcheck)) { + print $langs->trans("Warning").' dolibarr_nocsrfcheck = '.$dolibarr_nocsrfcheck; + print ' '.img_warning($langs->trans('SwitchThisForABetterSecurity', 0)).'
'; + } + */ + print '
'; // You can use div-table-responsive-no-min if you dont need reserved height for your table
print '';
print '
';
-
+print '
';
dol_fiche_end();
diff --git a/htdocs/adherents/stats/geo.php b/htdocs/adherents/stats/geo.php
index edb37a9d4a8..f7001656bd9 100644
--- a/htdocs/adherents/stats/geo.php
+++ b/htdocs/adherents/stats/geo.php
@@ -45,7 +45,7 @@ $startyear = $year - 2;
$endyear = $year;
// Load translation files required by the page
-$langs->loadLangs(array("companies", "members"));
+$langs->loadLangs(array("companies", "members", "banks"));
/*
@@ -272,12 +272,13 @@ if (count($arrayjs) && $mode == 'memberbycountry') {
}
if ($mode) {
- // Print array / Affiche le tableau
- print '| '.$langs->trans("MemberNature").' | '; -print ''.$langs->trans("NbOfMembers").' ('.$langs->trans("AllTime").') | '; +print ''.$langs->trans("NbOfMembers").' ('.$langs->trans("AllTime").') | '; print ''.$langs->trans("NbOfActiveMembers").' | '; print ''.$langs->trans("LastMemberDate").' | '; print ''.$langs->trans("NbOfSubscriptions").' | '; @@ -170,7 +171,7 @@ foreach ($data as $val) { } print '
| '.$label.' | '; if ($label2) print ''.$label2.' | '; - print ''.$langs->trans("NbOfMembers").' ('.$langs->trans("AllTime").') | '; + print ''.$langs->trans("NbOfMembers").' ('.$langs->trans("AllTime").') | '; print ''.$langs->trans("LastMemberDate").' | '; print ''.$langs->trans("LatestSubscriptionDate").' | '; print '
'; -if ($conf->global->MAIN_FEATURES_LEVEL >= 2) -{ - print '
| '.$langs->trans("Inventory").' | '."\n"; - print ''.$langs->trans("Status").' | '."\n"; - print '
| '.$langs->trans("INVENTORY_DISABLE_VIRTUAL").' | '; - print ''; - if ($conf->use_javascript_ajax) { - print ajax_constantonoff('INVENTORY_DISABLE_VIRTUAL'); - } else { - $arrval = array('0' => $langs->trans("No"), '1' => $langs->trans("Yes")); - print $form->selectarray("INVENTORY_DISABLE_VIRTUAL", $arrval, $conf->global->INVENTORY_DISABLE_VIRTUAL); - } - print ' |
| '.$langs->trans("INVENTORY_USE_MIN_PA_IF_NO_LAST_PA").' | '; - print ''; - if ($conf->use_javascript_ajax) { - print ajax_constantonoff('INVENTORY_USE_MIN_PA_IF_NO_LAST_PA'); - } else { - $arrval = array('0' => $langs->trans("No"), '1' => $langs->trans("Yes")); - print $form->selectarray("INVENTORY_USE_MIN_PA_IF_NO_LAST_PA", $arrval, $conf->global->INVENTORY_USE_MIN_PA_IF_NO_LAST_PA); - } - print ' |
| '.$langs->trans("INVENTORY_USE_INVENTORY_DATE_FOR_DATE_OF_MVT").' | '; - print ''; - if ($conf->use_javascript_ajax) { - print ajax_constantonoff('INVENTORY_USE_INVENTORY_DATE_FOR_DATE_OF_MVT'); - } else { - $arrval = array('0' => $langs->trans("No"), '1' => $langs->trans("Yes")); - print $form->selectarray("INVENTORY_USE_INVENTORY_DATE_FOR_DATE_OF_MVT", $arrval, $conf->global->INVENTORY_USE_INVENTORY_DATE_FOR_DATE_OF_MVT); - } - print ' |
'; + } + if (!empty($dolibarr_nocsrfcheck)) { + print $langs->trans("Warning").' dolibarr_nocsrfcheck = '.$dolibarr_nocsrfcheck; + print ' '.img_warning($langs->trans('SwitchThisForABetterSecurity', 0)).'
'; + } + */ + print '
';
print '';
diff --git a/htdocs/admin/user.php b/htdocs/admin/user.php
index 25822cd380b..723a4bb0063 100644
--- a/htdocs/admin/user.php
+++ b/htdocs/admin/user.php
@@ -192,7 +192,7 @@ $dirmodels = array_merge(array('/'), (array) $conf->modules_parts['models']);
$def = array();
$sql = "SELECT nom";
$sql .= " FROM ".MAIN_DB_PREFIX."document_model";
-$sql .= " WHERE type = '".$type."'";
+$sql .= " WHERE type = '".$db->escape($type)."'";
$sql .= " AND entity = ".$conf->entity;
$resql = $db->query($sql);
if ($resql)
diff --git a/htdocs/admin/usergroup.php b/htdocs/admin/usergroup.php
index d6b66b6fd22..0b372bf3518 100644
--- a/htdocs/admin/usergroup.php
+++ b/htdocs/admin/usergroup.php
@@ -124,7 +124,7 @@ $form = new Form($db);
$def = array();
$sql = "SELECT nom";
$sql .= " FROM ".MAIN_DB_PREFIX."document_model";
-$sql .= " WHERE type = '".$type."'";
+$sql .= " WHERE type = '".$db->escape($type)."'";
$sql .= " AND entity = ".$conf->entity;
$resql = $db->query($sql);
if ($resql)
diff --git a/htdocs/admin/website.php b/htdocs/admin/website.php
index 7c098aa1c4b..595848fe232 100644
--- a/htdocs/admin/website.php
+++ b/htdocs/admin/website.php
@@ -51,7 +51,7 @@ $actl[1] = img_picto($langs->trans("Activated"), 'switch_on');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
@@ -252,7 +252,7 @@ if (GETPOST('actionadd', 'alpha') || GETPOST('actionmodify', 'alpha'))
else $sql .= "'".$db->escape($_POST[$listfieldvalue[$i]])."'";
$i++;
}
- $sql .= " WHERE ".$rowidcol." = '".$rowid."'";
+ $sql .= " WHERE ".$rowidcol." = ".((int) $rowid);
dol_syslog("actionmodify", LOG_DEBUG);
//print $sql;
@@ -310,16 +310,16 @@ if ($action == 'confirm_delete' && $confirm == 'yes') // delete
if ($website->id > 0)
{
- $sql = "DELETE from ".MAIN_DB_PREFIX."website_account WHERE fk_website ='".$rowid."'";
+ $sql = "DELETE from ".MAIN_DB_PREFIX."website_account WHERE fk_website = ".((int) $rowid);
$result = $db->query($sql);
- $sql = "DELETE from ".MAIN_DB_PREFIX."website_page WHERE fk_website ='".$rowid."'";
+ $sql = "DELETE from ".MAIN_DB_PREFIX."website_page WHERE fk_website = ".((int) $rowid);
$result = $db->query($sql);
- $sql = "DELETE from ".MAIN_DB_PREFIX."website_extrafields WHERE fk_object ='".$rowid."'";
+ $sql = "DELETE from ".MAIN_DB_PREFIX."website_extrafields WHERE fk_object = ".((int) $rowid);
$result = $db->query($sql);
- $sql = "DELETE from ".MAIN_DB_PREFIX."website WHERE rowid ='".$rowid."'";
+ $sql = "DELETE from ".MAIN_DB_PREFIX."website WHERE rowid = ".((int) $rowid);
$result = $db->query($sql);
if (!$result)
{
@@ -346,7 +346,7 @@ if ($action == $acts[0])
if ($tabrowid[$id]) { $rowidcol = $tabrowid[$id]; } else { $rowidcol = "rowid"; }
if ($rowid) {
- $sql = "UPDATE ".$tabname[$id]." SET status = 1 WHERE rowid ='".$rowid."'";
+ $sql = "UPDATE ".$tabname[$id]." SET status = 1 WHERE rowid = ".((int) $rowid);
}
$result = $db->query($sql);
@@ -362,7 +362,7 @@ if ($action == $acts[1])
if ($tabrowid[$id]) { $rowidcol = $tabrowid[$id]; } else { $rowidcol = "rowid"; }
if ($rowid) {
- $sql = "UPDATE ".$tabname[$id]." SET status = 0 WHERE rowid ='".$rowid."'";
+ $sql = "UPDATE ".$tabname[$id]." SET status = 0 WHERE rowid = ".((int) $rowid);
}
$result = $db->query($sql);
diff --git a/htdocs/admin/website_options.php b/htdocs/admin/website_options.php
index 2bbe3e84638..1df7642b646 100644
--- a/htdocs/admin/website_options.php
+++ b/htdocs/admin/website_options.php
@@ -46,7 +46,7 @@ $status = 1;
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
diff --git a/htdocs/api/class/api_access.class.php b/htdocs/api/class/api_access.class.php
index a6d0d72b8de..84f7bf303e7 100644
--- a/htdocs/api/class/api_access.class.php
+++ b/htdocs/api/class/api_access.class.php
@@ -59,6 +59,16 @@ class DolibarrApiAccess implements iAuthenticate
*/
public static $user = '';
+
+ /**
+ * Constructor
+ */
+ public function __construct()
+ {
+ global $db;
+ $this->db = $db;
+ }
+
// phpcs:disable PEAR.NamingConventions.ValidFunctionName
/**
* Check access
@@ -107,15 +117,15 @@ class DolibarrApiAccess implements iAuthenticate
$sql = "SELECT u.login, u.datec, u.api_key, ";
$sql .= " u.tms as date_modification, u.entity";
$sql .= " FROM ".MAIN_DB_PREFIX."user as u";
- $sql .= " WHERE u.api_key = '".$db->escape($api_key)."'";
+ $sql .= " WHERE u.api_key = '".$this->db->escape($api_key)."'";
// TODO Check if 2 users has same API key.
- $result = $db->query($sql);
+ $result = $this->db->query($sql);
if ($result)
{
- if ($db->num_rows($result))
+ if ($this->db->num_rows($result))
{
- $obj = $db->fetch_object($result);
+ $obj = $this->db->fetch_object($result);
$login = $obj->login;
$stored_key = $obj->api_key;
$userentity = $obj->entity;
@@ -125,11 +135,11 @@ class DolibarrApiAccess implements iAuthenticate
$conf->entity = ($obj->entity ? $obj->entity : 1);
// We must also reload global conf to get params from the entity
dol_syslog("Entity was not set on http header with HTTP_DOLAPIENTITY (recommanded for performance purpose), so we switch now on entity of user (".$conf->entity.") and we have to reload configuration.", LOG_WARNING);
- $conf->setValues($db);
+ $conf->setValues($this->db);
}
}
} else {
- throw new RestException(503, 'Error when fetching user api_key :'.$db->error_msg);
+ throw new RestException(503, 'Error when fetching user api_key :'.$this->db->error_msg);
}
if ($stored_key != $api_key) { // This should not happen since we did a search on api_key
@@ -141,7 +151,7 @@ class DolibarrApiAccess implements iAuthenticate
{
throw new RestException(503, 'Error when searching login user from api key');
}
- $fuser = new User($db);
+ $fuser = new User($this->db);
$result = $fuser->fetch('', $login, '', 0, (empty($userentity) ? -1 : $conf->entity)); // If user is not entity 0, we search in working entity $conf->entity (that may have been forced to a different value than user entity)
if ($result <= 0) {
throw new RestException(503, 'Error when fetching user :'.$fuser->error.' (conf->entity='.$conf->entity.')');
diff --git a/htdocs/asset/list.php b/htdocs/asset/list.php
index 224caea2e58..975551968b4 100644
--- a/htdocs/asset/list.php
+++ b/htdocs/asset/list.php
@@ -47,7 +47,7 @@ $id = GETPOST('id', 'int');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha') || (empty($toselect) && $massaction === '0')) { $page = 0; } // If $page is not defined, or '' or -1 or if we click on clear filters or if we select empty mass action
diff --git a/htdocs/blockedlog/admin/blockedlog_list.php b/htdocs/blockedlog/admin/blockedlog_list.php
index 818c84a8b5e..f70e402b667 100644
--- a/htdocs/blockedlog/admin/blockedlog_list.php
+++ b/htdocs/blockedlog/admin/blockedlog_list.php
@@ -56,7 +56,7 @@ if (($search_start == -1 || empty($search_start)) && !GETPOSTISSET('search_start
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
diff --git a/htdocs/bom/bom_list.php b/htdocs/bom/bom_list.php
index 5f1728ef055..121517b2544 100644
--- a/htdocs/bom/bom_list.php
+++ b/htdocs/bom/bom_list.php
@@ -45,7 +45,7 @@ $id = GETPOST('id', 'int');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha') || (empty($toselect) && $massaction === '0')) { $page = 0; } // If $page is not defined, or '' or -1 or if we click on clear filters or if we select empty mass action
diff --git a/htdocs/bom/class/api_boms.class.php b/htdocs/bom/class/api_boms.class.php
index a6295d12589..b9123b8c226 100644
--- a/htdocs/bom/class/api_boms.class.php
+++ b/htdocs/bom/class/api_boms.class.php
@@ -99,7 +99,7 @@ class Boms extends DolibarrApi
global $db, $conf;
$obj_ret = array();
- $tmpobject = new BOM($db);
+ $tmpobject = new BOM($this->db);
$socid = DolibarrApiAccess::$user->socid ? DolibarrApiAccess::$user->socid : '';
@@ -139,7 +139,7 @@ class Boms extends DolibarrApi
$sql .= " AND (".preg_replace_callback('/'.$regexstring.'/', 'DolibarrApi::_forge_criteria_callback', $sqlfilters).")";
}
- $sql .= $db->order($sortfield, $sortorder);
+ $sql .= $this->db->order($sortfield, $sortorder);
if ($limit) {
if ($page < 0)
{
@@ -147,18 +147,18 @@ class Boms extends DolibarrApi
}
$offset = $limit * $page;
- $sql .= $db->plimit($limit + 1, $offset);
+ $sql .= $this->db->plimit($limit + 1, $offset);
}
- $result = $db->query($sql);
+ $result = $this->db->query($sql);
if ($result)
{
- $num = $db->num_rows($result);
+ $num = $this->db->num_rows($result);
$i = 0;
while ($i < $num)
{
- $obj = $db->fetch_object($result);
- $bom_static = new BOM($db);
+ $obj = $this->db->fetch_object($result);
+ $bom_static = new BOM($this->db);
if ($bom_static->fetch($obj->rowid)) {
$obj_ret[] = $this->_cleanObjectDatas($bom_static);
}
diff --git a/htdocs/bookmarks/list.php b/htdocs/bookmarks/list.php
index 3ea33b329ff..ca8e1d5c16a 100644
--- a/htdocs/bookmarks/list.php
+++ b/htdocs/bookmarks/list.php
@@ -42,7 +42,7 @@ $optioncss = GETPOST('optioncss', 'alpha');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha') || (empty($toselect) && $massaction === '0')) { $page = 0; } // If $page is not defined, or '' or -1 or if we click on clear filters or if we select empty mass action
diff --git a/htdocs/cashdesk/facturation.php b/htdocs/cashdesk/facturation.php
index e1a42aed012..85347e4c7ff 100644
--- a/htdocs/cashdesk/facturation.php
+++ b/htdocs/cashdesk/facturation.php
@@ -42,7 +42,7 @@ if (GETPOST('filtre', 'alpha')) {
$sql = "SELECT p.rowid, p.ref, p.label, p.tva_tx, p.fk_product_type";
if (!empty($conf->stock->enabled) && !empty($conf_fkentrepot)) $sql .= ", ps.reel";
$sql .= " FROM ".MAIN_DB_PREFIX."product as p";
- if (!empty($conf->stock->enabled) && !empty($conf_fkentrepot)) $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product_stock as ps ON p.rowid = ps.fk_product AND ps.fk_entrepot = '".$conf_fkentrepot."'";
+ if (!empty($conf->stock->enabled) && !empty($conf_fkentrepot)) $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product_stock as ps ON p.rowid = ps.fk_product AND ps.fk_entrepot = '".$db->escape($conf_fkentrepot)."'";
$sql .= " WHERE p.entity IN (".getEntity('product').")";
$sql .= " AND p.tosell = 1";
if (!$conf->global->CASHDESK_SERVICES) $sql .= " AND p.fk_product_type = 0";
@@ -92,7 +92,7 @@ if (GETPOST('filtre', 'alpha')) {
$sql = "SELECT p.rowid, ref, label, tva_tx, p.fk_product_type";
if (!empty($conf->stock->enabled) && !empty($conf_fkentrepot)) $sql .= ", ps.reel";
$sql .= " FROM ".MAIN_DB_PREFIX."product as p";
- if (!empty($conf->stock->enabled) && !empty($conf_fkentrepot)) $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product_stock as ps ON p.rowid = ps.fk_product AND ps.fk_entrepot = '".$conf_fkentrepot."'";
+ if (!empty($conf->stock->enabled) && !empty($conf_fkentrepot)) $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product_stock as ps ON p.rowid = ps.fk_product AND ps.fk_entrepot = '".$db->escape($conf_fkentrepot)."'";
$sql .= " WHERE p.entity IN (".getEntity('product').")";
$sql .= " AND p.tosell = 1";
if (!$conf->global->CASHDESK_SERVICES) $sql .= " AND p.fk_product_type = 0";
diff --git a/htdocs/cashdesk/facturation_dhtml.php b/htdocs/cashdesk/facturation_dhtml.php
index 99e1ed2f942..9ee4bdb856c 100644
--- a/htdocs/cashdesk/facturation_dhtml.php
+++ b/htdocs/cashdesk/facturation_dhtml.php
@@ -45,7 +45,7 @@ if (dol_strlen($search) >= 0) // If search criteria is on char length at least
$sql = "SELECT p.rowid, p.ref, p.label, p.tva_tx";
if (!empty($conf->stock->enabled) && !empty($conf_fkentrepot)) $sql .= ", ps.reel";
$sql .= " FROM ".MAIN_DB_PREFIX."product as p";
- if (!empty($conf->stock->enabled) && !empty($conf_fkentrepot)) $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product_stock as ps ON p.rowid = ps.fk_product AND ps.fk_entrepot = '".$conf_fkentrepot."'";
+ if (!empty($conf->stock->enabled) && !empty($conf_fkentrepot)) $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product_stock as ps ON p.rowid = ps.fk_product AND ps.fk_entrepot = '".$db->escape($conf_fkentrepot)."'";
$sql .= " WHERE p.entity IN (".getEntity('product').")";
$sql .= " AND p.tosell = 1";
$sql .= " AND p.fk_product_type = 0";
diff --git a/htdocs/cashdesk/index_verif.php b/htdocs/cashdesk/index_verif.php
index 204af8f51f7..e8366e981cc 100644
--- a/htdocs/cashdesk/index_verif.php
+++ b/htdocs/cashdesk/index_verif.php
@@ -89,7 +89,7 @@ if ($retour >= 0)
$sql = "SELECT rowid, lastname, firstname";
$sql .= " FROM ".MAIN_DB_PREFIX."user";
- $sql .= " WHERE login = '".$username."'";
+ $sql .= " WHERE login = '".$db->escape($username)."'";
$sql .= " AND entity IN (0,".$conf->entity.")";
$result = $db->query($sql);
diff --git a/htdocs/categories/class/api_categories.class.php b/htdocs/categories/class/api_categories.class.php
index 4a84a25e5ca..5f0a28340f9 100644
--- a/htdocs/categories/class/api_categories.class.php
+++ b/htdocs/categories/class/api_categories.class.php
@@ -155,7 +155,7 @@ class Categories extends DolibarrApi
$sql .= " AND (".preg_replace_callback('/'.$regexstring.'/', 'DolibarrApi::_forge_criteria_callback', $sqlfilters).")";
}
- $sql .= $db->order($sortfield, $sortorder);
+ $sql .= $this->db->order($sortfield, $sortorder);
if ($limit) {
if ($page < 0)
{
@@ -163,19 +163,19 @@ class Categories extends DolibarrApi
}
$offset = $limit * $page;
- $sql .= $db->plimit($limit + 1, $offset);
+ $sql .= $this->db->plimit($limit + 1, $offset);
}
- $result = $db->query($sql);
+ $result = $this->db->query($sql);
if ($result)
{
$i = 0;
- $num = $db->num_rows($result);
+ $num = $this->db->num_rows($result);
$min = min($num, ($limit <= 0 ? $num : $limit));
while ($i < $min)
{
- $obj = $db->fetch_object($result);
- $category_static = new Categorie($db);
+ $obj = $this->db->fetch_object($result);
+ $category_static = new Categorie($this->db);
if ($category_static->fetch($obj->rowid)) {
$obj_ret[] = $this->_cleanObjectDatas($category_static);
}
@@ -183,7 +183,7 @@ class Categories extends DolibarrApi
}
}
else {
- throw new RestException(503, 'Error when retrieve category list : '.$db->lasterror());
+ throw new RestException(503, 'Error when retrieve category list : '.$this->db->lasterror());
}
if (!count($obj_ret)) {
throw new RestException(404, 'No category found');
diff --git a/htdocs/categories/viewcat.php b/htdocs/categories/viewcat.php
index 2648a0c09f4..3a1d13d210e 100644
--- a/htdocs/categories/viewcat.php
+++ b/htdocs/categories/viewcat.php
@@ -53,7 +53,7 @@ $optioncss = GETPOST('optioncss', 'aZ'); // Option for the css output (always '
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha') || (empty($toselect) && $massaction === '0')) { $page = 0; } // If $page is not defined, or '' or -1 or if we click on clear filters or if we select empty mass action
diff --git a/htdocs/comm/action/class/actioncomm.class.php b/htdocs/comm/action/class/actioncomm.class.php
index 7e4a58b07e0..a5084bfac74 100644
--- a/htdocs/comm/action/class/actioncomm.class.php
+++ b/htdocs/comm/action/class/actioncomm.class.php
@@ -1031,8 +1031,8 @@ class ActionComm extends CommonObject
$sql .= ", location = ".($this->location ? "'".$this->db->escape($this->location)."'" : "null");
$sql .= ", transparency = '".$this->db->escape($this->transparency)."'";
$sql .= ", fk_user_mod = ".$user->id;
- $sql .= ", fk_user_action=".($userownerid > 0 ? "'".$userownerid."'" : "null");
- $sql .= ", fk_user_done=".($userdoneid > 0 ? "'".$userdoneid."'" : "null");
+ $sql .= ", fk_user_action = ".($userownerid > 0 ? "'".$this->db->escape($userownerid)."'" : "null");
+ $sql .= ", fk_user_done = ".($userdoneid > 0 ? "'".$this->db->escape($userdoneid)."'" : "null");
if (!empty($this->fk_element)) $sql .= ", fk_element=".($this->fk_element ? $this->db->escape($this->fk_element) : "null");
if (!empty($this->elementtype)) $sql .= ", elementtype=".($this->elementtype ? "'".$this->db->escape($this->elementtype)."'" : "null");
$sql .= " WHERE id=".$this->id;
@@ -1127,7 +1127,7 @@ class ActionComm extends CommonObject
* Load all objects with filters.
* @todo WARNING: This make a fetch on all records instead of making one request with a join.
*
- * @param DoliDb $db Database handler
+ * @param DoliDb $db Not used
* @param int $socid Filter by thirdparty
* @param int $fk_element Id of element action is linked to
* @param string $elementtype Type of element action is linked to
@@ -1160,7 +1160,7 @@ class ActionComm extends CommonObject
$sql .= " element_type = 'socpeople' AND fk_element = ".$fk_element.')';
}
else {
- $sql .= " AND a.fk_element = ".(int) $fk_element." AND a.elementtype = '".$elementtype."'";
+ $sql .= " AND a.fk_element = ".(int) $fk_element." AND a.elementtype = '".$db->escape($elementtype)."'";
}
}
if (!empty($filter)) $sql .= $filter;
diff --git a/htdocs/comm/action/class/api_agendaevents.class.php b/htdocs/comm/action/class/api_agendaevents.class.php
index 43d880b3866..473c87e22a0 100644
--- a/htdocs/comm/action/class/api_agendaevents.class.php
+++ b/htdocs/comm/action/class/api_agendaevents.class.php
@@ -148,7 +148,7 @@ class AgendaEvents extends DolibarrApi
$sql .= " AND (".preg_replace_callback('/'.$regexstring.'/', 'DolibarrApi::_forge_criteria_callback', $sqlfilters).")";
}
- $sql .= $db->order($sortfield, $sortorder);
+ $sql .= $this->db->order($sortfield, $sortorder);
if ($limit) {
if ($page < 0)
{
@@ -156,27 +156,27 @@ class AgendaEvents extends DolibarrApi
}
$offset = $limit * $page;
- $sql .= $db->plimit($limit + 1, $offset);
+ $sql .= $this->db->plimit($limit + 1, $offset);
}
- $result = $db->query($sql);
+ $result = $this->db->query($sql);
if ($result)
{
$i = 0;
- $num = $db->num_rows($result);
+ $num = $this->db->num_rows($result);
$min = min($num, ($limit <= 0 ? $num : $limit));
while ($i < $min)
{
- $obj = $db->fetch_object($result);
- $actioncomm_static = new ActionComm($db);
+ $obj = $this->db->fetch_object($result);
+ $actioncomm_static = new ActionComm($this->db);
if ($actioncomm_static->fetch($obj->rowid)) {
$obj_ret[] = $this->_cleanObjectDatas($actioncomm_static);
}
$i++;
}
} else {
- throw new RestException(503, 'Error when retrieve Agenda Event list : '.$db->lasterror());
+ throw new RestException(503, 'Error when retrieve Agenda Event list : '.$this->db->lasterror());
}
if (!count($obj_ret)) {
throw new RestException(404, 'No Agenda Event found');
diff --git a/htdocs/comm/action/class/cactioncomm.class.php b/htdocs/comm/action/class/cactioncomm.class.php
index 147a6ff7ef0..6e86a556a1a 100644
--- a/htdocs/comm/action/class/cactioncomm.class.php
+++ b/htdocs/comm/action/class/cactioncomm.class.php
@@ -139,7 +139,7 @@ class CActionComm
$sql .= " FROM ".MAIN_DB_PREFIX."c_actioncomm";
$sql .= " WHERE 1=1";
if ($active != '') $sql .= " AND active=".$active;
- if (!empty($excludetype)) $sql .= " AND type <> '".$excludetype."'";
+ if (!empty($excludetype)) $sql .= " AND type <> '".$this->db->escape($excludetype)."'";
if ($morefilter) $sql .= " AND ".$morefilter;
$sql .= " ORDER BY module, position, type";
diff --git a/htdocs/comm/action/index.php b/htdocs/comm/action/index.php
index f4e8487b054..a48dc03aea2 100644
--- a/htdocs/comm/action/index.php
+++ b/htdocs/comm/action/index.php
@@ -810,7 +810,7 @@ if ($conf->global->AGENDA_SHOW_HOLIDAYS)
if ($action == 'show_day')
{
// Request only leaves for the current selected day
- $sql .= " AND '".$year."-".$month."-".$day."' BETWEEN x.date_debut AND x.date_fin";
+ $sql .= " AND '".$db->escape($year)."-".$db->escape($month)."-".$db->escape($day)."' BETWEEN x.date_debut AND x.date_fin";
} elseif ($action == 'show_week')
{
// TODO: Add filter to reduce database request
diff --git a/htdocs/comm/card.php b/htdocs/comm/card.php
index d3e180b7a88..18bd6b22ce0 100644
--- a/htdocs/comm/card.php
+++ b/htdocs/comm/card.php
@@ -591,7 +591,7 @@ if ($object->id > 0)
$icon = 'bill';
if ($link) $boxstat .= '';
$boxstat .= '
| '; + print ''.$langs->trans("More").'... ('.$othernb.')'; + print ' | '; + print "|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| '; + print ''.$langs->trans("More").'... ('.$othernb.')'; + print ' | '; + print "';
print ' ';
- print $langs->trans('From').' ';
- print $form->selectDate($search_date_start ? $search_date_start : -1, 'search_date_start', 0, 0, 1);
+ print $form->selectDate($search_date_start ? $search_date_start : -1, 'search_date_start', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From'));
print ' ';
print '';
- print $langs->trans('to').' ';
- print $form->selectDate($search_date_end ? $search_date_end : -1, 'search_date_end', 0, 0, 1);
+ print $form->selectDate($search_date_end ? $search_date_end : -1, 'search_date_end', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('to'));
print ' ';
print ' | ';
}
@@ -650,12 +648,10 @@ if ($resql)
{
print '';
print ' ';
- print $langs->trans('From').' ';
- print $form->selectDate($search_dateend_start ? $search_dateend_start : -1, 'search_dateend_start', 0, 0, 1);
+ print $form->selectDate($search_dateend_start ? $search_dateend_start : -1, 'search_dateend_start', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From'));
print ' ';
print '';
- print $langs->trans('to').' ';
- print $form->selectDate($search_dateend_end ? $search_dateend_end : -1, 'search_dateend_end', 0, 0, 1);
+ print $form->selectDate($search_dateend_end ? $search_dateend_end : -1, 'search_dateend_end', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('to'));
print ' ';
print ' | ';
}
@@ -664,12 +660,10 @@ if ($resql)
{
print '';
print ' ';
- print $langs->trans('From').' ';
- print $form->selectDate($search_datedelivery_start ? $search_datedelivery_start : -1, 'search_datedelivery_start', 0, 0, 1);
+ print $form->selectDate($search_datedelivery_start ? $search_datedelivery_start : -1, 'search_datedelivery_start', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From'));
print ' ';
print '';
- print $langs->trans('to').' ';
- print $form->selectDate($search_datedelivery_end ? $search_datedelivery_end : -1, 'search_datedelivery_end', 0, 0, 1);
+ print $form->selectDate($search_datedelivery_end ? $search_datedelivery_end : -1, 'search_datedelivery_end', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From'));
print ' ';
print ' | ';
}
diff --git a/htdocs/comm/propal/stats/index.php b/htdocs/comm/propal/stats/index.php
index 00a79f3c1be..49e1141fec1 100644
--- a/htdocs/comm/propal/stats/index.php
+++ b/htdocs/comm/propal/stats/index.php
@@ -101,7 +101,7 @@ dol_mkdir($dir);
$stats = new PropaleStats($db, $socid, ($userid > 0 ? $userid : 0), $mode, ($typent_id > 0 ? $typent_id : 0), ($categ_id > 0 ? $categ_id : 0));
-if ($object_status != '' && $object_status >= 0) $stats->where .= ' AND p.fk_statut IN ('.$db->escape($object_status).')';
+if ($object_status != '' && $object_status >= 0) $stats->where .= ' AND p.fk_statut IN ('.$db->sanitize($db->escape($object_status)).')';
// Build graphic number of object
$data = $stats->getNbByMonthWithPrevYear($endyear, $startyear);
diff --git a/htdocs/commande/card.php b/htdocs/commande/card.php
index d48e990e7e8..b447a00c404 100644
--- a/htdocs/commande/card.php
+++ b/htdocs/commande/card.php
@@ -417,7 +417,7 @@ if (empty($reshook))
$originidforcontact=$srcobject->origin_id;
}
$sqlcontact = "SELECT code, fk_socpeople FROM ".MAIN_DB_PREFIX."element_contact as ec, ".MAIN_DB_PREFIX."c_type_contact as ctc";
- $sqlcontact.= " WHERE element_id = ".$originidforcontact." AND ec.fk_c_type_contact = ctc.rowid AND ctc.element = '".$originforcontact."'";
+ $sqlcontact.= " WHERE element_id = ".$originidforcontact." AND ec.fk_c_type_contact = ctc.rowid AND ctc.element = '".$db->escape($originforcontact)."'";
$resqlcontact = $db->query($sqlcontact);
if ($resqlcontact)
diff --git a/htdocs/commande/class/api_orders.class.php b/htdocs/commande/class/api_orders.class.php
index f62c00ee81b..2202ad5b67e 100644
--- a/htdocs/commande/class/api_orders.class.php
+++ b/htdocs/commande/class/api_orders.class.php
@@ -193,7 +193,7 @@ class Orders extends DolibarrApi
$sql .= " AND (".preg_replace_callback('/'.$regexstring.'/', 'DolibarrApi::_forge_criteria_callback', $sqlfilters).")";
}
- $sql .= $db->order($sortfield, $sortorder);
+ $sql .= $this->db->order($sortfield, $sortorder);
if ($limit) {
if ($page < 0)
{
@@ -201,21 +201,21 @@ class Orders extends DolibarrApi
}
$offset = $limit * $page;
- $sql .= $db->plimit($limit + 1, $offset);
+ $sql .= $this->db->plimit($limit + 1, $offset);
}
dol_syslog("API Rest request");
- $result = $db->query($sql);
+ $result = $this->db->query($sql);
if ($result)
{
- $num = $db->num_rows($result);
+ $num = $this->db->num_rows($result);
$min = min($num, ($limit <= 0 ? $num : $limit));
$i = 0;
while ($i < $min)
{
- $obj = $db->fetch_object($result);
- $commande_static = new Commande($db);
+ $obj = $this->db->fetch_object($result);
+ $commande_static = new Commande($this->db);
if ($commande_static->fetch($obj->rowid)) {
// Add external contacts ids
$commande_static->contacts_ids = $commande_static->liste_contact(-1, 'external', 1);
@@ -224,7 +224,7 @@ class Orders extends DolibarrApi
$i++;
}
} else {
- throw new RestException(503, 'Error when retrieve commande list : '.$db->lasterror());
+ throw new RestException(503, 'Error when retrieve commande list : '.$this->db->lasterror());
}
if (!count($obj_ret)) {
throw new RestException(404, 'No order found');
diff --git a/htdocs/commande/class/commande.class.php b/htdocs/commande/class/commande.class.php
index 1bd919fd470..5c314226214 100644
--- a/htdocs/commande/class/commande.class.php
+++ b/htdocs/commande/class/commande.class.php
@@ -1122,7 +1122,7 @@ class Commande extends CommonOrder
}
$sqlcontact = "SELECT ctc.code, ctc.source, ec.fk_socpeople FROM ".MAIN_DB_PREFIX."element_contact as ec, ".MAIN_DB_PREFIX."c_type_contact as ctc";
- $sqlcontact .= " WHERE element_id = ".$originidforcontact." AND ec.fk_c_type_contact = ctc.rowid AND ctc.element = '".$originforcontact."'";
+ $sqlcontact .= " WHERE element_id = ".$originidforcontact." AND ec.fk_c_type_contact = ctc.rowid AND ctc.element = '".$this->db->escape($originforcontact)."'";
$resqlcontact = $this->db->query($sqlcontact);
if ($resqlcontact)
diff --git a/htdocs/commande/list.php b/htdocs/commande/list.php
index c65ffe18e12..921e1de185b 100644
--- a/htdocs/commande/list.php
+++ b/htdocs/commande/list.php
@@ -630,31 +630,31 @@ if ($resql)
if (!empty($arrayfields['c.ref']['checked']))
{
print ''; - print ''; + print ''; print ' | '; } // Ref customer if (!empty($arrayfields['c.ref_client']['checked'])) { print ''; - print ''; + print ''; print ' | '; } // Project ref if (!empty($arrayfields['p.ref']['checked'])) { - print ''; + print ' | '; } // Project title if (!empty($arrayfields['p.title']['checked'])) { - print ' | '; + print ' | '; } // Thirpdarty if (!empty($arrayfields['s.nom']['checked'])) { print ' | '; - print ''; + print ''; print ' | '; } // Town @@ -687,12 +687,10 @@ if ($resql) { print '';
print ' ';
- print $langs->trans('From').' ';
- print $form->selectDate($search_dateorder_start ? $search_dateorder_start : -1, 'search_dateorder_start', 0, 0, 1);
+ print $form->selectDate($search_dateorder_start ? $search_dateorder_start : -1, 'search_dateorder_start', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From'));
print ' ';
print '';
- print $langs->trans('to').' ';
- print $form->selectDate($search_dateorder_end ? $search_dateorder_end : -1, 'search_dateorder_end', 0, 0, 1);
+ print $form->selectDate($search_dateorder_end ? $search_dateorder_end : -1, 'search_dateorder_end', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('to'));
print ' ';
print ' | ';
}
@@ -700,12 +698,10 @@ if ($resql)
{
print '';
print ' ';
- print $langs->trans('From').' ';
- print $form->selectDate($search_datedelivery_start ? $search_datedelivery_start : -1, 'search_datedelivery_start', 0, 0, 1);
+ print $form->selectDate($search_datedelivery_start ? $search_datedelivery_start : -1, 'search_datedelivery_start', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From'));
print ' ';
print '';
- print $langs->trans('to').' ';
- print $form->selectDate($search_datedelivery_end ? $search_datedelivery_end : -1, 'search_datedelivery_end', 0, 0, 1);
+ print $form->selectDate($search_datedelivery_end ? $search_datedelivery_end : -1, 'search_datedelivery_end', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('to'));
print ' ';
print ' | ';
}
@@ -713,14 +709,14 @@ if ($resql)
{
// Amount
print ''; - print ''; + print ''; print ' | '; } if (!empty($arrayfields['c.total_vat']['checked'])) { // Amount print ''; - print ''; + print ''; print ' | '; } if (!empty($arrayfields['c.total_ttc']['checked'])) diff --git a/htdocs/commande/orderstoinvoice.php b/htdocs/commande/orderstoinvoice.php index 7b8e31ce7a4..a4d4ed07dee 100644 --- a/htdocs/commande/orderstoinvoice.php +++ b/htdocs/commande/orderstoinvoice.php @@ -199,9 +199,9 @@ if (($action == 'create' || $action == 'add') && !$error) $sql .= ", targettype"; $sql .= ") VALUES ("; $sql .= $origin_id; - $sql .= ", '".$object->origin."'"; + $sql .= ", '".$db->escape($object->origin)."'"; $sql .= ", ".$id; - $sql .= ", '".$object->element."'"; + $sql .= ", '".$db->escape($object->element)."'"; $sql .= ")"; if ($db->query($sql)) diff --git a/htdocs/commande/stats/index.php b/htdocs/commande/stats/index.php index 0910e4ee7ad..346b5549bfd 100644 --- a/htdocs/commande/stats/index.php +++ b/htdocs/commande/stats/index.php @@ -94,11 +94,11 @@ dol_mkdir($dir); $stats = new CommandeStats($db, $socid, $mode, ($userid > 0 ? $userid : 0), ($typent_id > 0 ? $typent_id : 0), ($categ_id > 0 ? $categ_id : 0)); if ($mode == 'customer') { - if ($object_status != '' && $object_status >= -1) $stats->where .= ' AND c.fk_statut IN ('.$db->escape($object_status).')'; + if ($object_status != '' && $object_status >= -1) $stats->where .= ' AND c.fk_statut IN ('.$db->sanitize($db->escape($object_status)).')'; } if ($mode == 'supplier') { - if ($object_status != '' && $object_status >= 0) $stats->where .= ' AND c.fk_statut IN ('.$db->escape($object_status).')'; + if ($object_status != '' && $object_status >= 0) $stats->where .= ' AND c.fk_statut IN ('.$db->sanitize($db->escape($object_status)).')'; } diff --git a/htdocs/compta/accounting-files.php b/htdocs/compta/accounting-files.php index d73e7228b82..2a8a0358744 100644 --- a/htdocs/compta/accounting-files.php +++ b/htdocs/compta/accounting-files.php @@ -67,7 +67,7 @@ $hookmanager->initHooks(array('comptafileslist', 'globallist')); // Load variable for pagination $limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit; -$sortfield = GETPOST('sortfield', 'alpha'); +$sortfield = GETPOST('sortfield', 'aZ09comma'); $sortorder = GETPOST('sortorder', 'aZ09comma'); $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int'); if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1 diff --git a/htdocs/compta/bank/annuel.php b/htdocs/compta/bank/annuel.php index 72a7e33d3f2..cd82da0e1bd 100644 --- a/htdocs/compta/bank/annuel.php +++ b/htdocs/compta/bank/annuel.php @@ -91,7 +91,7 @@ $sql .= " WHERE b.fk_account = ba.rowid"; $sql .= " AND ba.entity IN (".getEntity('bank_account').")"; $sql .= " AND b.amount >= 0"; if (!empty($id)) - $sql .= " AND b.fk_account IN (".$db->escape($id).")"; + $sql .= " AND b.fk_account IN (".$db->sanitize($db->escape($id)).")"; $sql .= " GROUP BY dm"; $resql = $db->query($sql); @@ -117,7 +117,7 @@ $sql .= " WHERE b.fk_account = ba.rowid"; $sql .= " AND ba.entity IN (".getEntity('bank_account').")"; $sql .= " AND b.amount <= 0"; if (!empty($id)) - $sql .= " AND b.fk_account IN (".$db->escape($id).")"; + $sql .= " AND b.fk_account IN (".$db->sanitize($db->escape($id)).")"; $sql .= " GROUP BY dm"; $resql = $db->query($sql); @@ -240,7 +240,7 @@ $sql .= ", ".MAIN_DB_PREFIX."bank_account as ba"; $sql .= " WHERE b.fk_account = ba.rowid"; $sql .= " AND ba.entity IN (".getEntity('bank_account').")"; if (!empty($id)) - $sql .= " AND b.fk_account IN (".$db->escape($id).")"; + $sql .= " AND b.fk_account IN (".$db->sanitize($db->escape($id)).")"; $resql = $db->query($sql); if ($resql) diff --git a/htdocs/compta/bank/bankentries_list.php b/htdocs/compta/bank/bankentries_list.php index 1573a226521..950d0c7d3c6 100644 --- a/htdocs/compta/bank/bankentries_list.php +++ b/htdocs/compta/bank/bankentries_list.php @@ -811,19 +811,19 @@ if ($resql) $moreforfilter .= '|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ';
print ' ';
- print $langs->trans('From').' ';
- print $form->selectDate($search_datep_start ? $search_datep_start : -1, 'search_date_start', 0, 0, 1);
+ print $form->selectDate($search_datep_start ? $search_datep_start : -1, 'search_date_start', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From'));
print ' ';
print '';
- print $langs->trans('to').' ';
- print $form->selectDate($search_datep_end ? $search_datep_end : -1, 'search_date_end', 0, 0, 1);
+ print $form->selectDate($search_datep_end ? $search_datep_end : -1, 'search_date_end', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('to'));
print ' ';
print ' | ';
}
@@ -318,12 +318,10 @@ if ($result)
if ($arrayfields['datev']['checked']) {
print '';
print ' ';
- print $langs->trans('From').' ';
- print $form->selectDate($search_datev_start ? $search_datev_start : -1, 'search_date_value_start', 0, 0, 1);
+ print $form->selectDate($search_datev_start ? $search_datev_start : -1, 'search_date_value_start', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From'));
print ' ';
print '';
- print $langs->trans('to').' ';
- print $form->selectDate($search_datev_end ? $search_datev_end : -1, 'search_date_value_end', 0, 0, 1);
+ print $form->selectDate($search_datev_end ? $search_datev_end : -1, 'search_date_value_end', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('to'));
print ' ';
print ' | ';
}
@@ -331,7 +329,7 @@ if ($result)
// Payment type
if ($arrayfields['type']['checked']) {
print ''; - $form->select_types_paiements($typeid, 'typeid', '', 0, 1, 1, 16); + $form->select_types_paiements($typeid, 'typeid', '', 0, 1, 1, 16, 1, 'maxwidth100'); print ' | '; } @@ -345,14 +343,14 @@ if ($result) // Bank account if ($arrayfields['bank']['checked']) { print ''; - $form->select_comptes($search_bank_account, 'search_account', 0, '', 1); + $form->select_comptes($search_bank_account, 'search_account', 0, '', 1, '', 0, 'maxwidth100'); print ' | '; } // Bank entry if ($arrayfields['entry']['checked']) { - print ''; - print ''; + print ' | '; + print ''; print ' | '; } @@ -377,14 +375,14 @@ if ($result) // Debit if ($arrayfields['debit']['checked']) { print ''; - print ''; + print ''; print ' | '; } // Credit if ($arrayfields['credit']['checked']) { print ''; - print ''; + print ''; print ' | '; } @@ -469,7 +467,7 @@ if ($result) // Project if ($arrayfields['project']['checked']) { $proj->fetch($obj->fk_project); - print ''.$proj->getNomUrl(1).' | '; + print ''.$proj->getNomUrl(1).' | '; if (!$i) $totalarray['nbfield']++; } diff --git a/htdocs/compta/cashcontrol/cashcontrol_list.php b/htdocs/compta/cashcontrol/cashcontrol_list.php index ae2837a35cd..2adf3a01a83 100644 --- a/htdocs/compta/cashcontrol/cashcontrol_list.php +++ b/htdocs/compta/cashcontrol/cashcontrol_list.php @@ -63,7 +63,7 @@ $id = GETPOST('id', 'int'); // Load variable for pagination $limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit; -$sortfield = GETPOST('sortfield', 'alpha'); +$sortfield = GETPOST('sortfield', 'aZ09comma'); $sortorder = GETPOST('sortorder', 'aZ09comma'); $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int'); if (empty($page) || $page == -1 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha') || (empty($toselect) && $massaction === '0')) { $page = 0; } // If $page is not defined, or '' or -1 or if we click on clear filters or if we select empty mass action diff --git a/htdocs/compta/cashcontrol/report.php b/htdocs/compta/cashcontrol/report.php index f2d8e38fb15..02299788794 100644 --- a/htdocs/compta/cashcontrol/report.php +++ b/htdocs/compta/cashcontrol/report.php @@ -297,8 +297,8 @@ if ($resql) /* $sql = "UPDATE ".MAIN_DB_PREFIX."pos_cash_fence "; $sql .= "SET"; - $sql .= " cash='".$cash."'"; - $sql .= ", card='".$bank."'"; + $sql .= " cash='".$db->escape($cash)."'"; + $sql .= ", card='".$db->escape($bank)."'"; $sql .= " where rowid=".$id; $db->query($sql); */ diff --git a/htdocs/compta/clients.php b/htdocs/compta/clients.php index 5632e8ebc1a..1b4e86bbb4c 100644 --- a/htdocs/compta/clients.php +++ b/htdocs/compta/clients.php @@ -66,7 +66,7 @@ $thirdpartystatic = new Societe($db); if ($action == 'note') { - $sql = "UPDATE ".MAIN_DB_PREFIX."societe SET note='".$note."' WHERE rowid=".$socid; + $sql = "UPDATE ".MAIN_DB_PREFIX."societe SET note='".$db->escape($note)."' WHERE rowid=".$socid; $result = $db->query($sql); } diff --git a/htdocs/compta/deplacement/class/deplacementstats.class.php b/htdocs/compta/deplacement/class/deplacementstats.class.php index 6fdd54095a2..953ee78a3d6 100644 --- a/htdocs/compta/deplacement/class/deplacementstats.class.php +++ b/htdocs/compta/deplacement/class/deplacementstats.class.php @@ -122,7 +122,7 @@ class DeplacementStats extends Stats { $sql = "SELECT date_format(dated,'%m') as dm, sum(".$this->field.")"; $sql .= " FROM ".$this->from; - $sql .= " WHERE date_format(dated,'%Y') = '".$year."'"; + $sql .= " WHERE date_format(dated,'%Y') = '".$this->db->escape($year)."'"; $sql .= " AND ".$this->where; $sql .= " GROUP BY dm"; $sql .= $this->db->order('dm', 'DESC'); @@ -142,7 +142,7 @@ class DeplacementStats extends Stats { $sql = "SELECT date_format(dated,'%m') as dm, avg(".$this->field.")"; $sql .= " FROM ".$this->from; - $sql .= " WHERE date_format(dated,'%Y') = '".$year."'"; + $sql .= " WHERE date_format(dated,'%Y') = '".$this->db->escape($year)."'"; $sql .= " AND ".$this->where; $sql .= " GROUP BY dm"; $sql .= $this->db->order('dm', 'DESC'); diff --git a/htdocs/compta/deplacement/document.php b/htdocs/compta/deplacement/document.php index 98354e328f0..47b1709ff60 100644 --- a/htdocs/compta/deplacement/document.php +++ b/htdocs/compta/deplacement/document.php @@ -49,7 +49,7 @@ $result = restrictedArea($user, 'deplacement', $id, ''); // Get parameters $limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit; -$sortfield = GETPOST('sortfield', 'alpha'); +$sortfield = GETPOST('sortfield', 'aZ09comma'); $sortorder = GETPOST('sortorder', 'aZ09comma'); $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int'); if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1 diff --git a/htdocs/compta/facture/card.php b/htdocs/compta/facture/card.php index b19ee852db6..87a3a3c8be2 100644 --- a/htdocs/compta/facture/card.php +++ b/htdocs/compta/facture/card.php @@ -1664,7 +1664,7 @@ if (empty($reshook)) $originidforcontact=$srcobject->origin_id; } $sqlcontact = "SELECT code, fk_socpeople FROM ".MAIN_DB_PREFIX."element_contact as ec, ".MAIN_DB_PREFIX."c_type_contact as ctc"; - $sqlcontact.= " WHERE element_id = ".$originidforcontact." AND ec.fk_c_type_contact = ctc.rowid AND ctc.element = '".$originforcontact."'"; + $sqlcontact.= " WHERE element_id = ".$originidforcontact." AND ec.fk_c_type_contact = ctc.rowid AND ctc.element = '".$db->escape($originforcontact)."'"; $resqlcontact = $db->query($sqlcontact); if ($resqlcontact) diff --git a/htdocs/compta/facture/class/api_invoices.class.php b/htdocs/compta/facture/class/api_invoices.class.php index 1828493d89f..cc1b7fe57ed 100644 --- a/htdocs/compta/facture/class/api_invoices.class.php +++ b/htdocs/compta/facture/class/api_invoices.class.php @@ -207,7 +207,7 @@ class Invoices extends DolibarrApi $sql .= " AND (".preg_replace_callback('/'.$regexstring.'/', 'DolibarrApi::_forge_criteria_callback', $sqlfilters).")"; } - $sql .= $db->order($sortfield, $sortorder); + $sql .= $this->db->order($sortfield, $sortorder); if ($limit) { if ($page < 0) @@ -216,19 +216,19 @@ class Invoices extends DolibarrApi } $offset = $limit * $page; - $sql .= $db->plimit($limit + 1, $offset); + $sql .= $this->db->plimit($limit + 1, $offset); } - $result = $db->query($sql); + $result = $this->db->query($sql); if ($result) { $i = 0; - $num = $db->num_rows($result); + $num = $this->db->num_rows($result); $min = min($num, ($limit <= 0 ? $num : $limit)); while ($i < $min) { - $obj = $db->fetch_object($result); - $invoice_static = new Facture($db); + $obj = $this->db->fetch_object($result); + $invoice_static = new Facture($this->db); if ($invoice_static->fetch($obj->rowid)) { // Get payment details @@ -245,7 +245,7 @@ class Invoices extends DolibarrApi $i++; } } else { - throw new RestException(503, 'Error when retrieve invoice list : '.$db->lasterror()); + throw new RestException(503, 'Error when retrieve invoice list : '.$this->db->lasterror()); } if (!count($obj_ret)) { throw new RestException(404, 'No invoice found'); diff --git a/htdocs/compta/facture/class/facture-rec.class.php b/htdocs/compta/facture/class/facture-rec.class.php index c5e93bc41ad..67dd4e304ea 100644 --- a/htdocs/compta/facture/class/facture-rec.class.php +++ b/htdocs/compta/facture/class/facture-rec.class.php @@ -277,8 +277,8 @@ class FactureRec extends CommonInvoice $sql .= ", ".(!empty($this->note_public) ? ("'".$this->db->escape($this->note_public)."'") : "NULL"); $sql .= ", ".(!empty($this->modelpdf) ? ("'".$this->db->escape($this->modelpdf)."'") : "NULL"); $sql .= ", '".$this->db->escape($user->id)."'"; - $sql .= ", ".(!empty($facsrc->fk_project) ? "'".$facsrc->fk_project."'" : "null"); - $sql .= ", ".(!empty($facsrc->fk_account) ? "'".$facsrc->fk_account."'" : "null"); + $sql .= ", ".(!empty($facsrc->fk_project) ? "'".$this->db->escape($facsrc->fk_project)."'" : "null"); + $sql .= ", ".(!empty($facsrc->fk_account) ? "'".$this->db->escape($facsrc->fk_account)."'" : "null"); $sql .= ", ".($facsrc->cond_reglement_id > 0 ? $this->db->escape($facsrc->cond_reglement_id) : "null"); $sql .= ", ".($facsrc->mode_reglement_id > 0 ? $this->db->escape($facsrc->mode_reglement_id) : "null"); $sql .= ", ".$this->usenewprice; @@ -921,7 +921,7 @@ class FactureRec extends CommonInvoice $sql .= ", fk_unit"; $sql .= ', fk_multicurrency, multicurrency_code, multicurrency_subprice, multicurrency_total_ht, multicurrency_total_tva, multicurrency_total_ttc'; $sql .= ") VALUES ("; - $sql .= "'".$facid."'"; + $sql .= " ".((int) $facid); $sql .= ", ".(!empty($label) ? "'".$this->db->escape($label)."'" : "null"); $sql .= ", '".$this->db->escape($desc)."'"; $sql .= ", ".price2num($pu_ht); @@ -932,7 +932,7 @@ class FactureRec extends CommonInvoice $sql .= ", '".$this->db->escape($localtaxes_type[0])."'"; $sql .= ", ".price2num($txlocaltax2); $sql .= ", '".$this->db->escape($localtaxes_type[2])."'"; - $sql .= ", ".(!empty($fk_product) ? "'".$fk_product."'" : "null"); + $sql .= ", ".(!empty($fk_product) ? "'".$this->db->escape($fk_product)."'" : "null"); $sql .= ", ".$product_type; $sql .= ", ".price2num($remise_percent); $sql .= ", ".price2num($pu_ht); @@ -1083,7 +1083,7 @@ class FactureRec extends CommonInvoice } $sql = "UPDATE ".MAIN_DB_PREFIX."facturedet_rec SET "; - $sql .= "fk_facture = '".$facid."'"; + $sql .= "fk_facture = ".((int) $facid); $sql .= ", label=".(!empty($label) ? "'".$this->db->escape($label)."'" : "null"); $sql .= ", description='".$this->db->escape($desc)."'"; $sql .= ", price=".price2num($pu_ht); @@ -1094,7 +1094,7 @@ class FactureRec extends CommonInvoice $sql .= ", localtax1_type='".$this->db->escape($localtaxes_type[0])."'"; $sql .= ", localtax2_tx=".$txlocaltax2; $sql .= ", localtax2_type='".$this->db->escape($localtaxes_type[2])."'"; - $sql .= ", fk_product=".(!empty($fk_product) ? "'".$fk_product."'" : "null"); + $sql .= ", fk_product=".(!empty($fk_product) ? "'".$this->db->escape($fk_product)."'" : "null"); $sql .= ", product_type=".$product_type; $sql .= ", remise_percent='".price2num($remise_percent)."'"; $sql .= ", subprice='".price2num($pu_ht)."'"; @@ -1194,13 +1194,13 @@ class FactureRec extends CommonInvoice $sql = 'SELECT rowid FROM '.MAIN_DB_PREFIX.'facture_rec'; $sql .= ' WHERE frequency > 0'; // A recurring invoice is an invoice with a frequency - $sql .= " AND (date_when IS NULL OR date_when <= '".$db->idate($today)."')"; + $sql .= " AND (date_when IS NULL OR date_when <= '".$this->db->idate($today)."')"; $sql .= ' AND (nb_gen_done < nb_gen_max OR nb_gen_max = 0)'; $sql .= ' AND suspended = 0'; $sql .= ' AND entity = '.$conf->entity; // MUST STAY = $conf->entity here if ($restrictioninvoiceid > 0) $sql .= ' AND rowid = '.$restrictioninvoiceid; - $sql .= $db->order('entity', 'ASC'); + $sql .= $this->db->order('entity', 'ASC'); //print $sql;exit; $parameters = array( 'restrictioninvoiceid' => $restrictioninvoiceid, @@ -1208,11 +1208,11 @@ class FactureRec extends CommonInvoice ); $reshook = $hookmanager->executeHooks('beforeCreationOfRecurringInvoices', $parameters, $sql); // note that $sql might be modified by hooks - $resql = $db->query($sql); + $resql = $this->db->query($sql); if ($resql) { $i = 0; - $num = $db->num_rows($resql); + $num = $this->db->num_rows($resql); if ($num) $this->output .= $langs->trans("FoundXQualifiedRecurringInvoiceTemplate", $num)."\n"; @@ -1222,14 +1222,14 @@ class FactureRec extends CommonInvoice while ($i < $num) // Loop on each template invoice. If $num = 0, test is false at first pass. { - $line = $db->fetch_object($resql); + $line = $this->db->fetch_object($resql); - $db->begin(); + $this->db->begin(); $invoiceidgenerated = 0; $facture = null; - $facturerec = new FactureRec($db); + $facturerec = new FactureRec($this->db); $facturerec->fetch($line->rowid); if ($facturerec->id > 0) @@ -1239,7 +1239,7 @@ class FactureRec extends CommonInvoice dol_syslog("createRecurringInvoices Process invoice template id=".$facturerec->id.", ref=".$facturerec->ref.", entity=".$facturerec->entity); - $facture = new Facture($db); + $facture = new Facture($this->db); $facture->fac_rec = $facturerec->id; // We will create $facture from this recurring invoice $facture->fk_fac_rec_source = $facturerec->id; // We will create $facture from this recurring invoice @@ -1286,12 +1286,12 @@ class FactureRec extends CommonInvoice if (!$error && $invoiceidgenerated >= 0) { - $db->commit("createRecurringInvoices Process invoice template id=".$facturerec->id.", ref=".$facturerec->ref); + $this->db->commit("createRecurringInvoices Process invoice template id=".$facturerec->id.", ref=".$facturerec->ref); dol_syslog("createRecurringInvoices Process invoice template ".$facturerec->ref." is finished with a success generation"); $nb_create++; $this->output .= $langs->trans("InvoiceGeneratedFromTemplate", $facture->ref, $facturerec->ref)."\n"; } else { - $db->rollback("createRecurringInvoices Process invoice template id=".$facturerec->id.", ref=".$facturerec->ref); + $this->db->rollback("createRecurringInvoices Process invoice template id=".$facturerec->id.", ref=".$facturerec->ref); } $parameters = array( @@ -1308,7 +1308,7 @@ class FactureRec extends CommonInvoice } $conf->entity = $saventity; // Restore entity context - } else dol_print_error($db); + } else dol_print_error($this->db); $this->output = trim($this->output); diff --git a/htdocs/compta/facture/class/facture.class.php b/htdocs/compta/facture/class/facture.class.php index be0888e4c79..4110e5ad26d 100644 --- a/htdocs/compta/facture/class/facture.class.php +++ b/htdocs/compta/facture/class/facture.class.php @@ -612,7 +612,7 @@ class Facture extends CommonInvoice $sql .= ", ".setEntity($this); $sql .= ", ".($this->ref_ext ? "'".$this->db->escape($this->ref_ext)."'" : "null"); $sql .= ", '".$this->db->escape($this->type)."'"; - $sql .= ", '".$socid."'"; + $sql .= ", ".((int) $socid); $sql .= ", '".$this->db->idate($now)."'"; $sql .= ", ".($this->remise_absolue > 0 ? $this->remise_absolue : 'NULL'); $sql .= ", ".($this->remise_percent > 0 ? $this->remise_percent : 'NULL'); @@ -627,7 +627,7 @@ class Facture extends CommonInvoice $sql .= ", ".($this->pos_source != '' ? "'".$this->db->escape($this->pos_source)."'" : "null"); $sql .= ", ".($this->fk_fac_rec_source ? "'".$this->db->escape($this->fk_fac_rec_source)."'" : "null"); $sql .= ", ".($this->fk_facture_source ? "'".$this->db->escape($this->fk_facture_source)."'" : "null"); - $sql .= ", ".($user->id > 0 ? "'".$user->id."'" : "null"); + $sql .= ", ".($user->id > 0 ? (int) $user->id : "null"); $sql .= ", ".($this->fk_project ? $this->fk_project : "null"); $sql .= ", ".$this->cond_reglement_id; $sql .= ", ".$this->mode_reglement_id; @@ -715,7 +715,7 @@ class Facture extends CommonInvoice } $sqlcontact = "SELECT ctc.code, ctc.source, ec.fk_socpeople FROM ".MAIN_DB_PREFIX."element_contact as ec, ".MAIN_DB_PREFIX."c_type_contact as ctc"; - $sqlcontact .= " WHERE element_id = ".$originidforcontact." AND ec.fk_c_type_contact = ctc.rowid AND ctc.element = '".$originforcontact."'"; + $sqlcontact .= " WHERE element_id = ".$originidforcontact." AND ec.fk_c_type_contact = ctc.rowid AND ctc.element = '".$this->db->escape($originforcontact)."'"; $resqlcontact = $this->db->query($sqlcontact); if ($resqlcontact) diff --git a/htdocs/compta/facture/list.php b/htdocs/compta/facture/list.php index 9594acd8a56..4a856539196 100644 --- a/htdocs/compta/facture/list.php +++ b/htdocs/compta/facture/list.php @@ -478,15 +478,15 @@ if ($filtre) } if ($search_ref) $sql .= natural_search('f.ref', $search_ref); if ($search_refcustomer) $sql .= natural_search('f.ref_client', $search_refcustomer); -if ($search_type != '' && $search_type != '-1') $sql .= " AND f.type IN (".$db->escape($search_type).")"; +if ($search_type != '' && $search_type != '-1') $sql .= " AND f.type IN (".$db->sanitize($db->escape($search_type)).")"; if ($search_project_ref) $sql .= natural_search('p.ref', $search_project_ref); if ($search_project) $sql .= natural_search('p.title', $search_project); if ($search_societe) $sql .= natural_search('s.nom', $search_societe); if ($search_town) $sql .= natural_search('s.town', $search_town); if ($search_zip) $sql .= natural_search("s.zip", $search_zip); if ($search_state) $sql .= natural_search("state.nom", $search_state); -if ($search_country) $sql .= " AND s.fk_pays IN (".$db->escape($search_country).')'; -if ($search_type_thirdparty) $sql .= " AND s.fk_typent IN (".$db->escape($search_type_thirdparty).')'; +if ($search_country) $sql .= " AND s.fk_pays IN (".$db->sanitize($db->escape($search_country)).')'; +if ($search_type_thirdparty) $sql .= " AND s.fk_typent IN (".$db->sanitize($db->escape($search_type_thirdparty)).')'; if ($search_company) $sql .= natural_search('s.nom', $search_company); if ($search_montant_ht != '') $sql .= natural_search('f.total', $search_montant_ht, 1); if ($search_montant_vat != '') $sql .= natural_search('f.tva', $search_montant_vat, 1); @@ -510,7 +510,7 @@ if ($search_status != '-1' && $search_status != '') if ($search_status == '2') $sql .= " AND f.fk_statut = 2"; // payed Not that some corrupted data may contains f.fk_statut = 1 AND f.paye = 1 (it means payed too but should not happend. If yes, reopen and reclassify billed) if ($search_status == '3') $sql .= " AND f.fk_statut = 3"; // abandonned } else { - $sql .= " AND f.fk_statut IN (".$db->escape($search_status).")"; // When search_status is '1,2' for example + $sql .= " AND f.fk_statut IN (".$db->sanitize($db->escape($search_status)).")"; // When search_status is '1,2' for example } } @@ -807,12 +807,10 @@ if ($resql) { print '';
print ' ';
- print $langs->trans('From').' ';
- print $form->selectDate($search_date_start ? $search_date_start : -1, 'search_date_start', 0, 0, 1);
+ print $form->selectDate($search_date_start ? $search_date_start : -1, 'search_date_start', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From'));
print ' ';
print '';
- print $langs->trans('to').' ';
- print $form->selectDate($search_date_end ? $search_date_end : -1, 'search_date_end', 0, 0, 1);
+ print $form->selectDate($search_date_end ? $search_date_end : -1, 'search_date_end', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('to'));
print ' ';
print ' | ';
}
@@ -821,12 +819,10 @@ if ($resql)
{
print '';
print ' ';
- print $langs->trans('From').' ';
- print $form->selectDate($search_date_valid_start ? $search_date_valid_start : -1, 'search_date_valid_start', 0, 0, 1);
+ print $form->selectDate($search_date_valid_start ? $search_date_valid_start : -1, 'search_date_valid_start', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From'));
print ' ';
print '';
- print $langs->trans('to').' ';
- print $form->selectDate($search_date_valid_end ? $search_date_valid_end : -1, 'search_date_valid_end', 0, 0, 1);
+ print $form->selectDate($search_date_valid_end ? $search_date_valid_end : -1, 'search_date_valid_end', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('to'));
print ' ';
print ' | ';
}
diff --git a/htdocs/compta/facture/stats/index.php b/htdocs/compta/facture/stats/index.php
index 82ba8a33467..81466651856 100644
--- a/htdocs/compta/facture/stats/index.php
+++ b/htdocs/compta/facture/stats/index.php
@@ -94,7 +94,7 @@ dol_mkdir($dir);
$stats = new FactureStats($db, $socid, $mode, ($userid > 0 ? $userid : 0), ($typent_id > 0 ? $typent_id : 0), ($categ_id > 0 ? $categ_id : 0));
if ($mode == 'customer')
{
- if ($object_status != '' && $object_status >= 0) $stats->where .= ' AND f.fk_statut IN ('.$db->escape($object_status).')';
+ if ($object_status != '' && $object_status >= 0) $stats->where .= ' AND f.fk_statut IN ('.$db->sanitize($db->escape($object_status)).')';
if (is_array($custcats) && !empty($custcats)) {
$stats->from .= ' LEFT JOIN '.MAIN_DB_PREFIX.'categorie_societe as cat ON (f.fk_soc = cat.fk_soc)';
$stats->where .= ' AND cat.fk_categorie IN ('.implode(',', $custcats).')';
@@ -102,7 +102,7 @@ if ($mode == 'customer')
}
if ($mode == 'supplier')
{
- if ($object_status != '' && $object_status >= 0) $stats->where .= ' AND f.fk_statut IN ('.$db->escape($object_status).')';
+ if ($object_status != '' && $object_status >= 0) $stats->where .= ' AND f.fk_statut IN ('.$db->sanitize($db->escape($object_status)).')';
}
// Build graphic number of object
diff --git a/htdocs/compta/index.php b/htdocs/compta/index.php
index 6adff20725c..8c144f6bd71 100644
--- a/htdocs/compta/index.php
+++ b/htdocs/compta/index.php
@@ -60,7 +60,7 @@ if ($user->socid > 0)
$socid = $user->socid;
}
-$max = 3;
+$max = $conf->global->MAIN_SIZE_SHORTLIST_LIMIT;
// Initialize technical object to manage hooks. Note that conf->hooks_modules contains array
$hookmanager->initHooks(array('invoiceindex'));
@@ -370,6 +370,7 @@ if (!empty($conf->facture->enabled) && $user->rights->facture->lire)
{
$num = $db->num_rows($resql);
$i = 0;
+ $othernb = 0;
print '||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| '; + print ''.$langs->trans("More").'... ('.$othernb.')'; + print ' | '; + print "|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| '; + print ''.$langs->trans("More").'... ('.$othernb.')'; + print ' | '; + print "|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| '; + print ''.$langs->trans("More").'... ('.$othernb.')'; + print ' | '; + print "|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| '.$langs->trans("None").' | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| '; + print ''.$langs->trans("More").'... ('.$othernb.')'; + print ' | '; + print "|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| '.$langs->trans("Total").' | '; print ''.price($tot_ttc).' | '; print ''; @@ -740,6 +809,7 @@ if (!empty($conf->facture->enabled) && !empty($conf->commande->enabled) && $user if ($num) { $i = 0; + $othernb = 0; print ' | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| '; + print ''.$langs->trans("More").'... ('.$othernb.')'; + print ' | '; + print "|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| '.$langs->trans("Total").' ('.$langs->trans("RemainderToBill").': '.price($tot_tobill).') | '; if (!empty($conf->global->MAIN_SHOW_HT_ON_SUMMARY)) print ''.price($tot_ht).' | '; print ''.price($tot_ttc).' | '; @@ -861,6 +947,7 @@ if (!empty($conf->facture->enabled) && $user->rights->facture->lire) { $num = $db->num_rows($resql); $i = 0; + $othernb = 0; print '|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| '.price($obj->total_ht).' | '; print ''.price($obj->total_ttc).' | '; print ''.price($obj->am).' | '; - print ''.$facstatic->LibStatut($obj->paye, $obj->fk_statut, 3, $obj->am).' | '; + print ''.$facstatic->LibStatut($obj->paye, $obj->fk_statut, 3, $obj->am, $obj->type).' | '; print ''; $total_ttc += $obj->total_ttc; @@ -944,6 +1039,14 @@ if (!empty($conf->facture->enabled) && $user->rights->facture->lire) $i++; } + if ($othernb) { + print '|||||||||||||||||||||||||||
| '; + print ''.$langs->trans("More").'... ('.$othernb.')'; + print ' | '; + print "|||||||||||||||||||||||||||||||
| '.$langs->trans("Total").' ('.$langs->trans("RemainderToTake").': '.price($total_ttc - $totalam).') | '; print ''; if (!empty($conf->global->MAIN_SHOW_HT_ON_SUMMARY)) print ' | '.price($total).' | '; @@ -970,7 +1073,7 @@ if ((!empty($conf->fournisseur->enabled) && empty($conf->global->MAIN_USE_NEW_SU { $facstatic = new FactureFournisseur($db); - $sql = "SELECT ff.rowid, ff.ref, ff.fk_statut, ff.libelle as label, ff.total_ht, ff.total_tva, ff.total_ttc, ff.paye"; + $sql = "SELECT ff.rowid, ff.ref, ff.fk_statut, ff.type, ff.libelle as label, ff.total_ht, ff.total_tva, ff.total_ttc, ff.paye"; $sql .= ", ff.date_lim_reglement"; $sql .= ", s.nom as name"; $sql .= ", s.rowid as socid, s.email"; @@ -991,7 +1094,7 @@ if ((!empty($conf->fournisseur->enabled) && empty($conf->global->MAIN_USE_NEW_SU $reshook = $hookmanager->executeHooks('printFieldListWhereSupplierUnpaid', $parameters); $sql .= $hookmanager->resPrint; - $sql .= " GROUP BY ff.rowid, ff.ref, ff.fk_statut, ff.libelle, ff.total_ht, ff.tva, ff.total_tva, ff.total_ttc, ff.paye, ff.date_lim_reglement,"; + $sql .= " GROUP BY ff.rowid, ff.ref, ff.fk_statut, ff.type, ff.libelle, ff.total_ht, ff.tva, ff.total_tva, ff.total_ttc, ff.paye, ff.date_lim_reglement,"; $sql .= " s.nom, s.rowid, s.email, s.code_client, s.code_fournisseur, s.code_compta, s.code_compta_fournisseur"; $sql .= " ORDER BY ff.date_lim_reglement ASC"; @@ -999,6 +1102,7 @@ if ((!empty($conf->fournisseur->enabled) && empty($conf->global->MAIN_USE_NEW_SU if ($resql) { $num = $db->num_rows($resql); + $othernb = 0; print '|||||||||||||||||||||||||||||
| '.price($obj->total_ht).' | '; print ''.price($obj->total_ttc).' | '; print ''.price($obj->am).' | '; - print ''.$facstatic->LibStatut($obj->paye, $obj->fk_statut, 3).' | '; + print ''.$facstatic->LibStatut($obj->paye, $obj->fk_statut, 3, $obj->am, $obj->type).' | '; print ''; $total += $obj->total_ht; $total_ttc += $obj->total_ttc; @@ -1060,6 +1173,14 @@ if ((!empty($conf->fournisseur->enabled) && empty($conf->global->MAIN_USE_NEW_SU $i++; } + if ($othernb) { + print '||
| '; + print ''.$langs->trans("More").'... ('.$othernb.')'; + print ' | '; + print "||||||
| '.$langs->trans("Total").' ('.$langs->trans("RemainderToPay").': '.price($total_ttc - $totalam).') | '; print ''; if (!empty($conf->global->MAIN_SHOW_HT_ON_SUMMARY)) print ' | '.price($total).' | '; diff --git a/htdocs/compta/journal/purchasesjournal.php b/htdocs/compta/journal/purchasesjournal.php index 78ef32072d6..d754760dd57 100644 --- a/htdocs/compta/journal/purchasesjournal.php +++ b/htdocs/compta/journal/purchasesjournal.php @@ -106,7 +106,7 @@ $sql .= " s.rowid as socid, s.nom as name, s.code_compta_fournisseur,"; $sql .= " p.rowid as pid, p.ref as ref, p.accountancy_code_buy,"; $sql .= " ct.accountancy_code_buy as account_tva, ct.recuperableonly"; $sql .= " FROM ".MAIN_DB_PREFIX."facture_fourn_det as fd"; -$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_tva as ct ON fd.tva_tx = ct.taux AND fd.info_bits = ct.recuperableonly AND ct.fk_pays = '".$idpays."'"; +$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_tva as ct ON fd.tva_tx = ct.taux AND fd.info_bits = ct.recuperableonly AND ct.fk_pays = ".((int) $idpays); $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product as p ON p.rowid = fd.fk_product"; $sql .= " JOIN ".MAIN_DB_PREFIX."facture_fourn as f ON f.rowid = fd.fk_facture_fourn"; $sql .= " JOIN ".MAIN_DB_PREFIX."societe as s ON s.rowid = f.fk_soc"; diff --git a/htdocs/compta/journal/sellsjournal.php b/htdocs/compta/journal/sellsjournal.php index bd44f6c47cc..62e8c77a133 100644 --- a/htdocs/compta/journal/sellsjournal.php +++ b/htdocs/compta/journal/sellsjournal.php @@ -109,7 +109,7 @@ $sql .= " FROM ".MAIN_DB_PREFIX."facturedet as fd"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product as p ON p.rowid = fd.fk_product"; $sql .= " JOIN ".MAIN_DB_PREFIX."facture as f ON f.rowid = fd.fk_facture"; $sql .= " JOIN ".MAIN_DB_PREFIX."societe as s ON s.rowid = f.fk_soc"; -$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_tva ct ON fd.tva_tx = ct.taux AND fd.info_bits = ct.recuperableonly AND ct.fk_pays = '".$idpays."'"; +$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_tva ct ON fd.tva_tx = ct.taux AND fd.info_bits = ct.recuperableonly AND ct.fk_pays = ".((int) $idpays); $sql .= " WHERE f.entity IN (".getEntity('invoice').")"; $sql .= " AND f.fk_statut > 0"; if (!empty($conf->global->FACTURE_DEPOSITS_ARE_JUST_PAYMENTS)) { diff --git a/htdocs/compta/paiement.php b/htdocs/compta/paiement.php index 2dea1b245f4..9d86cff65dd 100644 --- a/htdocs/compta/paiement.php +++ b/htdocs/compta/paiement.php @@ -47,7 +47,7 @@ $accountid = GETPOST('accountid', 'int'); $paymentnum = GETPOST('num_paiement', 'alpha'); $socid = GETPOST('socid', 'int'); -$sortfield = GETPOST('sortfield', 'alpha'); +$sortfield = GETPOST('sortfield', 'aZ09comma'); $sortorder = GETPOST('sortorder', 'alpha'); $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int'); diff --git a/htdocs/compta/paiement/cheque/card.php b/htdocs/compta/paiement/cheque/card.php index 1691fe3ecfc..2f9182f1693 100644 --- a/htdocs/compta/paiement/cheque/card.php +++ b/htdocs/compta/paiement/cheque/card.php @@ -46,7 +46,7 @@ $fieldname = (!empty($ref) ? 'ref' : 'rowid'); if ($user->socid) $socid = $user->socid; $result = restrictedArea($user, 'cheque', $id, 'bordereau_cheque', '', 'fk_user_author', $fieldname); -$sortfield = GETPOST('sortfield', 'alpha'); +$sortfield = GETPOST('sortfield', 'aZ09comma'); $sortorder = GETPOST('sortorder', 'aZ09comma'); $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int'); if (!$sortorder) $sortorder = "ASC"; @@ -57,7 +57,7 @@ $offset = $limit * $page; $dir = $conf->bank->dir_output.'/checkdeposits/'; $filterdate = dol_mktime(0, 0, 0, GETPOST('fdmonth'), GETPOST('fdday'), GETPOST('fdyear')); -$filteraccountid = GETPOST('accountid'); +$filteraccountid = GETPOST('accountid', 'int'); $object = new RemiseCheque($db); @@ -152,10 +152,10 @@ if ($action == 'create' && $_POST["accountid"] > 0 && $user->rights->banque->che } } -if ($action == 'remove' && $id > 0 && $_GET["lineid"] > 0 && $user->rights->banque->cheque) +if ($action == 'remove' && $id > 0 && GETPOST("lineid", 'int') > 0 && $user->rights->banque->cheque) { $object->id = $id; - $result = $object->removeCheck($_GET["lineid"]); + $result = $object->removeCheck(GETPOST("lineid", "int")); if ($result === 0) { header("Location: ".$_SERVER["PHP_SELF"]."?id=".$object->id); @@ -206,7 +206,7 @@ if ($action == 'confirm_valide' && $confirm == 'yes' && $user->rights->banque->c if ($action == 'confirm_reject_check' && $confirm == 'yes' && $user->rights->banque->cheque) { $reject_date = dol_mktime(0, 0, 0, GETPOST('rejectdate_month'), GETPOST('rejectdate_day'), GETPOST('rejectdate_year')); - $rejected_check = GETPOST('bankid'); + $rejected_check = GETPOST('bankid', 'int'); $object->fetch($id); $paiement_id = $object->rejectCheck($rejected_check, $reject_date); @@ -394,7 +394,7 @@ if ($action == 'new') $sql .= " AND b.fk_bordereau = 0"; $sql .= " AND b.amount > 0"; if ($filterdate) $sql .= " AND b.dateo = '".$db->idate($filterdate)."'"; - if ($filteraccountid > 0) $sql .= " AND ba.rowid= '".$filteraccountid."'"; + if ($filteraccountid > 0) $sql .= " AND ba.rowid = ".((int) $filteraccountid); $sql .= $db->order("b.dateo,b.rowid", "ASC"); $resql = $db->query($sql); diff --git a/htdocs/compta/paiement/cheque/class/remisecheque.class.php b/htdocs/compta/paiement/cheque/class/remisecheque.class.php index 48c58dc7219..00815c90f7d 100644 --- a/htdocs/compta/paiement/cheque/class/remisecheque.class.php +++ b/htdocs/compta/paiement/cheque/class/remisecheque.class.php @@ -211,7 +211,7 @@ class RemiseCheque extends CommonObject $sql .= " WHERE b.fk_type = 'CHQ'"; $sql .= " AND b.amount > 0"; $sql .= " AND b.fk_bordereau = 0"; - $sql .= " AND b.fk_account='".$account_id."'"; + $sql .= " AND b.fk_account = ".((int) $account_id); if ($limit) $sql .= $this->db->plimit($limit); dol_syslog("RemiseCheque::Create", LOG_DEBUG); @@ -358,7 +358,7 @@ class RemiseCheque extends CommonObject if ($this->errno == 0 && $numref) { $sql = "UPDATE ".MAIN_DB_PREFIX."bordereau_cheque"; - $sql .= " SET statut = 1, ref = '".$numref."'"; + $sql .= " SET statut = 1, ref = '".$this->db->escape($numref)."'"; $sql .= " WHERE rowid = ".$this->id; $sql .= " AND entity = ".$conf->entity; $sql .= " AND statut = 0"; @@ -662,6 +662,7 @@ class RemiseCheque extends CommonObject global $conf; $this->errno = 0; + $this->db->begin(); $total = 0; $nb = 0; @@ -681,8 +682,8 @@ class RemiseCheque extends CommonObject $this->db->free($resql); $sql = "UPDATE ".MAIN_DB_PREFIX."bordereau_cheque"; - $sql .= " SET amount = '".price2num($total)."'"; - $sql .= ", nbcheque = ".$nb; + $sql .= " SET amount = ".price2num($total); + $sql .= ", nbcheque = ".((int) $nb); $sql .= " WHERE rowid = ".$this->id; $sql .= " AND entity = ".$conf->entity; @@ -722,8 +723,8 @@ class RemiseCheque extends CommonObject { $sql = "UPDATE ".MAIN_DB_PREFIX."bank"; $sql .= " SET fk_bordereau = 0"; - $sql .= " WHERE rowid = '".$account_id."'"; - $sql .= " AND fk_bordereau = ".$this->id; + $sql .= " WHERE rowid = ".((int) $account_id); + $sql .= " AND fk_bordereau = ".((int) $this->id); $resql = $this->db->query($sql); if ($resql) @@ -774,18 +775,18 @@ class RemiseCheque extends CommonObject $sql .= ' FROM '.MAIN_DB_PREFIX.'paiement_facture as pf'; $sql .= ' WHERE pf.fk_paiement = '.$payment->id; - $resql = $db->query($sql); + $resql = $this->db->query($sql); if ($resql) { - $rejectedPayment = new Paiement($db); + $rejectedPayment = new Paiement($this->db); $rejectedPayment->amounts = array(); $rejectedPayment->datepaye = $rejection_date; $rejectedPayment->paiementid = dol_getIdFromCode($this->db, 'CHQ', 'c_paiement', 'code', 'id', 1); $rejectedPayment->num_payment = $payment->num_payment; - while ($obj = $db->fetch_object($resql)) + while ($obj = $this->db->fetch_object($resql)) { - $invoice = new Facture($db); + $invoice = new Facture($this->db); $invoice->fetch($obj->fk_facture); $invoice->set_unpaid($user); diff --git a/htdocs/compta/paiement/class/paiement.class.php b/htdocs/compta/paiement/class/paiement.class.php index f2dc613175f..5cb16bdcbe3 100644 --- a/htdocs/compta/paiement/class/paiement.class.php +++ b/htdocs/compta/paiement/class/paiement.class.php @@ -800,7 +800,7 @@ class Paiement extends CommonObject $sql = "UPDATE ".MAIN_DB_PREFIX.'bank'; $sql .= " SET dateo = '".$this->db->idate($date)."', datev = '".$this->db->idate($date)."'"; - $sql .= " WHERE rowid IN (SELECT fk_bank FROM ".MAIN_DB_PREFIX."bank_url WHERE type = '".$type."' AND url_id = ".$this->id.")"; + $sql .= " WHERE rowid IN (SELECT fk_bank FROM ".MAIN_DB_PREFIX."bank_url WHERE type = '".$this->db->escape($type)."' AND url_id = ".$this->id.")"; $sql .= " AND rappro = 0"; $result = $this->db->query($sql); diff --git a/htdocs/compta/paiement/tovalidate.php b/htdocs/compta/paiement/tovalidate.php index df0b92b5f44..00e9a0c4074 100644 --- a/htdocs/compta/paiement/tovalidate.php +++ b/htdocs/compta/paiement/tovalidate.php @@ -40,7 +40,7 @@ if ($user->socid > 0) $limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit; -$sortfield = GETPOST('sortfield', 'alpha'); +$sortfield = GETPOST('sortfield', 'aZ09comma'); $sortorder = GETPOST('sortorder', 'aZ09comma'); $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int'); if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1 diff --git a/htdocs/compta/prelevement/bons.php b/htdocs/compta/prelevement/bons.php index cb702174434..69d6412b235 100644 --- a/htdocs/compta/prelevement/bons.php +++ b/htdocs/compta/prelevement/bons.php @@ -41,7 +41,7 @@ $result = restrictedArea($user, 'prelevement', '', '', 'bons'); $type = GETPOST('type', 'aZ09'); $limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit; -$sortfield = GETPOST('sortfield', 'alpha'); +$sortfield = GETPOST('sortfield', 'aZ09comma'); $sortorder = GETPOST('sortorder', 'aZ09comma'); $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int'); if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1 diff --git a/htdocs/compta/prelevement/card.php b/htdocs/compta/prelevement/card.php index a70a464b428..1370155cb1d 100644 --- a/htdocs/compta/prelevement/card.php +++ b/htdocs/compta/prelevement/card.php @@ -45,7 +45,7 @@ $type = GETPOST('type', 'aZ09'); // Load variable for pagination $limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit; -$sortfield = GETPOST('sortfield', 'alpha'); +$sortfield = GETPOST('sortfield', 'aZ09comma'); $sortorder = GETPOST('sortorder', 'aZ09comma'); $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int'); if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1 diff --git a/htdocs/compta/prelevement/class/bonprelevement.class.php b/htdocs/compta/prelevement/class/bonprelevement.class.php index 067dd33cd81..9d3c5bef7a8 100644 --- a/htdocs/compta/prelevement/class/bonprelevement.class.php +++ b/htdocs/compta/prelevement/class/bonprelevement.class.php @@ -205,9 +205,9 @@ class BonPrelevement extends CommonObject $sql .= " FROM ".MAIN_DB_PREFIX."prelevement_lignes"; $sql .= " WHERE fk_prelevement_bons = ".$this->id; $sql .= " AND fk_soc =".$client_id; - $sql .= " AND code_banque ='".$code_banque."'"; - $sql .= " AND code_guichet ='".$code_guichet."'"; - $sql .= " AND number ='".$number."'"; + $sql .= " AND code_banque = '".$this->db->escape($code_banque)."'"; + $sql .= " AND code_guichet = '".$this->db->escape($code_guichet)."'"; + $sql .= " AND number = '".$this->db->escape($number)."'"; $resql = $this->db->query($sql); if ($resql) @@ -234,10 +234,10 @@ class BonPrelevement extends CommonObject $sql .= ", ".$client_id; $sql .= ", '".$this->db->escape($client_nom)."'"; $sql .= ", '".price2num($amount)."'"; - $sql .= ", '".$code_banque."'"; - $sql .= ", '".$code_guichet."'"; - $sql .= ", '".$number."'"; - $sql .= ", '".$number_key."'"; + $sql .= ", '".$this->db->escape($code_banque)."'"; + $sql .= ", '".$this->db->escape($code_guichet)."'"; + $sql .= ", '".$this->db->escape($number)."'"; + $sql .= ", '".$this->db->escape($number_key)."'"; $sql .= ")"; if ($this->db->query($sql)) @@ -1380,7 +1380,7 @@ class BonPrelevement extends CommonObject $result = 0; $sql = "DELETE FROM ".MAIN_DB_PREFIX."notify_def"; - $sql .= " WHERE rowid = '".$rowid."'"; + $sql .= " WHERE rowid = ".((int) $rowid); if ($this->db->query($sql)) { @@ -1404,7 +1404,7 @@ class BonPrelevement extends CommonObject $result = 0; $sql = "DELETE FROM ".MAIN_DB_PREFIX."notify_def"; - $sql .= " WHERE fk_user=".$user." AND fk_action='".$action."'"; + $sql .= " WHERE fk_user=".$user." AND fk_action='".$this->db->escape($action)."'"; if ($this->db->query($sql)) { @@ -1433,7 +1433,7 @@ class BonPrelevement extends CommonObject $now = dol_now(); $sql = "INSERT INTO ".MAIN_DB_PREFIX."notify_def (datec,fk_user, fk_soc, fk_contact, fk_action)"; - $sql .= " VALUES (".$db->idate($now).",".$user.", 'NULL', 'NULL', '".$action."')"; + $sql .= " VALUES ('".$this->db->idate($now)."', ".$user.", 'NULL', 'NULL', '".$this->db->escape($action)."')"; dol_syslog("adnotiff: ".$sql); if ($this->db->query($sql)) diff --git a/htdocs/compta/prelevement/factures.php b/htdocs/compta/prelevement/factures.php index 4104633e111..0b0c0eef6d4 100644 --- a/htdocs/compta/prelevement/factures.php +++ b/htdocs/compta/prelevement/factures.php @@ -45,7 +45,7 @@ $type = GETPOST('type', 'aZ09'); // Load variable for pagination $limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit; -$sortfield = GETPOST('sortfield', 'alpha'); +$sortfield = GETPOST('sortfield', 'aZ09comma'); $sortorder = GETPOST('sortorder', 'aZ09comma'); $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int'); if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1 diff --git a/htdocs/compta/prelevement/fiche-rejet.php b/htdocs/compta/prelevement/fiche-rejet.php index 29d799a8554..6e601d82ecd 100644 --- a/htdocs/compta/prelevement/fiche-rejet.php +++ b/htdocs/compta/prelevement/fiche-rejet.php @@ -45,7 +45,7 @@ $type = GETPOST('type', 'aZ09'); // Load variable for pagination $limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit; -$sortfield = GETPOST('sortfield', 'alpha'); +$sortfield = GETPOST('sortfield', 'aZ09comma'); $sortorder = GETPOST('sortorder', 'aZ09comma'); $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int'); if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1 diff --git a/htdocs/compta/prelevement/fiche-stat.php b/htdocs/compta/prelevement/fiche-stat.php index 3bb71f8c441..4ff81467d7c 100644 --- a/htdocs/compta/prelevement/fiche-stat.php +++ b/htdocs/compta/prelevement/fiche-stat.php @@ -43,7 +43,7 @@ $type = GETPOST('type', 'aZ09'); // Load variable for pagination $limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit; -$sortfield = GETPOST('sortfield', 'alpha'); +$sortfield = GETPOST('sortfield', 'aZ09comma'); $sortorder = GETPOST('sortorder', 'aZ09comma'); $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int'); if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1 diff --git a/htdocs/compta/prelevement/line.php b/htdocs/compta/prelevement/line.php index 4120672b44e..3c8d80d4931 100644 --- a/htdocs/compta/prelevement/line.php +++ b/htdocs/compta/prelevement/line.php @@ -47,7 +47,7 @@ $type = GETPOST('type', 'aZ09'); $limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit; $sortorder = GETPOST('sortorder', 'aZ09comma'); -$sortfield = GETPOST('sortfield', 'alpha'); +$sortfield = GETPOST('sortfield', 'aZ09comma'); $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int'); if ($page == -1 || $page == null) { $page = 0; } $offset = $limit * $page; diff --git a/htdocs/compta/prelevement/list.php b/htdocs/compta/prelevement/list.php index 1255a2b861e..6f9685ece18 100644 --- a/htdocs/compta/prelevement/list.php +++ b/htdocs/compta/prelevement/list.php @@ -50,7 +50,7 @@ $result = restrictedArea($user, 'prelevement', '', '', 'bons'); $type = GETPOST('type', 'aZ09'); $limit = GETPOST('limit', 'int')?GETPOST('limit', 'int'):$conf->liste_limit; -$sortfield = GETPOST('sortfield', 'alpha'); +$sortfield = GETPOST('sortfield', 'aZ09comma'); $sortorder = GETPOST('sortorder', 'aZ09comma'); $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int'); if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1 diff --git a/htdocs/compta/prelevement/rejets.php b/htdocs/compta/prelevement/rejets.php index 6c38e65981b..da2420aed3f 100644 --- a/htdocs/compta/prelevement/rejets.php +++ b/htdocs/compta/prelevement/rejets.php @@ -43,7 +43,7 @@ $type = GETPOST('type', 'aZ09'); // Get supervariables $limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit; $sortorder = GETPOST('sortorder', 'aZ09comma'); -$sortfield = GETPOST('sortfield', 'alpha'); +$sortfield = GETPOST('sortfield', 'aZ09comma'); $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int'); if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1 $offset = $limit * $page; diff --git a/htdocs/compta/recap-compta.php b/htdocs/compta/recap-compta.php index 3106235430e..63368fa94e8 100644 --- a/htdocs/compta/recap-compta.php +++ b/htdocs/compta/recap-compta.php @@ -46,7 +46,7 @@ $hookmanager->initHooks(array('recapcomptacard', 'globalcard')); // Load variable for pagination $limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit; -$sortfield = GETPOST('sortfield', 'alpha'); +$sortfield = GETPOST('sortfield', 'aZ09comma'); $sortorder = GETPOST('sortorder', 'aZ09comma'); $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int'); if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1 diff --git a/htdocs/compta/sociales/list.php b/htdocs/compta/sociales/list.php index 341799a686a..52d3b9b7fa3 100644 --- a/htdocs/compta/sociales/list.php +++ b/htdocs/compta/sociales/list.php @@ -138,8 +138,8 @@ if ($year > 0) $sql .= " AND ("; // Si period renseignee on l'utilise comme critere de date, sinon on prend date echeance, // ceci afin d'etre compatible avec les cas ou la periode n'etait pas obligatoire - $sql .= " (cs.periode IS NOT NULL AND date_format(cs.periode, '%Y') = '".$year."') "; - $sql .= "OR (cs.periode IS NULL AND date_format(cs.date_ech, '%Y') = '".$year."')"; + $sql .= " (cs.periode IS NOT NULL AND date_format(cs.periode, '%Y') = '".$db->escape($year)."') "; + $sql .= "OR (cs.periode IS NULL AND date_format(cs.date_ech, '%Y') = '".$db->escape($year)."')"; $sql .= ")"; } if ($filtre) { diff --git a/htdocs/compta/stats/cabyprodserv.php b/htdocs/compta/stats/cabyprodserv.php index ab2c1dcadb1..fbecc1df335 100644 --- a/htdocs/compta/stats/cabyprodserv.php +++ b/htdocs/compta/stats/cabyprodserv.php @@ -60,6 +60,9 @@ if (GETPOST('subcat', 'alpha') === 'yes') { $selected_type = GETPOST('search_type', 'int'); if ($selected_type == '') $selected_type = -1; +// Hook +$hookmanager->initHooks(array('cabyprodservlist')); + // Date range $year = GETPOST("year"); $month = GETPOST("month"); diff --git a/htdocs/compta/stats/casoc.php b/htdocs/compta/stats/casoc.php index ab71b147b50..a02d87a8392 100644 --- a/htdocs/compta/stats/casoc.php +++ b/htdocs/compta/stats/casoc.php @@ -61,6 +61,9 @@ if ($user->socid > 0) $socid = $user->socid; if (!empty($conf->comptabilite->enabled)) $result = restrictedArea($user, 'compta', '', '', 'resultat'); if (!empty($conf->accounting->enabled)) $result = restrictedArea($user, 'accounting', '', '', 'comptarapport'); +// Hook +$hookmanager->initHooks(array('casoclist')); + // Date range $year = GETPOST("year", 'int'); $month = GETPOST("month", 'int'); diff --git a/htdocs/compta/stats/supplier_turnover_by_prodserv.php b/htdocs/compta/stats/supplier_turnover_by_prodserv.php index 5911daaba45..83a3cb70a00 100644 --- a/htdocs/compta/stats/supplier_turnover_by_prodserv.php +++ b/htdocs/compta/stats/supplier_turnover_by_prodserv.php @@ -57,6 +57,9 @@ if (GETPOST('subcat', 'alpha') === 'yes') { $selected_type = GETPOST('search_type', 'int'); if ($selected_type == '') $selected_type = -1; +// Hook +$hookmanager->initHooks(array('supplierturnoverbyprodservlist')); + // Date range $year = GETPOST("year"); $month = GETPOST("month"); diff --git a/htdocs/compta/stats/supplier_turnover_by_thirdparty.php b/htdocs/compta/stats/supplier_turnover_by_thirdparty.php index 60d65049800..7a624284cdf 100644 --- a/htdocs/compta/stats/supplier_turnover_by_thirdparty.php +++ b/htdocs/compta/stats/supplier_turnover_by_thirdparty.php @@ -50,6 +50,9 @@ if (GETPOST('subcat', 'alpha') === 'yes') { $subcat = true; } +// Hook +$hookmanager->initHooks(array('supplierturnoverbythirdpartylist')); + // Security check if ($user->socid > 0) $socid = $user->socid; if (!empty($conf->comptabilite->enabled)) $result = restrictedArea($user, 'compta', '', '', 'resultat'); diff --git a/htdocs/compta/tva/class/tva.class.php b/htdocs/compta/tva/class/tva.class.php index b4201d0bc36..5f661609e52 100644 --- a/htdocs/compta/tva/class/tva.class.php +++ b/htdocs/compta/tva/class/tva.class.php @@ -384,7 +384,7 @@ class Tva extends CommonObject $sql .= " FROM ".MAIN_DB_PREFIX."facture as f WHERE f.paye = 1"; if ($year) { - $sql .= " AND f.datef >= '".$year."-01-01' AND f.datef <= '".$year."-12-31' "; + $sql .= " AND f.datef >= '".$this->db->escape($year)."-01-01' AND f.datef <= '".$this->db->escape($year)."-12-31' "; } $result = $this->db->query($sql); @@ -421,7 +421,7 @@ class Tva extends CommonObject $sql .= " FROM ".MAIN_DB_PREFIX."facture_fourn as f"; if ($year) { - $sql .= " WHERE f.datef >= '".$year."-01-01' AND f.datef <= '".$year."-12-31' "; + $sql .= " WHERE f.datef >= '".$this->db->escape($year)."-01-01' AND f.datef <= '".$this->db->escape($year)."-12-31' "; } $result = $this->db->query($sql); @@ -460,7 +460,7 @@ class Tva extends CommonObject if ($year) { - $sql .= " WHERE f.datev >= '".$year."-01-01' AND f.datev <= '".$year."-12-31' "; + $sql .= " WHERE f.datev >= '".$this->db->escape($year)."-01-01' AND f.datev <= '".$this->db->escape($year)."-12-31' "; } $result = $this->db->query($sql); diff --git a/htdocs/compta/tva/list.php b/htdocs/compta/tva/list.php index 8c9b9efb5a6..82829fca12e 100644 --- a/htdocs/compta/tva/list.php +++ b/htdocs/compta/tva/list.php @@ -170,22 +170,18 @@ if ($result) // Date end period print '';
print ' ';
- print $langs->trans('From').' ';
- print $form->selectDate($search_dateend_start ? $search_dateend_start : -1, 'search_dateend_start', 0, 0, 1);
+ print $form->selectDate($search_dateend_start ? $search_dateend_start : -1, 'search_dateend_start', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From'));
print ' ';
print '';
- print $langs->trans('to').' ';
- print $form->selectDate($search_dateend_end ? $search_dateend_end : -1, 'search_dateend_end', 0, 0, 1);
+ print $form->selectDate($search_dateend_end ? $search_dateend_end : -1, 'search_dateend_end', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('to'));
print ' ';
// Date payment
print ' | ';
print ' ';
- print $langs->trans('From').' ';
- print $form->selectDate($search_datepayment_start ? $search_datepayment_start : -1, 'search_datepayment_start', 0, 0, 1);
+ print $form->selectDate($search_datepayment_start ? $search_datepayment_start : -1, 'search_datepayment_start', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From'));
print ' ';
print '';
- print $langs->trans('to').' ';
- print $form->selectDate($search_datepayment_end ? $search_datepayment_end : -1, 'search_datepayment_end', 0, 0, 1);
+ print $form->selectDate($search_datepayment_end ? $search_datepayment_end : -1, 'search_datepayment_end', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('to'));
print ' ';
// Type
print ' | ';
diff --git a/htdocs/contact/card.php b/htdocs/contact/card.php
index dab7242b598..8428b257fac 100644
--- a/htdocs/contact/card.php
+++ b/htdocs/contact/card.php
@@ -1249,9 +1249,14 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action))
}
}
- if (!empty($id) && $action != 'edit' && $action != 'create')
- {
- $objsoc = new Societe($db);
+ // Select mail models is same action as presend
+ if (GETPOST('modelselected', 'alpha')) {
+ $action = 'presend';
+ }
+
+ if (!empty($id) && $action != 'edit' && $action != 'create')
+ {
+ $objsoc = new Societe($db);
// View mode
diff --git a/htdocs/contact/class/contact.class.php b/htdocs/contact/class/contact.class.php
index 3922dc9069f..0c2c3bf56ce 100644
--- a/htdocs/contact/class/contact.class.php
+++ b/htdocs/contact/class/contact.class.php
@@ -1649,7 +1649,7 @@ class Contact extends CommonObject
$sql .= ", ".MAIN_DB_PREFIX."societe_contacts sc";
$sql .= " WHERE sc.fk_soc =".$this->socid;
$sql .= " AND sc.fk_c_type_contact=tc.rowid";
- $sql .= " AND tc.element='".$element."'";
+ $sql .= " AND tc.element='".$this->db->escape($element)."'";
$sql .= " AND tc.active=1";
dol_syslog(__METHOD__, LOG_DEBUG);
diff --git a/htdocs/contact/list.php b/htdocs/contact/list.php
index 7bf82aa9379..0f4f01a0916 100644
--- a/htdocs/contact/list.php
+++ b/htdocs/contact/list.php
@@ -104,7 +104,7 @@ $type = GETPOST("type", 'aZ');
$view = GETPOST("view", 'alpha');
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
$userid = GETPOST('userid', 'int');
diff --git a/htdocs/contrat/class/api_contracts.class.php b/htdocs/contrat/class/api_contracts.class.php
index ffe66208afe..671ac1177f6 100644
--- a/htdocs/contrat/class/api_contracts.class.php
+++ b/htdocs/contrat/class/api_contracts.class.php
@@ -141,7 +141,7 @@ class Contracts extends DolibarrApi
$sql .= " AND (".preg_replace_callback('/'.$regexstring.'/', 'DolibarrApi::_forge_criteria_callback', $sqlfilters).")";
}
- $sql .= $db->order($sortfield, $sortorder);
+ $sql .= $this->db->order($sortfield, $sortorder);
if ($limit) {
if ($page < 0)
{
@@ -149,28 +149,28 @@ class Contracts extends DolibarrApi
}
$offset = $limit * $page;
- $sql .= $db->plimit($limit + 1, $offset);
+ $sql .= $this->db->plimit($limit + 1, $offset);
}
dol_syslog("API Rest request");
- $result = $db->query($sql);
+ $result = $this->db->query($sql);
if ($result)
{
- $num = $db->num_rows($result);
+ $num = $this->db->num_rows($result);
$min = min($num, ($limit <= 0 ? $num : $limit));
$i = 0;
while ($i < $min)
{
- $obj = $db->fetch_object($result);
- $contrat_static = new Contrat($db);
+ $obj = $this->db->fetch_object($result);
+ $contrat_static = new Contrat($this->db);
if ($contrat_static->fetch($obj->rowid)) {
$obj_ret[] = $this->_cleanObjectDatas($contrat_static);
}
$i++;
}
} else {
- throw new RestException(503, 'Error when retrieve contrat list : '.$db->lasterror());
+ throw new RestException(503, 'Error when retrieve contrat list : '.$this->db->lasterror());
}
if (!count($obj_ret)) {
throw new RestException(404, 'No contract found');
diff --git a/htdocs/contrat/class/contrat.class.php b/htdocs/contrat/class/contrat.class.php
index b555917e2f3..f94b19c30b9 100644
--- a/htdocs/contrat/class/contrat.class.php
+++ b/htdocs/contrat/class/contrat.class.php
@@ -510,7 +510,7 @@ class Contrat extends CommonObject
if ($num)
{
- $sql = "UPDATE ".MAIN_DB_PREFIX."contrat SET ref = '".$num."', statut = 1";
+ $sql = "UPDATE ".MAIN_DB_PREFIX."contrat SET ref = '".$this->db->escape($num)."', statut = 1";
//$sql.= ", fk_user_valid = ".$user->id.", date_valid = '".$this->db->idate($now)."'";
$sql .= " WHERE rowid = ".$this->id." AND statut = 0";
@@ -1093,7 +1093,7 @@ class Contrat extends CommonObject
}
$sqlcontact = "SELECT ctc.code, ctc.source, ec.fk_socpeople FROM ".MAIN_DB_PREFIX."element_contact as ec, ".MAIN_DB_PREFIX."c_type_contact as ctc";
- $sqlcontact .= " WHERE element_id = ".$originidforcontact." AND ec.fk_c_type_contact = ctc.rowid AND ctc.element = '".$originforcontact."'";
+ $sqlcontact .= " WHERE element_id = ".$originidforcontact." AND ec.fk_c_type_contact = ctc.rowid AND ctc.element = '".$this->db->escape($originforcontact)."'";
$resqlcontact = $this->db->query($sqlcontact);
if ($resqlcontact)
@@ -1541,15 +1541,15 @@ class Contrat extends CommonObject
$sql .= ($fk_product > 0 ? $fk_product : "null").",";
$sql .= " ".$qty.",";
$sql .= " ".$txtva.",";
- $sql .= " ".($vat_src_code ? "'".$vat_src_code."'" : "null").",";
+ $sql .= " ".($vat_src_code ? "'".$this->db->escape($vat_src_code)."'" : "null").",";
$sql .= " ".$txlocaltax1.",";
$sql .= " ".$txlocaltax2.",";
- $sql .= " '".$localtax1_type."',";
- $sql .= " '".$localtax2_type."',";
+ $sql .= " '".$this->db->escape($localtax1_type)."',";
+ $sql .= " '".$this->db->escape($localtax2_type)."',";
$sql .= " ".price2num($remise_percent).",";
$sql .= " ".price2num($pu_ht).",";
$sql .= " ".price2num($total_ht).",".price2num($total_tva).",".price2num($total_localtax1).",".price2num($total_localtax2).",".price2num($total_ttc).",";
- $sql .= " '".$info_bits."',";
+ $sql .= " '".$this->db->escape($info_bits)."',";
$sql .= " ".price2num($price).",".price2num($remise).",";
if (isset($fk_fournprice)) $sql .= ' '.$fk_fournprice.',';
else $sql .= ' null,';
@@ -1717,8 +1717,8 @@ class Contrat extends CommonObject
$sql .= ",tva_tx='".price2num($tvatx)."'";
$sql .= ",localtax1_tx='".price2num($localtax1tx)."'";
$sql .= ",localtax2_tx='".price2num($localtax2tx)."'";
- $sql .= ",localtax1_type='".$localtax1_type."'";
- $sql .= ",localtax2_type='".$localtax2_type."'";
+ $sql .= ",localtax1_type='".$this->db->escape($localtax1_type)."'";
+ $sql .= ",localtax2_type='".$this->db->escape($localtax2_type)."'";
$sql .= ", total_ht='".price2num($total_ht)."'";
$sql .= ", total_tva='".price2num($total_tva)."'";
$sql .= ", total_localtax1='".price2num($total_localtax1)."'";
diff --git a/htdocs/contrat/index.php b/htdocs/contrat/index.php
index 1293da8cf26..7fe88d03c3d 100644
--- a/htdocs/contrat/index.php
+++ b/htdocs/contrat/index.php
@@ -37,7 +37,7 @@ $hookmanager->initHooks(array('contractindex'));
// Load translation files required by the page
$langs->loadLangs(array('products', 'companies', 'contracts'));
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
diff --git a/htdocs/core/actions_massactions.inc.php b/htdocs/core/actions_massactions.inc.php
index 4db4c94f007..98e936a2d7a 100644
--- a/htdocs/core/actions_massactions.inc.php
+++ b/htdocs/core/actions_massactions.inc.php
@@ -648,9 +648,9 @@ if ($massaction == 'confirm_createbills') // Create bills from orders
$sql .= ", targettype";
$sql .= ") VALUES (";
$sql .= $id_order;
- $sql .= ", '".$objecttmp->origin."'";
+ $sql .= ", '".$db->escape($objecttmp->origin)."'";
$sql .= ", ".$objecttmp->id;
- $sql .= ", '".$objecttmp->element."'";
+ $sql .= ", '".$db->escape($objecttmp->element)."'";
$sql .= ")";
if (!$db->query($sql))
diff --git a/htdocs/core/ajax/check_notifications.php b/htdocs/core/ajax/check_notifications.php
index f8a30e69aa9..098ac586ce1 100644
--- a/htdocs/core/ajax/check_notifications.php
+++ b/htdocs/core/ajax/check_notifications.php
@@ -101,7 +101,7 @@ $eventfound = array();
//dol_syslog('time='.$time.' $_SESSION[auto_ck_events_not_before]='.$_SESSION['auto_check_events_not_before']);
// TODO Try to make a solution with only a javascript timer that is easier. Difficulty is to avoid notification twice when several tabs are opened.
-// This need to extend period to be sure to not miss and save in session what we notified to avoid duplicate (save is not done yet).
+// This need to extend period to be sure to not miss and save in session what we notified to avoid duplicate.
if ($time >= $_SESSION['auto_check_events_not_before'] || GETPOST('forcechecknow', 'int'))
{
$time_update = (int) $conf->global->MAIN_BROWSER_NOTIFICATION_FREQUENCY; // Always defined
diff --git a/htdocs/core/ajax/constantonoff.php b/htdocs/core/ajax/constantonoff.php
index 456542e331e..710759e10bb 100644
--- a/htdocs/core/ajax/constantonoff.php
+++ b/htdocs/core/ajax/constantonoff.php
@@ -26,13 +26,15 @@ if (!defined('NOREQUIREHTML')) define('NOREQUIREHTML', '1');
if (!defined('NOREQUIREAJAX')) define('NOREQUIREAJAX', '1');
if (!defined('NOREQUIRESOC')) define('NOREQUIRESOC', '1');
if (!defined('NOREQUIRETRAN')) define('NOREQUIRETRAN', '1');
+if (!defined('CSRFCHECK_WITH_TOKEN')) define('CSRFCHECK_WITH_TOKEN', '1'); // Token is required even in GET mode
require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
-$action = GETPOST('action', 'aZ09');
+$action = GETPOST('action', 'aZ09'); // set or del
$name = GETPOST('name', 'alpha');
+
/*
* View
*/
@@ -46,7 +48,7 @@ top_httphead();
//print ''."\n";
-// Registering the location of boxes
+// Registering the new value of constant
if (!empty($action) && !empty($name))
{
$entity = GETPOST('entity', 'int');
@@ -62,4 +64,6 @@ if (!empty($action) && !empty($name))
dolibarr_del_const($db, $name, $entity);
}
}
+} else {
+ http_response_code(403);
}
diff --git a/htdocs/core/ajax/selectobject.php b/htdocs/core/ajax/selectobject.php
index a672510555b..9d9b7bbfc42 100644
--- a/htdocs/core/ajax/selectobject.php
+++ b/htdocs/core/ajax/selectobject.php
@@ -75,9 +75,10 @@ if (!is_object($objecttmp))
}
// When used from jQuery, the search term is added as GET param "term".
-$searchkey = (($id && GETPOST($id, 'alpha')) ?GETPOST($id, 'alpha') : (($htmlname && GETPOST($htmlname, 'alpha')) ?GETPOST($htmlname, 'alpha') : ''));
+$searchkey = (($id && GETPOST($id, 'alpha')) ? GETPOST($id, 'alpha') : (($htmlname && GETPOST($htmlname, 'alpha')) ? GETPOST($htmlname, 'alpha') : ''));
-// TODO Add a security test to avoid to get content of all tables
+// Add a security test to avoid to get content of all tables
+restrictedArea($user, $objecttmp->element, $id);
$arrayresult = $form->selectForFormsList($objecttmp, $htmlname, '', 0, $searchkey, '', '', '', 0, 1);
diff --git a/htdocs/core/boxes/box_produits.php b/htdocs/core/boxes/box_produits.php
index 8dffe4adf20..52591fa5292 100644
--- a/htdocs/core/boxes/box_produits.php
+++ b/htdocs/core/boxes/box_produits.php
@@ -117,7 +117,7 @@ class box_produits extends ModeleBoxes
$sqld = "SELECT label";
$sqld .= " FROM ".MAIN_DB_PREFIX."product_lang";
$sqld .= " WHERE fk_product=".$objp->rowid;
- $sqld .= " AND lang='".$langs->getDefaultLang()."'";
+ $sqld .= " AND lang='".$this->db->escape($langs->getDefaultLang())."'";
$sqld .= " LIMIT 1";
$resultd = $this->db->query($sqld);
diff --git a/htdocs/core/boxes/box_produits_alerte_stock.php b/htdocs/core/boxes/box_produits_alerte_stock.php
index 5b17ef22ddf..6845cb2db5f 100644
--- a/htdocs/core/boxes/box_produits_alerte_stock.php
+++ b/htdocs/core/boxes/box_produits_alerte_stock.php
@@ -130,7 +130,7 @@ class box_produits_alerte_stock extends ModeleBoxes
$sqld = "SELECT label";
$sqld .= " FROM ".MAIN_DB_PREFIX."product_lang";
$sqld .= " WHERE fk_product=".$objp->rowid;
- $sqld .= " AND lang='".$langs->getDefaultLang()."'";
+ $sqld .= " AND lang='".$this->db->escape($langs->getDefaultLang())."'";
$sqld .= " LIMIT 1";
$resultd = $this->db->query($sqld);
diff --git a/htdocs/core/boxes/box_task.php b/htdocs/core/boxes/box_task.php
index 9c6020bebdc..c1d728eb667 100644
--- a/htdocs/core/boxes/box_task.php
+++ b/htdocs/core/boxes/box_task.php
@@ -94,7 +94,7 @@ class box_task extends ModeleBoxes
if (in_array(GETPOST($cookie_name), array('all', 'im_project_contact', 'im_task_contact'))) {
$filterValue = GETPOST($cookie_name);
} elseif (!empty($_COOKIE[$cookie_name])) {
- $filterValue = $_COOKIE[$cookie_name];
+ $filterValue = preg_replace('/[^a-z_]/', '', $_COOKIE[$cookie_name]); // Clean cookie from evil data
}
if ($filterValue == 'im_task_contact') {
@@ -154,10 +154,10 @@ class box_task extends ModeleBoxes
$sql .= " JOIN ".MAIN_DB_PREFIX."projet as p ON (pt.fk_projet = p.rowid)";
if ($filterValue === 'im_task_contact') {
- $sql .= " JOIN ".MAIN_DB_PREFIX."element_contact as ec ON (ec.element_id = pt.rowid AND ec.fk_socpeople = '".$user->id."' )";
+ $sql .= " JOIN ".MAIN_DB_PREFIX."element_contact as ec ON (ec.element_id = pt.rowid AND ec.fk_socpeople = ".((int) $user->id).")";
$sql .= " JOIN ".MAIN_DB_PREFIX."c_type_contact as tc ON (ec.fk_c_type_contact = tc.rowid AND tc.element = 'project_task' AND tc.source = 'internal' )";
} elseif ($filterValue === 'im_project_contact') {
- $sql .= " JOIN ".MAIN_DB_PREFIX."element_contact as ec ON (ec.element_id = p.rowid AND ec.fk_socpeople = '".$user->id."' )";
+ $sql .= " JOIN ".MAIN_DB_PREFIX."element_contact as ec ON (ec.element_id = p.rowid AND ec.fk_socpeople = ".((int) $user->id).")";
$sql .= " JOIN ".MAIN_DB_PREFIX."c_type_contact as tc ON (ec.fk_c_type_contact = tc.rowid AND tc.element = 'project' AND tc.source = 'internal' )";
}
diff --git a/htdocs/core/class/CMailFile.class.php b/htdocs/core/class/CMailFile.class.php
index a90e3a2cf26..10c539a48de 100644
--- a/htdocs/core/class/CMailFile.class.php
+++ b/htdocs/core/class/CMailFile.class.php
@@ -294,6 +294,16 @@ class CMailFile
$addr_bcc .= ($addr_bcc ? ', ' : '').$conf->global->MAIN_MAIL_AUTOCOPY_TO;
}
+ $keyforsslseflsigned ='MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED';
+ if (!empty($this->sendcontext)) {
+ $smtpContextKey = strtoupper($this->sendcontext);
+ $keyForSMTPSendMode = 'MAIN_MAIL_SENDMODE_' . $smtpContextKey;
+ $smtpContextSendMode = $conf->global->{$keyForSMTPSendMode};
+ if (!empty($smtpContextSendMode) && $smtpContextSendMode != 'default') {
+ $keyforsslseflsigned ='MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED_' . $smtpContextKey;
+ }
+ }
+
// We set all data according to choosed sending method.
// We also set a value for ->msgid
if ($this->sendmode == 'mail')
@@ -404,6 +414,7 @@ class CMailFile
$smtps->setBCC($this->addr_bcc);
$smtps->setErrorsTo($this->errors_to);
$smtps->setDeliveryReceipt($this->deliveryreceipt);
+ if (!empty($conf->global->$keyforsslseflsigned)) $smtps->setOptions(array('ssl' => array('verify_peer' => false, 'verify_peer_name' => false, 'allow_self_signed' => true)));
$host = dol_getprefix('email');
$this->msgid = time().'.SMTPs-dolibarr-'.$this->trackid.'@'.$host;
@@ -642,17 +653,19 @@ class CMailFile
$keyforsmtppw = 'MAIN_MAIL_SMTPS_PW';
$keyfortls = 'MAIN_MAIL_EMAIL_TLS';
$keyforstarttls = 'MAIN_MAIL_EMAIL_STARTTLS';
+ $keyforsslseflsigned ='MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED';
if (!empty($this->sendcontext)) {
$smtpContextKey = strtoupper($this->sendcontext);
$keyForSMTPSendMode = 'MAIN_MAIL_SENDMODE_'.$smtpContextKey;
$smtpContextSendMode = $conf->global->{$keyForSMTPSendMode};
if (!empty($smtpContextSendMode) && $smtpContextSendMode != 'default') {
- $keyforsmtpserver = 'MAIN_MAIL_SMTP_SERVER_'.$smtpContextKey;
- $keyforsmtpport = 'MAIN_MAIL_SMTP_PORT_'.$smtpContextKey;
- $keyforsmtpid = 'MAIN_MAIL_SMTPS_ID_'.$smtpContextKey;
- $keyforsmtppw = 'MAIN_MAIL_SMTPS_PW_'.$smtpContextKey;
- $keyfortls = 'MAIN_MAIL_EMAIL_TLS_'.$smtpContextKey;
- $keyforstarttls = 'MAIN_MAIL_EMAIL_STARTTLS_'.$smtpContextKey;
+ $keyforsmtpserver = 'MAIN_MAIL_SMTP_SERVER_' . $smtpContextKey;
+ $keyforsmtpport = 'MAIN_MAIL_SMTP_PORT_' . $smtpContextKey;
+ $keyforsmtpid = 'MAIN_MAIL_SMTPS_ID_' . $smtpContextKey;
+ $keyforsmtppw = 'MAIN_MAIL_SMTPS_PW_' . $smtpContextKey;
+ $keyfortls = 'MAIN_MAIL_EMAIL_TLS_' . $smtpContextKey;
+ $keyforstarttls = 'MAIN_MAIL_EMAIL_STARTTLS_' . $smtpContextKey;
+ $keyforsslseflsigned ='MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED_' . $smtpContextKey;
}
}
@@ -849,6 +862,7 @@ class CMailFile
if (!empty($conf->global->$keyforsmtpid)) $this->transport->setUsername($conf->global->$keyforsmtpid);
if (!empty($conf->global->$keyforsmtppw)) $this->transport->setPassword($conf->global->$keyforsmtppw);
+ if (! empty($conf->global->$keyforsslseflsigned)) $this->transport->setStreamOptions(array('ssl' => array('allow_self_signed' => true, 'verify_peer' => false)));;
//$smtps->_msgReplyTo = 'reply@web.com';
// Switch content encoding to base64 - avoid the doubledot issue with quoted-printable
diff --git a/htdocs/core/class/comment.class.php b/htdocs/core/class/comment.class.php
index 91fba374181..a083576aacb 100644
--- a/htdocs/core/class/comment.class.php
+++ b/htdocs/core/class/comment.class.php
@@ -349,25 +349,25 @@ class Comment extends CommonObject
$sql .= " c.rowid";
$sql .= " FROM ".MAIN_DB_PREFIX.$this->table_element." as c";
$sql .= " WHERE c.fk_element = ".$fk_element;
- $sql .= " AND c.element_type = '".$db->escape($element_type)."'";
+ $sql .= " AND c.element_type = '".$this->db->escape($element_type)."'";
$sql .= " AND c.entity = ".$conf->entity;
$sql .= " ORDER BY c.tms DESC";
dol_syslog(get_class($this).'::'.__METHOD__, LOG_DEBUG);
- $resql = $db->query($sql);
+ $resql = $this->db->query($sql);
if ($resql)
{
- $num_rows = $db->num_rows($resql);
+ $num_rows = $this->db->num_rows($resql);
if ($num_rows > 0)
{
- while ($obj = $db->fetch_object($resql))
+ while ($obj = $this->db->fetch_object($resql))
{
$comment = new self($db);
$comment->fetch($obj->rowid);
$this->comments[] = $comment;
}
}
- $db->free($resql);
+ $this->db->free($resql);
} else {
$this->errors[] = "Error ".$this->db->lasterror();
return -1;
diff --git a/htdocs/core/class/commondocgenerator.class.php b/htdocs/core/class/commondocgenerator.class.php
index f610e6bb952..2eac2d5d900 100644
--- a/htdocs/core/class/commondocgenerator.class.php
+++ b/htdocs/core/class/commondocgenerator.class.php
@@ -604,7 +604,7 @@ abstract class CommonDocGenerator
if ($columns != "")
{
$columns = substr($columns, 0, strlen($columns) - 2);
- $resql = $this->db->query("SELECT $columns FROM ".MAIN_DB_PREFIX."product_fournisseur_price_extrafields AS ex INNER JOIN ".MAIN_DB_PREFIX."product_fournisseur_price AS f ON ex.fk_object = f.rowid WHERE f.ref_fourn = '".$line->ref_supplier."'");
+ $resql = $this->db->query("SELECT ".$columns." FROM ".MAIN_DB_PREFIX."product_fournisseur_price_extrafields AS ex INNER JOIN ".MAIN_DB_PREFIX."product_fournisseur_price AS f ON ex.fk_object = f.rowid WHERE f.ref_fourn = '".$this->db->escape($line->ref_supplier)."'");
if ($this->db->num_rows($resql) > 0)
{
diff --git a/htdocs/core/class/commonincoterm.class.php b/htdocs/core/class/commonincoterm.class.php
index b0bb5a3370c..b2d5491684e 100644
--- a/htdocs/core/class/commonincoterm.class.php
+++ b/htdocs/core/class/commonincoterm.class.php
@@ -122,12 +122,12 @@ trait CommonIncoterm
$this->fk_incoterms = $id_incoterm;
$this->location_incoterms = $location;
- $sql = 'SELECT libelle FROM '.MAIN_DB_PREFIX.'c_incoterms WHERE rowid = '.(int) $this->fk_incoterms;
+ $sql = 'SELECT libelle as label_incotermsFROM '.MAIN_DB_PREFIX.'c_incoterms WHERE rowid = '.(int) $this->fk_incoterms;
$res = $this->db->query($sql);
if ($res)
{
$obj = $this->db->fetch_object($res);
- $this->label_incoterms = $obj->libelle;
+ $this->label_incoterms = $obj->label_incoterms;
}
return 1;
} else {
diff --git a/htdocs/core/class/commoninvoice.class.php b/htdocs/core/class/commoninvoice.class.php
index 3dabb8279e9..98890744701 100644
--- a/htdocs/core/class/commoninvoice.class.php
+++ b/htdocs/core/class/commoninvoice.class.php
@@ -462,7 +462,7 @@ abstract class CommonInvoice extends CommonObject
$type = 'customer_invoice';
if ($this->element == 'invoice_supplier') $type = 'supplier_invoice';
- $sql = " SELECT COUNT(ab.rowid) as nb FROM ".MAIN_DB_PREFIX."accounting_bookkeeping as ab WHERE ab.doc_type='".$type."' AND ab.fk_doc = ".$this->id;
+ $sql = " SELECT COUNT(ab.rowid) as nb FROM ".MAIN_DB_PREFIX."accounting_bookkeeping as ab WHERE ab.doc_type='".$this->db->escape($type)."' AND ab.fk_doc = ".$this->id;
$resql = $this->db->query($sql);
if ($resql)
{
@@ -544,7 +544,7 @@ abstract class CommonInvoice extends CommonObject
$labelStatus = $langs->trans('BillStatusClosedPaidPartially');
$labelStatusShort = $langs->trans('Bill'.$prefix.'StatusClosedPaidPartially');
$statusType = 'status9';
- } elseif ($alreadypaid <= 0) {
+ } elseif ($alreadypaid == 0) {
$labelStatus = $langs->trans('BillStatusNotPaid');
$labelStatusShort = $langs->trans('Bill'.$prefix.'StatusNotPaid');
$statusType = 'status1';
diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php
index ef519f388a7..38596f2a265 100644
--- a/htdocs/core/class/commonobject.class.php
+++ b/htdocs/core/class/commonobject.class.php
@@ -1028,8 +1028,8 @@ abstract class CommonObject
// Insert into database
$sql = "UPDATE ".MAIN_DB_PREFIX."element_contact set";
$sql .= " statut = ".$statut;
- if ($type_contact_id) $sql .= ", fk_c_type_contact = '".$type_contact_id."'";
- if ($fk_socpeople) $sql .= ", fk_socpeople = '".$fk_socpeople."'";
+ if ($type_contact_id) $sql .= ", fk_c_type_contact = ".((int) $type_contact_id);
+ if ($fk_socpeople) $sql .= ", fk_socpeople = ".((int) $fk_socpeople);
$sql .= " where rowid = ".$rowid;
$resql = $this->db->query($sql);
if ($resql)
@@ -1389,9 +1389,9 @@ abstract class CommonObject
if ($source == 'internal') $sql .= " AND c.entity IN (".getEntity('user').")";
if ($source == 'external') $sql .= " AND c.entity IN (".getEntity('societe').")";
$sql .= " AND ec.fk_c_type_contact = tc.rowid";
- $sql .= " AND tc.element = '".$element."'";
- $sql .= " AND tc.source = '".$source."'";
- if ($code) $sql .= " AND tc.code = '".$code."'";
+ $sql .= " AND tc.element = '".$this->db->escape($element)."'";
+ $sql .= " AND tc.source = '".$this->db->escape($source)."'";
+ if ($code) $sql .= " AND tc.code = '".$this->db->escape($code)."'";
$sql .= " AND tc.active = 1";
if ($status) $sql .= " AND ec.statut = ".$status;
@@ -3243,16 +3243,16 @@ abstract class CommonObject
{
if ($justsource)
{
- $sql .= "fk_source = ".$sourceid." AND sourcetype = '".$sourcetype."'";
- if ($withtargettype) $sql .= " AND targettype = '".$targettype."'";
+ $sql .= "fk_source = ".$sourceid." AND sourcetype = '".$this->db->escape($sourcetype)."'";
+ if ($withtargettype) $sql .= " AND targettype = '".$this->db->escape($targettype)."'";
} elseif ($justtarget)
{
- $sql .= "fk_target = ".$targetid." AND targettype = '".$targettype."'";
- if ($withsourcetype) $sql .= " AND sourcetype = '".$sourcetype."'";
+ $sql .= "fk_target = ".$targetid." AND targettype = '".$this->db->escape($targettype)."'";
+ if ($withsourcetype) $sql .= " AND sourcetype = '".$this->db->escape($sourcetype)."'";
}
} else {
- $sql .= "(fk_source = ".$sourceid." AND sourcetype = '".$sourcetype."')";
- $sql .= " ".$clause." (fk_target = ".$targetid." AND targettype = '".$targettype."')";
+ $sql .= "(fk_source = ".$sourceid." AND sourcetype = '".$this->db->escape($sourcetype)."')";
+ $sql .= " ".$clause." (fk_target = ".$targetid." AND targettype = '".$this->db->escape($targettype)."')";
}
$sql .= ' ORDER BY '.$orderby;
@@ -4841,7 +4841,7 @@ abstract class CommonObject
// Request to get translation values for object
$sql = "SELECT rowid, property, lang , value";
$sql .= " FROM ".MAIN_DB_PREFIX."object_lang";
- $sql .= " WHERE type_object = '".$element."'";
+ $sql .= " WHERE type_object = '".$this->db->escape($element)."'";
$sql .= " AND fk_object = ".$this->id;
//dol_syslog(get_class($this)."::fetch_optionals get extrafields data for ".$this->table_element, LOG_DEBUG); // Too verbose
@@ -5741,11 +5741,9 @@ abstract class CommonObject
}
// Set value of $morecss. For this, we use in priority showsize from parameters, then $val['css'] then autodefine
- if (empty($morecss) && !empty($val['css']))
- {
+ if (empty($morecss) && !empty($val['css'])) {
$morecss = $val['css'];
- } elseif (empty($morecss))
- {
+ } elseif (empty($morecss)) {
if ($type == 'date')
{
$morecss = 'minwidth100imp';
@@ -5792,16 +5790,16 @@ abstract class CommonObject
{
$tmp = explode(',', $size);
$newsize = $tmp[0];
- $out = '';
+ $out = '';
} elseif (in_array($type, array('real')))
{
- $out = '';
+ $out = '';
} elseif (preg_match('/varchar/', $type))
{
- $out = '';
+ $out = '';
} elseif (in_array($type, array('mail', 'phone', 'url')))
{
- $out = '';
+ $out = '';
} elseif ($type == 'text')
{
if (!preg_match('/search_/', $keyprefix)) // If keyprefix is search_ or search_options_, we must just use a simple text field
@@ -8295,7 +8293,7 @@ abstract class CommonObject
$sql = "INSERT INTO ".MAIN_DB_PREFIX."categorie_".(empty($categorystatic->MAP_CAT_TABLE[$type]) ? $type : $categorystatic->MAP_CAT_TABLE[$type])." (fk_categorie, fk_product)";
$sql .= " SELECT fk_categorie, $toId FROM ".MAIN_DB_PREFIX."categorie_".(empty($categorystatic->MAP_CAT_TABLE[$type]) ? $type : $categorystatic->MAP_CAT_TABLE[$type]);
- $sql .= " WHERE fk_product = '".$fromId."'";
+ $sql .= " WHERE fk_product = ".((int) $fromId);
if (!$this->db->query($sql))
{
@@ -8341,7 +8339,7 @@ abstract class CommonObject
$sql = "DELETE FROM ".MAIN_DB_PREFIX."ecm_files";
$sql.= " WHERE filename LIKE '".$this->db->escape($this->ref)."%'";
- $sql.= " AND filepath = '".$element."/".$this->db->escape($this->ref)."' AND entity = ".$conf->entity;
+ $sql.= " AND filepath = '".$this->db->escape($element)."/".$this->db->escape($this->ref)."' AND entity = ".$conf->entity;
if (!$this->db->query($sql)) {
$this->error = $this->db->lasterror();
diff --git a/htdocs/core/class/commonstickergenerator.class.php b/htdocs/core/class/commonstickergenerator.class.php
index 6c832c4788d..c3d6e7de299 100644
--- a/htdocs/core/class/commonstickergenerator.class.php
+++ b/htdocs/core/class/commonstickergenerator.class.php
@@ -127,7 +127,7 @@ abstract class CommonStickerGenerator
/**
* Output a sticker on page at position _COUNTX, _COUNTY (_COUNTX and _COUNTY start from 0)
*
- * @param PDF $pdf PDF reference
+ * @param TCPDF $pdf PDF reference
* @param Translate $outputlangs Output langs
* @param array $param Associative array containing label content and optional parameters
* @return void
@@ -139,7 +139,7 @@ abstract class CommonStickerGenerator
* Methode qui permet de modifier la taille des caracteres
* Cela modiera aussi l'espace entre chaque ligne
*
- * @param PDF $pdf PDF reference
+ * @param TCPDF $pdf PDF reference
* @param int $pt point
* @return void
*/
@@ -158,7 +158,7 @@ abstract class CommonStickerGenerator
/**
* protected Print dot line
*
- * @param PDF $pdf PDF reference
+ * @param TCPDF $pdf PDF reference
* @param int $x1 X1
* @param int $y1 Y1
* @param int $x2 X2
@@ -201,7 +201,7 @@ abstract class CommonStickerGenerator
/**
* protected Function realisant une croix aux 4 coins des cartes
*
- * @param PDF $pdf PDF reference
+ * @param TCPDF $pdf PDF reference
* @param int $x1 X1
* @param int $y1 Y1
* @param int $x2 X2
@@ -280,7 +280,7 @@ abstract class CommonStickerGenerator
/**
* protected Set format
*
- * @param PDF $pdf PDF reference
+ * @param TCPDF $pdf PDF reference
* @param string $format Format
* @return void
*/
diff --git a/htdocs/core/class/extrafields.class.php b/htdocs/core/class/extrafields.class.php
index ddf811cfc77..678560b622e 100644
--- a/htdocs/core/class/extrafields.class.php
+++ b/htdocs/core/class/extrafields.class.php
@@ -426,7 +426,7 @@ class ExtraFields
$sql .= " help,";
$sql .= " totalizable";
$sql .= " )";
- $sql .= " VALUES('".$attrname."',";
+ $sql .= " VALUES('".$this->db->escape($attrname)."',";
$sql .= " '".$this->db->escape($label)."',";
$sql .= " '".$this->db->escape($type)."',";
$sql .= " ".$pos.",";
@@ -494,8 +494,8 @@ class ExtraFields
{
$sql = "SELECT COUNT(rowid) as nb";
$sql .= " FROM ".MAIN_DB_PREFIX."extrafields";
- $sql .= " WHERE elementtype = '".$elementtype."'";
- $sql .= " AND name = '".$attrname."'";
+ $sql .= " WHERE elementtype = '".$this->db->escape($elementtype)."'";
+ $sql .= " AND name = '".$this->db->escape($attrname)."'";
//$sql.= " AND entity IN (0,".$conf->entity.")"; Do not test on entity here. We want to see if there is still on field remaning in other entities before deleting field in table
$resql = $this->db->query($sql);
if ($resql)
@@ -539,9 +539,9 @@ class ExtraFields
if (isset($attrname) && $attrname != '' && preg_match("/^\w[a-zA-Z0-9-_]*$/", $attrname))
{
$sql = "DELETE FROM ".MAIN_DB_PREFIX."extrafields";
- $sql .= " WHERE name = '".$attrname."'";
+ $sql .= " WHERE name = '".$this->db->escape($attrname)."'";
$sql .= " AND entity IN (0,".$conf->entity.')';
- $sql .= " AND elementtype = '".$elementtype."'";
+ $sql .= " AND elementtype = '".$this->db->escape($elementtype)."'";
dol_syslog(get_class($this)."::delete_label", LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -724,15 +724,15 @@ class ExtraFields
{
// We dont want on all entities, we delete all and current
$sql_del = "DELETE FROM ".MAIN_DB_PREFIX."extrafields";
- $sql_del .= " WHERE name = '".$attrname."'";
+ $sql_del .= " WHERE name = '".$this->db->escape($attrname)."'";
$sql_del .= " AND entity IN (0, ".($entity === '' ? $conf->entity : $entity).")";
- $sql_del .= " AND elementtype = '".$elementtype."'";
+ $sql_del .= " AND elementtype = '".$this->db->escape($elementtype)."'";
} else {
// We want on all entities ($entities = '0'), we delete on all only (we keep setup specific to each entity)
$sql_del = "DELETE FROM ".MAIN_DB_PREFIX."extrafields";
- $sql_del .= " WHERE name = '".$attrname."'";
+ $sql_del .= " WHERE name = '".$this->db->escape($attrname)."'";
$sql_del .= " AND entity = 0";
- $sql_del .= " AND elementtype = '".$elementtype."'";
+ $sql_del .= " AND elementtype = '".$this->db->escape($elementtype)."'";
}
$resql1 = $this->db->query($sql_del);
@@ -761,7 +761,7 @@ class ExtraFields
$sql .= " enabled,";
$sql .= " help";
$sql .= ") VALUES (";
- $sql .= "'".$attrname."',";
+ $sql .= "'".$this->db->escape($attrname)."',";
$sql .= " ".($entity === '' ? $conf->entity : $entity).",";
$sql .= " '".$this->db->escape($label)."',";
$sql .= " '".$this->db->escape($type)."',";
@@ -829,7 +829,7 @@ class ExtraFields
$sql = "SELECT rowid,name,label,type,size,elementtype,fieldunique,fieldrequired,param,pos,alwayseditable,perms,langs,list,printable,totalizable,fielddefault,fieldcomputed,entity,enabled,help";
$sql .= " FROM ".MAIN_DB_PREFIX."extrafields";
//$sql.= " WHERE entity IN (0,".$conf->entity.")"; // Filter is done later
- if ($elementtype) $sql .= " WHERE elementtype = '".$elementtype."'"; // Filed with object->table_element
+ if ($elementtype) $sql .= " WHERE elementtype = '".$this->db->escape($elementtype)."'"; // Filed with object->table_element
$sql .= " ORDER BY pos";
$resql = $this->db->query($sql);
diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php
index 7c5d350d21e..5acb5d7de85 100644
--- a/htdocs/core/class/html.form.class.php
+++ b/htdocs/core/class/html.form.class.php
@@ -2108,9 +2108,9 @@ class Form
$selectFields = " p.rowid, p.ref, p.label, p.description, p.barcode, p.fk_country, p.fk_product_type, p.price, p.price_ttc, p.price_base_type, p.tva_tx, p.duration, p.fk_price_expression";
if (count($warehouseStatusArray))
{
- $selectFieldsGrouped = ", sum(".$db->ifsql("e.statut IS NULL", "0", "ps.reel").") as stock"; // e.statut is null if there is no record in stock
+ $selectFieldsGrouped = ", sum(".$this->db->ifsql("e.statut IS NULL", "0", "ps.reel").") as stock"; // e.statut is null if there is no record in stock
} else {
- $selectFieldsGrouped = ", ".$db->ifsql("p.stock IS NULL", 0, "p.stock")." AS stock";
+ $selectFieldsGrouped = ", ".$this->db->ifsql("p.stock IS NULL", 0, "p.stock")." AS stock";
}
$sql = "SELECT ";
@@ -2163,7 +2163,7 @@ class Form
{
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product_stock as ps on ps.fk_product = p.rowid";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."entrepot as e on ps.fk_entrepot = e.rowid AND e.entity IN (".getEntity('stock').")";
- $sql .= ' AND e.statut IN ('.$this->db->escape(implode(',', $warehouseStatusArray)).')'; // Return line if product is inside the selected stock. If not, an empty line will be returned so we will count 0.
+ $sql .= ' AND e.statut IN ('.$this->db->sanitize($this->db->escape(implode(',', $warehouseStatusArray))).')'; // Return line if product is inside the selected stock. If not, an empty line will be returned so we will count 0.
}
// include search in supplier ref
@@ -2183,7 +2183,7 @@ class Form
// Multilang : we add translation
if (!empty($conf->global->MAIN_MULTILANGS))
{
- $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product_lang as pl ON pl.fk_product = p.rowid AND pl.lang='".$langs->getDefaultLang()."'";
+ $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product_lang as pl ON pl.fk_product = p.rowid AND pl.lang='".$this->db->escape($langs->getDefaultLang())."'";
}
if (!empty($conf->global->PRODUIT_ATTRIBUTES_HIDECHILD)) {
@@ -2226,19 +2226,19 @@ class Form
foreach ($scrit as $crit)
{
if ($i > 0) $sql .= " AND ";
- $sql .= "(p.ref LIKE '".$db->escape($prefix.$crit)."%' OR p.label LIKE '".$db->escape($prefix.$crit)."%'";
- if (!empty($conf->global->MAIN_MULTILANGS)) $sql .= " OR pl.label LIKE '".$db->escape($prefix.$crit)."%'";
+ $sql .= "(p.ref LIKE '".$this->db->escape($prefix.$crit)."%' OR p.label LIKE '".$this->db->escape($prefix.$crit)."%'";
+ if (!empty($conf->global->MAIN_MULTILANGS)) $sql .= " OR pl.label LIKE '".$this->db->escape($prefix.$crit)."%'";
if (!empty($conf->global->PRODUCT_AJAX_SEARCH_ON_DESCRIPTION))
{
- $sql .= " OR p.description LIKE '".$db->escape($prefix.$crit)."%'";
- if (!empty($conf->global->MAIN_MULTILANGS)) $sql .= " OR pl.description LIKE '".$db->escape($prefix.$crit)."%'";
+ $sql .= " OR p.description LIKE '".$this->db->escape($prefix.$crit)."%'";
+ if (!empty($conf->global->MAIN_MULTILANGS)) $sql .= " OR pl.description LIKE '".$this->db->escape($prefix.$crit)."%'";
}
- if (!empty($conf->global->MAIN_SEARCH_PRODUCT_BY_FOURN_REF)) $sql .= " OR pfp.ref_fourn LIKE '".$db->escape($prefix.$crit)."%'";
+ if (!empty($conf->global->MAIN_SEARCH_PRODUCT_BY_FOURN_REF)) $sql .= " OR pfp.ref_fourn LIKE '".$this->db->escape($prefix.$crit)."%'";
$sql .= ")";
$i++;
}
if (count($scrit) > 1) $sql .= ")";
- if (!empty($conf->barcode->enabled)) $sql .= " OR p.barcode LIKE '".$db->escape($prefix.$filterkey)."%'";
+ if (!empty($conf->barcode->enabled)) $sql .= " OR p.barcode LIKE '".$this->db->escape($prefix.$filterkey)."%'";
$sql .= ')';
}
if (count($warehouseStatusArray))
@@ -2253,10 +2253,10 @@ class Form
//ASC OR DESC order
($conf->global->PRODUCT_SORT_BY_CATEGORY == 1) ? $sql .= "ASC" : $sql .= "DESC";
} else {
- $sql .= $db->order("p.ref");
+ $sql .= $this->db->order("p.ref");
}
- $sql .= $db->plimit($limit, 0);
+ $sql .= $this->db->plimit($limit, 0);
// Build output string
dol_syslog(get_class($this)."::select_produits_list search product", LOG_DEBUG);
@@ -2503,9 +2503,9 @@ class Form
{
$sql = "SELECT price, price_ttc, price_base_type, tva_tx";
$sql .= " FROM ".MAIN_DB_PREFIX."product_price";
- $sql .= " WHERE fk_product='".$objp->rowid."'";
+ $sql .= " WHERE fk_product = ".((int) $objp->rowid);
$sql .= " AND entity IN (".getEntity('productprice').")";
- $sql .= " AND price_level=".$price_level;
+ $sql .= " AND price_level = ".((int) $price_level);
$sql .= " ORDER BY date_price DESC, rowid DESC"; // Warning DESC must be both on date_price and rowid.
$sql .= " LIMIT 1";
@@ -2770,7 +2770,7 @@ class Form
$sql .= ')';
}
$sql .= " ORDER BY pfp.ref_fourn DESC, pfp.quantity ASC";
- $sql .= $db->plimit($limit, 0);
+ $sql .= $this->db->plimit($limit, 0);
// Build output string
@@ -4913,10 +4913,10 @@ class Form
$sql = 'SELECT code FROM '.MAIN_DB_PREFIX.'multicurrency';
$sql .= " WHERE entity IN ('".getEntity('mutlicurrency')."')";
- $resql = $db->query($sql);
+ $resql = $this->db->query($sql);
if ($resql)
{
- while ($obj = $db->fetch_object($resql)) $TCurrency[$obj->code] = $obj->code;
+ while ($obj = $this->db->fetch_object($resql)) $TCurrency[$obj->code] = $obj->code;
}
$out = '';
@@ -5280,10 +5280,11 @@ class Form
* @param string $openinghours Specify hour start and hour end for the select ex 8,20
* @param int $stepminutes Specify step for minutes between 1 and 30
* @param string $labeladddateof Label to use for the $adddateof parameter.
+ * @param string $placeholder Placeholder
* @return string Html for selectDate
* @see form_date(), select_month(), select_year(), select_dayofweek()
*/
- public function selectDate($set_time = '', $prefix = 're', $h = 0, $m = 0, $empty = 0, $form_name = "", $d = 1, $addnowlink = 0, $disabled = 0, $fullday = '', $addplusone = '', $adddateof = '', $openinghours = '', $stepminutes = 1, $labeladddateof = '')
+ public function selectDate($set_time = '', $prefix = 're', $h = 0, $m = 0, $empty = 0, $form_name = "", $d = 1, $addnowlink = 0, $disabled = 0, $fullday = '', $addplusone = '', $adddateof = '', $openinghours = '', $stepminutes = 1, $labeladddateof = '', $placeholder = '')
{
global $conf, $langs;
@@ -5420,6 +5421,7 @@ class Form
$retstring .= ' ';
$retstring .= 'trans("FormatDateShortJavaInput").'\'); "'; // FormatDateShortInput for dol_print_date / FormatDateShortJavaInput that is same for javascript
$retstring .= '>';
@@ -5782,6 +5784,7 @@ class Form
/**
* Generic method to select a component from a combo list.
+ * Can use autocomplete with ajax after x key pressed or a full combo, depending on setup.
* This is the generic method that will replace all specific existing methods.
*
* @param string $objectdesc ObjectClass:PathToClass[:AddCreateButtonOrNot[:Filter]]
@@ -6460,11 +6463,12 @@ class Form
templateSelection: formatSelection /* For 4.0 */
});
});'."\n";
- } elseif ($addjscombo == 2)
+ } elseif ($addjscombo == 2 && ! defined('DISABLE_MULTISELECT'))
{
// Add other js lib
// TODO external lib multiselect/jquery.multi-select.js must have been loaded to use this multiselect plugin
// ...
+ $out .= 'console.log(\'addjscombo=2 for htmlname='.$htmlname.'\');';
$out .= '$(document).ready(function () {
$(\'#'.$htmlname.'\').multiSelect({
containerHTML: \' \',
@@ -7015,7 +7019,7 @@ class Form
// phpcs:enable
$sql = "SELECT rowid, label";
$sql .= " FROM ".MAIN_DB_PREFIX."export_model";
- $sql .= " WHERE type = '".$type."'";
+ $sql .= " WHERE type = '".$this->db->escape($type)."'";
$sql .= " ORDER BY rowid";
$result = $this->db->query($sql);
if ($result)
@@ -7157,7 +7161,7 @@ class Form
}
//if ($conf->browser->layout == 'phone') $ret.='';
- $ret .= ' ';
+ $ret .= ' ';
// For thirdparty, contact, user, member, the ref is the id, so we show something else
if ($object->element == 'societe')
@@ -7459,10 +7463,10 @@ class Form
if (!empty($conf->multicompany->enabled) && $conf->entity == 1 && $user->admin && !$user->entity)
{
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."entity as e ON e.rowid=ug.entity";
- if ($force_entity) $sql .= " WHERE ug.entity IN (0,".$force_entity.")";
+ if ($force_entity) $sql .= " WHERE ug.entity IN (0, ".$force_entity.")";
else $sql .= " WHERE ug.entity IS NOT NULL";
} else {
- $sql .= " WHERE ug.entity IN (0,".$conf->entity.")";
+ $sql .= " WHERE ug.entity IN (0, ".$conf->entity.")";
}
if (is_array($exclude) && $excludeGroups) $sql .= " AND ug.rowid NOT IN ('".$excludeGroups."')";
if (is_array($include) && $includeGroups) $sql .= " AND ug.rowid IN ('".$includeGroups."')";
diff --git a/htdocs/core/class/html.formaccounting.class.php b/htdocs/core/class/html.formaccounting.class.php
index 991a8f87006..f48e9b8eb74 100644
--- a/htdocs/core/class/html.formaccounting.class.php
+++ b/htdocs/core/class/html.formaccounting.class.php
@@ -174,15 +174,15 @@ class FormAccounting extends Form
$sql .= " WHERE c.active = 1";
$sql .= " AND c.category_type = 0";
$sql .= " AND c.fk_country = co.rowid";
- if (empty($allcountries)) $sql .= " AND co.code = '".$mysoc->country_code."'";
+ if (empty($allcountries)) $sql .= " AND co.code = '".$this->db->escape($mysoc->country_code)."'";
$sql .= " ORDER BY c.label ASC";
}
dol_syslog(get_class($this).'::'.__METHOD__, LOG_DEBUG);
- $resql = $db->query($sql);
+ $resql = $this->db->query($sql);
if ($resql)
{
- $num = $db->num_rows($resql);
+ $num = $this->db->num_rows($resql);
if ($num)
{
$out = ' | ';
diff --git a/htdocs/core/class/html.formintervention.class.php b/htdocs/core/class/html.formintervention.class.php
index 37073e8d3a5..dccbe50333a 100644
--- a/htdocs/core/class/html.formintervention.class.php
+++ b/htdocs/core/class/html.formintervention.class.php
@@ -80,18 +80,18 @@ class FormIntervention
}
dol_syslog(get_class($this)."::select_intervention", LOG_DEBUG);
- $resql = $db->query($sql);
+ $resql = $this->db->query($sql);
if ($resql)
{
$out .= '';
- $db->free($resql);
+ $this->db->free($resql);
return $out;
} else {
- dol_print_error($db);
+ dol_print_error($this->db);
return '';
}
}
diff --git a/htdocs/core/class/html.formmail.class.php b/htdocs/core/class/html.formmail.class.php
index f7acd09dbd1..fcd7199137c 100644
--- a/htdocs/core/class/html.formmail.class.php
+++ b/htdocs/core/class/html.formmail.class.php
@@ -1296,7 +1296,7 @@ class FormMail extends Form
$sql .= " WHERE type_template='".$this->db->escape($type_template)."'";
$sql .= " AND entity IN (".getEntity('c_email_templates').")";
$sql .= " AND (fk_user is NULL or fk_user = 0 or fk_user = ".$user->id.")";
- if (is_object($outputlangs)) $sql .= " AND (lang = '".$outputlangs->defaultlang."' OR lang IS NULL OR lang = '')";
+ if (is_object($outputlangs)) $sql .= " AND (lang = '".$this->db->escape($outputlangs->defaultlang)."' OR lang IS NULL OR lang = '')";
$sql .= $this->db->order("lang,label", "ASC");
//print $sql;
@@ -1330,7 +1330,7 @@ class FormMail extends Form
$sql .= " AND entity IN (".getEntity('c_email_templates').")";
$sql .= " AND (private = 0 OR fk_user = ".$user->id.")"; // See all public templates or templates I own.
if ($active >= 0) $sql .= " AND active = ".$active;
- //if (is_object($outputlangs)) $sql.= " AND (lang = '".$outputlangs->defaultlang."' OR lang IS NULL OR lang = '')"; // Return all languages
+ //if (is_object($outputlangs)) $sql.= " AND (lang = '".$this->db->escape($outputlangs->defaultlang)."' OR lang IS NULL OR lang = '')"; // Return all languages
$sql .= $this->db->order("position,lang,label", "ASC");
//print $sql;
diff --git a/htdocs/core/class/html.formmargin.class.php b/htdocs/core/class/html.formmargin.class.php
index 5e18bb20782..cf159819764 100644
--- a/htdocs/core/class/html.formmargin.class.php
+++ b/htdocs/core/class/html.formmargin.class.php
@@ -87,7 +87,7 @@ class FormMargin
if (empty($line->pa_ht) && isset($line->fk_fournprice) && !$force_price)
{
require_once DOL_DOCUMENT_ROOT.'/fourn/class/fournisseur.product.class.php';
- $product = new ProductFournisseur($db);
+ $product = new ProductFournisseur($this->db);
if ($product->fetch_product_fournisseur_price($line->fk_fournprice))
$line->pa_ht = $product->fourn_unitprice * (1 - $product->fourn_remise_percent / 100);
}
@@ -204,7 +204,7 @@ class FormMargin
if (!empty($conf->global->MARGIN_ADD_SHOWHIDE_BUTTON)) // TODO Warning this feature rely on an external js file that may be removed. Using native js function document.cookie should be better
{
print $langs->trans('ShowMarginInfos').' : ';
- $hidemargininfos = $_COOKIE['DOLUSER_MARGININFO_HIDE_SHOW'];
+ $hidemargininfos = preg_replace('/[^a-zA-Z0-9_\-]/', '', $_COOKIE['DOLUSER_MARGININFO_HIDE_SHOW']); // Clean cookie
print ''.img_picto($langs->trans("Disabled"), 'switch_off').'';
print ''.img_picto($langs->trans("Enabled"), 'switch_on').'';
diff --git a/htdocs/core/class/html.formother.class.php b/htdocs/core/class/html.formother.class.php
index f69ef6703e0..96c73deff7a 100644
--- a/htdocs/core/class/html.formother.class.php
+++ b/htdocs/core/class/html.formother.class.php
@@ -256,7 +256,7 @@ class FormOther
$sql = "SELECT r.taux, r.revenuestamp_type";
$sql .= " FROM ".MAIN_DB_PREFIX."c_revenuestamp as r,".MAIN_DB_PREFIX."c_country as c";
$sql .= " WHERE r.active = 1 AND r.fk_pays = c.rowid";
- $sql .= " AND c.code = '".$country_code."'";
+ $sql .= " AND c.code = '".$this->db->escape($country_code)."'";
dol_syslog(get_class($this).'::select_revenue_stamp', LOG_DEBUG);
$resql = $this->db->query($sql);
@@ -1141,7 +1141,7 @@ class FormOther
// Load translation files required by the page
$langs->loadLangs(array("boxes", "projects"));
- $emptybox = new ModeleBoxes($db);
+ $emptybox = new ModeleBoxes($db);
$boxlista .= "\n\n";
diff --git a/htdocs/core/class/html.formsocialcontrib.class.php b/htdocs/core/class/html.formsocialcontrib.class.php
index c6d28a7b70f..b5adfdba82f 100644
--- a/htdocs/core/class/html.formsocialcontrib.class.php
+++ b/htdocs/core/class/html.formsocialcontrib.class.php
@@ -83,15 +83,15 @@ class FormSocialContrib
$sql = "SELECT c.id, c.libelle as type";
$sql .= " FROM ".MAIN_DB_PREFIX."c_chargesociales as c, ".MAIN_DB_PREFIX."c_country as co";
$sql .= " WHERE c.active = 1 AND c.fk_pays = co.rowid";
- $sql .= " AND co.code = '".$mysoc->country_code."'";
+ $sql .= " AND co.code = '".$this->db->escape($mysoc->country_code)."'";
$sql .= " ORDER BY c.libelle ASC";
}
dol_syslog("Form::select_type_socialcontrib", LOG_DEBUG);
- $resql = $db->query($sql);
+ $resql = $this->db->query($sql);
if ($resql)
{
- $num = $db->num_rows($resql);
+ $num = $this->db->num_rows($resql);
if ($num)
{
print '|
';
-$NBMAX = 3;
-$max = 3;
+$NBMAX = $conf->global->MAIN_SIZE_SHORTLIST_LIMIT;
+$max = $conf->global->MAIN_SIZE_SHORTLIST_LIMIT;
// Last modified job position
if (!empty($conf->recruitment->enabled) && $user->rights->recruitment->recruitmentjobposition->read)
diff --git a/htdocs/recruitment/recruitmentjobposition_list.php b/htdocs/recruitment/recruitmentjobposition_list.php
index a0194feb647..24c98a3fbb9 100644
--- a/htdocs/recruitment/recruitmentjobposition_list.php
+++ b/htdocs/recruitment/recruitmentjobposition_list.php
@@ -83,7 +83,7 @@ $id = GETPOST('id', 'int');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page < 0 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha')) { $page = 0; } // If $page is not defined, or '' or -1 or if we click on clear filters
diff --git a/htdocs/resource/document.php b/htdocs/resource/document.php
index fa7fb07dbb0..0e1e6ba5cc1 100644
--- a/htdocs/resource/document.php
+++ b/htdocs/resource/document.php
@@ -50,7 +50,7 @@ $result = restrictedArea($user, 'resource', $id, 'resource');
// Get parameters
$limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
diff --git a/htdocs/resource/list.php b/htdocs/resource/list.php
index 4dca64b47a6..e2d10ffceef 100644
--- a/htdocs/resource/list.php
+++ b/htdocs/resource/list.php
@@ -39,7 +39,7 @@ $element_id = GETPOST('element_id', 'int');
$resource_id = GETPOST('resource_id', 'int');
$sortorder = GETPOST('sortorder', 'alpha');
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
// Initialize context for list
$contextpage = GETPOST('contextpage', 'aZ') ?GETPOST('contextpage', 'aZ') : 'resourcelist';
diff --git a/htdocs/salaries/class/salariesstats.class.php b/htdocs/salaries/class/salariesstats.class.php
index 3601e14bcdc..f20bde818a1 100644
--- a/htdocs/salaries/class/salariesstats.class.php
+++ b/htdocs/salaries/class/salariesstats.class.php
@@ -119,7 +119,7 @@ class SalariesStats extends Stats
{
$sql = "SELECT date_format(datep,'%m') as dm, sum(".$this->field.")";
$sql .= " FROM ".$this->from;
- $sql .= " WHERE date_format(datep,'%Y') = '".$year."'";
+ $sql .= " WHERE date_format(datep,'%Y') = '".$this->db->escape($year)."'";
$sql .= " AND ".$this->where;
$sql .= " GROUP BY dm";
$sql .= $this->db->order('dm', 'DESC');
@@ -140,7 +140,7 @@ class SalariesStats extends Stats
{
$sql = "SELECT date_format(datep,'%m') as dm, avg(".$this->field.")";
$sql .= " FROM ".$this->from;
- $sql .= " WHERE date_format(datep,'%Y') = '".$year."'";
+ $sql .= " WHERE date_format(datep,'%Y') = '".$this->db->escape($year)."'";
$sql .= " AND ".$this->where;
$sql .= " GROUP BY dm";
$sql .= $this->db->order('dm', 'DESC');
diff --git a/htdocs/salaries/document.php b/htdocs/salaries/document.php
index 06d572012bb..403a5b3af3b 100644
--- a/htdocs/salaries/document.php
+++ b/htdocs/salaries/document.php
@@ -51,7 +51,7 @@ $result = restrictedArea($user, 'salaries', '', '', '');
// Get parameters
$limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
diff --git a/htdocs/salaries/list.php b/htdocs/salaries/list.php
index 051f18c62cb..9341599ba70 100644
--- a/htdocs/salaries/list.php
+++ b/htdocs/salaries/list.php
@@ -184,12 +184,10 @@ if ($result)
// Date
print '';
print ' ';
// Type
diff --git a/htdocs/societe/admin/societe.php b/htdocs/societe/admin/societe.php
index 69f5e373725..a66f17ca915 100644
--- a/htdocs/societe/admin/societe.php
+++ b/htdocs/societe/admin/societe.php
@@ -119,7 +119,7 @@ if ($action == 'set')
$type = 'company';
$sql = "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity, libelle, description)";
- $sql .= " VALUES ('".$db->escape($value)."','".$type."',".$conf->entity.", ";
+ $sql .= " VALUES ('".$db->escape($value)."','".$db->escape($type)."',".$conf->entity.", ";
$sql .= ($label ? "'".$db->escape($label)."'" : 'null').", ";
$sql .= (!empty($scandir) ? "'".$db->escape($scandir)."'" : "null");
$sql .= ")";
@@ -133,7 +133,7 @@ if ($action == 'del')
{
$type = 'company';
$sql = "DELETE FROM ".MAIN_DB_PREFIX."document_model";
- $sql .= " WHERE nom='".$db->escape($value)."' AND type='".$type."' AND entity=".$conf->entity;
+ $sql .= " WHERE nom='".$db->escape($value)."' AND type='".$db->escape($type)."' AND entity=".$conf->entity;
$resql = $db->query($sql);
if (!$resql) dol_print_error($db);
}
@@ -152,13 +152,13 @@ if ($action == 'setdoc')
$type = 'company';
$sql_del = "DELETE FROM ".MAIN_DB_PREFIX."document_model";
$sql_del .= " WHERE nom = '".$db->escape(GETPOST('value', 'alpha'))."'";
- $sql_del .= " AND type = '".$type."'";
+ $sql_del .= " AND type = '".$db->escape($type)."'";
$sql_del .= " AND entity = ".$conf->entity;
dol_syslog("societe.php ".$sql);
$result1 = $db->query($sql_del);
$sql = "INSERT INTO ".MAIN_DB_PREFIX."document_model (nom, type, entity, libelle, description)";
- $sql .= " VALUES ('".$db->escape($value)."', '".$type."', ".$conf->entity.", ";
+ $sql .= " VALUES ('".$db->escape($value)."', '".$db->escape($type)."', ".$conf->entity.", ";
$sql .= ($label ? "'".$db->escape($label)."'" : 'null').", ";
$sql .= (!empty($scandir) ? "'".$db->escape($scandir)."'" : "null");
$sql .= ")";
diff --git a/htdocs/societe/card.php b/htdocs/societe/card.php
index b19c3bc814a..42de4d74b39 100644
--- a/htdocs/societe/card.php
+++ b/htdocs/societe/card.php
@@ -1181,12 +1181,12 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action))
print ''.$form->editfieldkey('ThirdPartyName', 'name', '', $object, 0).'';
}
print 'global->SOCIETE_USEPREFIX) ? ' colspan="3"' : '').'>';
- print '';
+ print '';
print $form->widgetForTranslation("name", $object, $permissiontoadd, 'string', 'alpahnohtml', 'minwidth300');
print '';
if (!empty($conf->global->SOCIETE_USEPREFIX)) // Old not used prefix field
{
- print ''.$langs->trans('Prefix').' '.$langs->trans('Prefix').'
';
- print $langs->trans('From').' ';
- print $form->selectDate($search_date_start ? $search_date_start : -1, 'search_date_start', 0, 0, 1);
+ print $form->selectDate($search_date_start ? $search_date_start : -1, 'search_date_start', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From'));
print '
';
print '';
- print $langs->trans('to').' ';
- print $form->selectDate($search_date_end ? $search_date_end : -1, 'search_date_end', 0, 0, 1);
+ print $form->selectDate($search_date_end ? $search_date_end : -1, 'search_date_end', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('to'));
print '
';
print '
';
print '';
} else {
- print '';
- if (!$conf->global->TAKEPOS_HIDE_PRODUCT_IMAGES) print '';
diff --git a/htdocs/user/card.php b/htdocs/user/card.php
index 6ca1e7c9bdc..96b9d55af6a 100644
--- a/htdocs/user/card.php
+++ b/htdocs/user/card.php
@@ -61,6 +61,12 @@ $group = GETPOST("group", "int", 3);
$cancel = GETPOST('cancel', 'alpha');
$contextpage = GETPOST('contextpage', 'aZ') ?GETPOST('contextpage', 'aZ') : 'useracard'; // To manage different context of search
+$dateemployment = dol_mktime(0, 0, 0, GETPOST('dateemploymentmonth', 'int'), GETPOST('dateemploymentday', 'int'), GETPOST('dateemploymentyear', 'int'));
+$dateemploymentend = dol_mktime(0, 0, 0, GETPOST('dateemploymentendmonth', 'int'), GETPOST('dateemploymentendday', 'int'), GETPOST('dateemploymentendyear', 'int'));
+$datestartvalidity = dol_mktime(0, 0, 0, GETPOST('datestartvaliditymonth', 'int'), GETPOST('datestartvalidityday', 'int'), GETPOST('datestartvalidityyear', 'int'));
+$dateendvalidity = dol_mktime(0, 0, 0, GETPOST('dateendvaliditymonth', 'int'), GETPOST('dateendvalidityday', 'int'), GETPOST('dateendvalidityyear', 'int'));
+$dateofbirth = dol_mktime(0, 0, 0, GETPOST('dateofbirthmonth', 'int'), GETPOST('dateofbirthday', 'int'), GETPOST('dateofbirthyear', 'int'));
+
// Define value to know what current user can do on users
$canadduser = (!empty($user->admin) || $user->rights->user->user->creer);
$canreaduser = (!empty($user->admin) || $user->rights->user->user->lire);
@@ -202,8 +208,6 @@ if (empty($reshook)) {
$object->login = GETPOST("login", 'alphanohtml');
$object->api_key = GETPOST("api_key", 'alphanohtml');
$object->gender = GETPOST("gender", 'aZ09');
- $birth = dol_mktime(0, 0, 0, GETPOST('birthmonth', 'int'), GETPOST('birthday', 'int'), GETPOST('birthyear', 'int'));
- $object->birth = $birth;
$object->admin = GETPOST("admin", 'int');
$object->address = GETPOST('address', 'alphanohtml');
$object->zip = GETPOST('zipcode', 'alphanohtml');
@@ -226,7 +230,7 @@ if (empty($reshook)) {
}
$object->email = preg_replace('/\s+/', '', GETPOST("email", 'alphanohtml'));
- $object->job = GETPOST("job", 'nohtml');
+ $object->job = GETPOST("job", 'alphanohtml');
$object->signature = GETPOST("signature", 'restricthtml');
$object->accountancy_code = GETPOST("accountancy_code", 'alphanohtml');
$object->note = GETPOST("note", 'restricthtml');
@@ -247,11 +251,12 @@ if (empty($reshook)) {
$object->weeklyhours = GETPOST("weeklyhours", 'alphanohtml') != '' ? GETPOST("weeklyhours", 'alphanohtml') : '';
$object->color = GETPOST("color", 'alphanohtml') != '' ? GETPOST("color", 'alphanohtml') : '';
- $dateemployment = dol_mktime(0, 0, 0, GETPOST('dateemploymentmonth', 'int'), GETPOST('dateemploymentday', 'int'), GETPOST('dateemploymentyear', 'int'));
- $object->dateemployment = $dateemployment;
- $dateemploymentend = dol_mktime(0, 0, 0, GETPOST('dateemploymentendmonth', 'int'), GETPOST('dateemploymentendday', 'int'), GETPOST('dateemploymentendyear', 'int'));
+ $object->dateemployment = $dateemployment;
$object->dateemploymentend = $dateemploymentend;
+ $object->datestartvalidity = $datestartvalidity;
+ $object->dateendvalidity = $dateendvalidity;
+ $object->birth = $dateofbirth;
$object->fk_warehouse = GETPOST('fk_warehouse', 'int');
@@ -364,8 +369,6 @@ if (empty($reshook)) {
$object->firstname = GETPOST("firstname", 'alphanohtml');
$object->login = GETPOST("login", 'alphanohtml');
$object->gender = GETPOST("gender", 'aZ09');
- $birth = dol_mktime(0, 0, 0, GETPOST('birthmonth', 'int'), GETPOST('birthday', 'int'), GETPOST('birthyear', 'int'));
- $object->birth = $birth;
$object->pass = GETPOST("password", 'none');
$object->api_key = (GETPOST("api_key", 'alphanohtml')) ? GETPOST("api_key", 'alphanohtml') : $object->api_key;
if (!empty($user->admin)) $object->admin = GETPOST("admin", "int"); // admin flag can only be set/unset by an admin user. A test is also done later when forging sql request
@@ -388,7 +391,7 @@ if (empty($reshook)) {
}
}
$object->email = preg_replace('/\s+/', '', GETPOST("email", 'alphanohtml'));
- $object->job = GETPOST("job", 'nohtml');
+ $object->job = GETPOST("job", 'alphanohtml');
$object->signature = GETPOST("signature", 'restricthtml');
$object->accountancy_code = GETPOST("accountancy_code", 'alphanohtml');
$object->openid = GETPOST("openid", 'alphanohtml');
@@ -409,10 +412,11 @@ if (empty($reshook)) {
$object->weeklyhours = price2num($object->weeklyhours);
$object->color = GETPOST("color", 'alphanohtml') != '' ? GETPOST("color", 'alphanohtml') : '';
- $dateemployment = dol_mktime(0, 0, 0, GETPOST('dateemploymentmonth', 'int'), GETPOST('dateemploymentday', 'int'), GETPOST('dateemploymentyear', 'int'));
$object->dateemployment = $dateemployment;
- $dateemploymentend = dol_mktime(0, 0, 0, GETPOST('dateemploymentendmonth', 'int'), GETPOST('dateemploymentendday', 'int'), GETPOST('dateemploymentendyear', 'int'));
$object->dateemploymentend = $dateemploymentend;
+ $object->datestartvalidity = $datestartvalidity;
+ $object->dateendvalidity = $dateendvalidity;
+ $object->birth = $dateofbirth;
if (!empty($conf->stock->enabled))
{
@@ -1183,7 +1187,7 @@ if ($action == 'create' || $action == 'adduserldap')
// Position/Job
print ''.$langs->trans("PostOrFunction").' ';
print '';
- print '';
+ print '';
print ' '.$langs->trans("DateEmployment").' ';
print '';
- print $form->selectDate(GETPOST('dateemployment'), 'dateemployment', 0, 0, 1, 'formdateemployment', 1, 0);
+ print $form->selectDate($dateemployment, 'dateemployment', 0, 0, 1, 'formdateemployment', 1, 1);
+
+ print ' - ';
+
+ print $form->selectDate($dateemploymentend, 'dateemploymentend', 0, 0, 1, 'formdateemploymentend', 1, 0);
print ' ';
print "'.$langs->trans("DateEmploymentEnd").' ';
+ // Date validity
+ print ''.$langs->trans("RangeOfLoginValidity").' ';
print '';
- print $form->selectDate(GETPOST('dateemploymentend'), 'dateemploymentend', 0, 0, 1, 'formdateemploymentend', 1, 0);
+ print $form->selectDate($datestartvalidity, 'datestartvalidity', 0, 0, 1, 'formdatestartvalidity', 1, 1);
+
+ print ' - ';
+
+ print $form->selectDate($dateendvalidity, 'dateendvalidity', 0, 0, 1, 'formdateendvalidity', 1, 0);
print ' ';
print "'.$langs->trans("DateToBirth").' ';
+ print ''.$langs->trans("DateOfBirth").' ';
print '';
- print $form->selectDate(GETPOST('birth'), 'birth', 0, 0, 1, 'createuser', 1, 0);
+ print $form->selectDate($dateofbirth, 'dateofbirth', 0, 0, 1, 'createuser', 1, 0);
print ' ';
print "'.$langs->trans("PostOrFunction").' ';
- print ''.$object->job.' ';
+ print ''.dol_escape_htmltag($object->job).' ';
print ''.$langs->trans("DateOfEmployment").' ';
print '';
if ($object->dateemployment) {
- print ''.$langs->trans("FromDate ").'';
+ print ''.$langs->trans("FromDate").' ';
print dol_print_date($object->dateemployment, 'day');
}
- //print ' ';
- //print "'.$langs->trans("DateEmploymentEnd").' ';
- //print '';
if ($object->dateemploymentend) {
- print ' - '.$langs->trans("To ").'';
+ print ' - '.$langs->trans("To").' ';
print dol_print_date($object->dateemploymentend, 'day');
}
print ' ';
print "'.$langs->trans("RangeOfLoginValidity").' ';
+ print '';
+ if ($object->datestartvalidity) {
+ print ''.$langs->trans("FromDate").' ';
+ print dol_print_date($object->datestartvalidity, 'day');
+ }
+ if ($object->dateendvalidity) {
+ print ' - '.$langs->trans("To").' ';
+ print dol_print_date($object->dateendvalidity, 'day');
+ }
+ print ' ';
+ print "'.$langs->trans("DateToBirth").' ';
+ print ''.$langs->trans("DateOfBirth").' ';
print '';
print dol_print_date($object->birth, 'day');
print ' ';
@@ -2606,10 +2626,10 @@ if ($action == 'create' || $action == 'adduserldap')
print '';
if ($caneditfield)
{
- print '';
+ print '';
} else {
- print '';
- print $object->job;
+ print '';
+ print dol_escape_htmltag($object->job);
}
print ' ';
if ($caneditfield)
{
- print $form->selectDate(GETPOST('dateemployment') ?GETPOST('dateemployment') : $object->dateemployment, 'dateemployment', 0, 0, 1, 'formdateemployment', 1, 0);
+ print $form->selectDate($dateemployment ? $dateemployment : $object->dateemployment, 'dateemployment', 0, 0, 1, 'formdateemployment', 1, 1);
} else {
print dol_print_date($object->dateemployment, 'day');
}
- print ' ';
- print "\n";
- // Date employmentEnd
- print ''.$langs->trans("DateEmploymentEnd").' ';
- print '';
+ if ($dateemployment && $dateemploymentend) print ' - ';
+
if ($caneditfield)
{
- print $form->selectDate(GETPOST('dateemploymentend') ?GETPOST('dateemploymentend') : $object->dateemploymentend, 'dateemploymentend', 0, 0, 1, 'formdateemploymentend', 1, 0);
+ print $form->selectDate($dateemploymentend ? $dateemploymentend : $object->dateemploymentend, 'dateemploymentend', 0, 0, 1, 'formdateemploymentend', 1, 0);
} else {
print dol_print_date($object->dateemploymentend, 'day');
}
@@ -2692,12 +2709,33 @@ if ($action == 'create' || $action == 'adduserldap')
print " '.$langs->trans("DateToBirth").' ';
+ // Date login validity
+ print ''.$langs->trans("RangeOfLoginValidity").' ';
print '';
if ($caneditfield)
{
- echo $form->selectDate(GETPOST('birth') ?GETPOST('birth') : $object->birth, 'birth', 0, 0, 1, 'updateuser', 1, 0);
+ print $form->selectDate($datestartvalidity ? $datestartvalidity : $object->datestartvalidity, 'datestartvalidity', 0, 0, 1, 'formdatestartvalidity', 1, 1);
+ } else {
+ print dol_print_date($object->datestartvalidity, 'day');
+ }
+
+ if ($datestartvalidity && $dateendvalidity) print ' - ';
+
+ if ($caneditfield)
+ {
+ print $form->selectDate($dateendvalidity ? $datendevalidity : $object->dateendvalidity, 'dateendvalidity', 0, 0, 1, 'formdateendvalidity', 1, 0);
+ } else {
+ print dol_print_date($object->dateendvalidity, 'day');
+ }
+ print ' ';
+ print "'.$langs->trans("DateOfBirth").' ';
+ print '';
+ if ($caneditfield) {
+ echo $form->selectDate($dateofbirth ? $dateofbirth : $object->birth, 'dateofbirth', 0, 0, 1, 'updateuser', 1, 0);
} else {
print dol_print_date($object->birth, 'day');
}
diff --git a/htdocs/user/class/api_users.class.php b/htdocs/user/class/api_users.class.php
index cab2b56f5d9..5245ff0b961 100644
--- a/htdocs/user/class/api_users.class.php
+++ b/htdocs/user/class/api_users.class.php
@@ -90,7 +90,7 @@ class Users extends DolibarrApi
// Select products of given category
if ($category > 0) {
- $sql .= " AND c.fk_categorie = ".$db->escape($category);
+ $sql .= " AND c.fk_categorie = ".$this->db->escape($category);
$sql .= " AND c.fk_user = t.rowid ";
}
@@ -105,7 +105,7 @@ class Users extends DolibarrApi
$sql .= " AND (".preg_replace_callback('/'.$regexstring.'/', 'DolibarrApi::_forge_criteria_callback', $sqlfilters).")";
}
- $sql .= $db->order($sortfield, $sortorder);
+ $sql .= $this->db->order($sortfield, $sortorder);
if ($limit) {
if ($page < 0)
{
@@ -113,27 +113,27 @@ class Users extends DolibarrApi
}
$offset = $limit * $page;
- $sql .= $db->plimit($limit + 1, $offset);
+ $sql .= $this->db->plimit($limit + 1, $offset);
}
- $result = $db->query($sql);
+ $result = $this->db->query($sql);
if ($result)
{
$i = 0;
- $num = $db->num_rows($result);
+ $num = $this->db->num_rows($result);
$min = min($num, ($limit <= 0 ? $num : $limit));
while ($i < $min)
{
- $obj = $db->fetch_object($result);
- $user_static = new User($db);
+ $obj = $this->db->fetch_object($result);
+ $user_static = new User($this->db);
if ($user_static->fetch($obj->rowid)) {
$obj_ret[] = $this->_cleanObjectDatas($user_static);
}
$i++;
}
} else {
- throw new RestException(503, 'Error when retrieve User list : '.$db->lasterror());
+ throw new RestException(503, 'Error when retrieve User list : '.$this->db->lasterror());
}
if (!count($obj_ret)) {
throw new RestException(404, 'No User found');
@@ -490,7 +490,7 @@ class Users extends DolibarrApi
$sql .= " AND (".preg_replace_callback('/'.$regexstring.'/', 'DolibarrApi::_forge_criteria_callback', $sqlfilters).")";
}
- $sql .= $db->order($sortfield, $sortorder);
+ $sql .= $this->db->order($sortfield, $sortorder);
if ($limit) {
if ($page < 0)
{
@@ -498,19 +498,19 @@ class Users extends DolibarrApi
}
$offset = $limit * $page;
- $sql .= $db->plimit($limit + 1, $offset);
+ $sql .= $this->db->plimit($limit + 1, $offset);
}
- $result = $db->query($sql);
+ $result = $this->db->query($sql);
if ($result)
{
$i = 0;
- $num = $db->num_rows($result);
+ $num = $this->db->num_rows($result);
$min = min($num, ($limit <= 0 ? $num : $limit));
while ($i < $min)
{
- $obj = $db->fetch_object($result);
+ $obj = $this->db->fetch_object($result);
$group_static = new UserGroup($this->db);
if ($group_static->fetch($obj->rowid)) {
$obj_ret[] = $this->_cleanObjectDatas($group_static);
@@ -518,7 +518,7 @@ class Users extends DolibarrApi
$i++;
}
} else {
- throw new RestException(503, 'Error when retrieve Group list : '.$db->lasterror());
+ throw new RestException(503, 'Error when retrieve Group list : '.$this->db->lasterror());
}
if (!count($obj_ret)) {
throw new RestException(404, 'No Group found');
diff --git a/htdocs/user/class/user.class.php b/htdocs/user/class/user.class.php
index 53a7abe5dac..786af8c81d1 100644
--- a/htdocs/user/class/user.class.php
+++ b/htdocs/user/class/user.class.php
@@ -154,7 +154,7 @@ class User extends CommonObject
public $datelastlogin;
public $datepreviouslogin;
public $datestartvalidity;
- public $dateedvalidity;
+ public $dateendvalidity;
public $photo;
public $lang;
@@ -1038,6 +1038,14 @@ class User extends CommonObject
$this->error = $this->db->lasterror();
}
+ // Remove params
+ $sql = "DELETE FROM ".MAIN_DB_PREFIX."user_param WHERE fk_user = ".$this->id;
+ if (!$error && !$this->db->query($sql))
+ {
+ $error++;
+ $this->error = $this->db->lasterror();
+ }
+
// If contact, remove link
if ($this->contact_id > 0)
{
@@ -1459,7 +1467,6 @@ class User extends CommonObject
$this->employee = $this->employee ? $this->employee : 0;
$this->login = trim($this->login);
$this->gender = trim($this->gender);
- $this->birth = trim($this->birth);
$this->pass = trim($this->pass);
$this->api_key = trim($this->api_key);
$this->address = $this->address ?trim($this->address) : trim($this->address);
@@ -1487,6 +1494,9 @@ class User extends CommonObject
$this->color = empty($this->color) ? '' : $this->color;
$this->dateemployment = empty($this->dateemployment) ? '' : $this->dateemployment;
$this->dateemploymentend = empty($this->dateemploymentend) ? '' : $this->dateemploymentend;
+ $this->datestartvalidity = empty($this->datestartvalidity) ? '' : $this->datestartvalidity;
+ $this->dateendvalidity = empty($this->dateendvalidity) ? '' : $this->dateendvalidity;
+ $this->birth = trim($this->birth);
$this->fk_warehouse = trim(empty($this->fk_warehouse) ? '' : $this->fk_warehouse);
// Check parameters
@@ -1499,7 +1509,7 @@ class User extends CommonObject
if (empty($this->login))
{
$langs->load("errors");
- $this->error = $langs->trans("ErrorFieldRequired", $this->login);
+ $this->error = $langs->trans("ErrorFieldRequired", 'Login');
return -1;
}
@@ -1533,6 +1543,8 @@ class User extends CommonObject
$sql .= ", color = '".$this->db->escape($this->color)."'";
$sql .= ", dateemployment=".(strval($this->dateemployment) != '' ? "'".$this->db->idate($this->dateemployment)."'" : 'null');
$sql .= ", dateemploymentend=".(strval($this->dateemploymentend) != '' ? "'".$this->db->idate($this->dateemploymentend)."'" : 'null');
+ $sql .= ", datestartvalidity=".(strval($this->datestartvalidity) != '' ? "'".$this->db->idate($this->datestartvalidity)."'" : 'null');
+ $sql .= ", dateendvalidity=".(strval($this->dateendvalidity) != '' ? "'".$this->db->idate($this->dateendvalidity)."'" : 'null');
$sql .= ", note = '".$this->db->escape($this->note_private)."'";
$sql .= ", note_public = '".$this->db->escape($this->note_public)."'";
$sql .= ", photo = ".($this->photo ? "'".$this->db->escape($this->photo)."'" : "null");
@@ -1550,7 +1562,6 @@ class User extends CommonObject
$sql .= ", default_c_exp_tax_cat = ".($this->default_c_exp_tax_cat > 0 ? $this->default_c_exp_tax_cat : 'null');
$sql .= ", fk_warehouse = ".($this->fk_warehouse ? "'".$this->db->escape($this->fk_warehouse)."'" : "null");
$sql .= ", lang = ".($this->lang ? "'".$this->db->escape($this->lang)."'" : "null");
-
$sql .= " WHERE rowid = ".$this->id;
dol_syslog(get_class($this)."::update", LOG_DEBUG);
@@ -3133,7 +3144,7 @@ class User extends CommonObject
$sql = "SELECT rowid, email, user_mobile, civility, lastname, firstname";
$sql .= " FROM ".MAIN_DB_PREFIX."user";
- $sql .= " WHERE rowid = '".$rowid."'";
+ $sql .= " WHERE rowid = ".((int) $rowid);
$resql = $this->db->query($sql);
if ($resql)
diff --git a/htdocs/user/class/userbankaccount.class.php b/htdocs/user/class/userbankaccount.class.php
index 325753fc773..25c751b4cb9 100644
--- a/htdocs/user/class/userbankaccount.class.php
+++ b/htdocs/user/class/userbankaccount.class.php
@@ -170,7 +170,7 @@ class UserBankAccount extends Account
$sql .= " FROM ".MAIN_DB_PREFIX."user_rib";
if ($id) $sql .= " WHERE rowid = ".$id;
if ($ref) $sql .= " WHERE label = '".$this->db->escape($ref)."'";
- if ($userid) $sql .= " WHERE fk_user = '".$userid."'";
+ if ($userid) $sql .= " WHERE fk_user = ".((int) $userid);
$resql = $this->db->query($sql);
if ($resql)
diff --git a/htdocs/user/group/list.php b/htdocs/user/group/list.php
index 336fbc19727..0b6cdf23d47 100644
--- a/htdocs/user/group/list.php
+++ b/htdocs/user/group/list.php
@@ -57,7 +57,7 @@ if (!empty($conf->global->MAIN_USE_ADVANCED_PERMS))
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; }
diff --git a/htdocs/user/list.php b/htdocs/user/list.php
index 7e8406e84bf..406401bdf38 100644
--- a/htdocs/user/list.php
+++ b/htdocs/user/list.php
@@ -51,7 +51,7 @@ $mode = GETPOST("mode", 'alpha');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1) { $page = 0; }
@@ -224,21 +224,21 @@ if ($reshook > 0) {
}
if ($socid > 0) $sql .= " AND u.fk_soc = ".$socid;
//if ($search_user != '') $sql.=natural_search(array('u.login', 'u.lastname', 'u.firstname'), $search_user);
-if ($search_supervisor > 0) $sql .= " AND u.fk_user IN (".$db->escape($search_supervisor).")";
+if ($search_supervisor > 0) $sql .= " AND u.fk_user IN (".$db->sanitize($db->escape($search_supervisor)).")";
if ($search_thirdparty != '') $sql .= natural_search(array('s.nom'), $search_thirdparty);
if ($search_login != '') $sql .= natural_search("u.login", $search_login);
if ($search_lastname != '') $sql .= natural_search("u.lastname", $search_lastname);
if ($search_firstname != '') $sql .= natural_search("u.firstname", $search_firstname);
-if ($search_gender != '' && $search_gender != '-1') $sql .= " AND u.gender = '".$search_gender."'";
+if ($search_gender != '' && $search_gender != '-1') $sql .= natural_search("u.gender", $search_gender);
if (is_numeric($search_employee) && $search_employee >= 0) {
$sql .= ' AND u.employee = '.(int) $search_employee;
}
if ($search_accountancy_code != '') $sql .= natural_search("u.accountancy_code", $search_accountancy_code);
if ($search_email != '') $sql .= natural_search("u.email", $search_email);
if ($search_api_key != '') $sql .= natural_search("u.api_key", $search_api_key);
-if ($search_statut != '' && $search_statut >= 0) $sql .= " AND u.statut IN (".$db->escape($search_statut).")";
+if ($search_statut != '' && $search_statut >= 0) $sql .= " AND u.statut IN (".$db->sanitize($db->escape($search_statut)).")";
if ($sall) $sql .= natural_search(array_keys($fieldstosearchall), $sall);
-if ($catid > 0) $sql .= " AND cu.fk_categorie = ".$catid;
+if ($catid > 0) $sql .= " AND cu.fk_categorie = ".((int) $catid);
if ($catid == -2) $sql .= " AND cu.fk_categorie IS NULL";
if ($search_categ > 0) $sql .= " AND cu.fk_categorie = ".$db->escape($search_categ);
if ($search_categ == -2) $sql .= " AND cu.fk_categorie IS NULL";
diff --git a/htdocs/user/passwordforgotten.php b/htdocs/user/passwordforgotten.php
index 03225e85866..96497492a15 100644
--- a/htdocs/user/passwordforgotten.php
+++ b/htdocs/user/passwordforgotten.php
@@ -100,16 +100,24 @@ if ($action == 'buildnewpassword' && $username)
{
$message = '';
// End of page
diff --git a/test/phpunit/CodingPhpTest.php b/test/phpunit/CodingPhpTest.php
index 74f889f19b6..b819671578c 100644
--- a/test/phpunit/CodingPhpTest.php
+++ b/test/phpunit/CodingPhpTest.php
@@ -166,10 +166,71 @@ class CodingPhpTest extends PHPUnit\Framework\TestCase
print 'Check php file '.$file['fullname']."\n";
$filecontent=file_get_contents($file['fullname']);
+ if (preg_match('/\.class\.php/', $file['relativename'])
+ || preg_match('/boxes\/box_/', $file['relativename'])
+ || preg_match('/modules\/.*\/doc\/(doc|pdf)_/', $file['relativename'])
+ || preg_match('/modules\/(import|mailings|printing)\//', $file['relativename'])
+ || in_array($file['name'], array('modules_boxes.php', 'rapport.pdf.php', 'TraceableDB.php'))) {
+ if (! in_array($file['name'], array(
+ 'api.class.php',
+ 'actioncomm.class.php',
+ 'commonobject.class.php',
+ 'conf.class.php',
+ 'html.form.class.php',
+ 'html.formmail.class.php',
+ 'infobox.class.php',
+ 'link.class.php',
+ 'translate.class.php',
+ 'utils.class.php',
+ 'modules_product.class.php',
+ 'modules_societe.class.php',
+ 'TraceableDB.php',
+ 'expeditionbatch.class.php',
+ 'expensereport_ik.class.php',
+ 'expensereport_rule.class.php',
+ 'multicurrency.class.php',
+ 'productbatch.class.php',
+ 'reception.class.php',
+ 'societe.class.php'
+ ))) {
+ // Must must not found $db->
+ $ok=true;
+ $matches=array();
+ // Check string get_class...
+ preg_match_all('/'.preg_quote('$db->', '/').'/', $filecontent, $matches, PREG_SET_ORDER);
+ foreach ($matches as $key => $val)
+ {
+ $ok=false;
+ break;
+ }
+ //print __METHOD__." Result for checking we don't have non escaped string in sql requests for file ".$file."\n";
+ $this->assertTrue($ok, 'Found string $db-> into a .class.php file in '.$file['relativename']);
+ //exit;
+ }
+ } else {
+ if (! in_array($file['name'], array(
+ 'extrafieldsinexport.inc.php',
+ 'DolQueryCollector.php'
+ ))) {
+ // Must must not found $this->db->
+ $ok=true;
+ $matches=array();
+ // Check string get_class...
+ preg_match_all('/'.preg_quote('$this->db->', '/').'/', $filecontent, $matches, PREG_SET_ORDER);
+ foreach ($matches as $key => $val)
+ {
+ $ok=false;
+ break;
+ }
+ //print __METHOD__." Result for checking we don't have non escaped string in sql requests for file ".$file."\n";
+ $this->assertTrue($ok, 'Found string $this->db-> in '.$file['relativename']);
+ //exit;
+ }
+ }
$ok=true;
$matches=array();
- // Check string ='".$this->xxx with xxx that is not 'escape'. It means we forget a db->escape when forging sql request.
+ // Check string get_class...
preg_match_all('/'.preg_quote('get_class($this)."::".__METHOD__', '/').'/', $filecontent, $matches, PREG_SET_ORDER);
foreach ($matches as $key => $val)
{
@@ -182,7 +243,7 @@ class CodingPhpTest extends PHPUnit\Framework\TestCase
$ok=true;
$matches=array();
- // Check string ='".$this->xxx with xxx that is not 'escape'. It means we forget a db->escape when forging sql request.
+ // Check string $this->db->idate without quotes
preg_match_all('/(..)\s*\.\s*\$this->db->idate\(/', $filecontent, $matches, PREG_SET_ORDER);
foreach ($matches as $key => $val)
{
@@ -200,11 +261,12 @@ class CodingPhpTest extends PHPUnit\Framework\TestCase
$ok=true;
$matches=array();
+
// Check string ='".$this->xxx with xxx that is not 'escape'. It means we forget a db->escape when forging sql request.
- preg_match_all('/(=|sql.+)\s*\'"\s*\.\s*\$this->(....)/', $filecontent, $matches, PREG_SET_ORDER);
+ preg_match_all('/=\s*\'"\s*\.\s*\$this->(....)/', $filecontent, $matches, PREG_SET_ORDER);
foreach ($matches as $key => $val)
{
- if ($val[2] != 'db->' && $val[2] != 'esca')
+ if ($val[1] != 'db->' && $val[1] != 'esca')
{
$ok=false;
break;
@@ -212,7 +274,21 @@ class CodingPhpTest extends PHPUnit\Framework\TestCase
//if ($reg[0] != 'db') $ok=false;
}
//print __METHOD__." Result for checking we don't have non escaped string in sql requests for file ".$file."\n";
- $this->assertTrue($ok, 'Found non escaped string in building of a sql request '.$file['relativename'].' ('.$val[0].'). Bad.');
+ $this->assertTrue($ok, 'Found non escaped string in building of a sql request '.$file['relativename'].': '.$val[0].' - Bad.');
+ //exit;
+
+ // Check string ='".$this->xxx with xxx that is not 'escape'. It means we forget a db->escape when forging sql request.
+ preg_match_all('/sql.+\s*\'"\s*\.\s*\$(.........)/', $filecontent, $matches, PREG_SET_ORDER);
+ foreach ($matches as $key => $val)
+ {
+ if (! in_array($val[1], array('this->db-', 'this->esc', 'db->escap', 'db->idate', 'excludeGr', 'includeGr'))) {
+ $ok=false;
+ break;
+ }
+ //if ($reg[0] != 'db') $ok=false;
+ }
+ //print __METHOD__." Result for checking we don't have non escaped string in sql requests for file ".$file."\n";
+ $this->assertTrue($ok, 'Found non escaped string in building of a sql request '.$file['relativename'].': '.$val[0].' - Bad.');
//exit;
diff --git a/test/phpunit/SecurityTest.php b/test/phpunit/SecurityTest.php
index 161dcd935b3..6c4d2270d1a 100644
--- a/test/phpunit/SecurityTest.php
+++ b/test/phpunit/SecurityTest.php
@@ -173,11 +173,12 @@ class SecurityTest extends PHPUnit\Framework\TestCase
$_GET["param1"]="222";
$_POST["param1"]="333";
$_GET["param2"]='a/b#e(pr)qq-rr\cc';
- $_GET["param3"]='"a/b#e(pr)qq-rr\cc'; // Same than param2 + "
+ $_GET["param3"]='"na/b#e(pr)qq-rr\cc'; // Same than param2 + " and n
$_GET["param4"]='../dir';
$_GET["param5"]="a_1-b";
- $_POST["param6"]="">
'.$langs->trans("ErrorBadValueForCode").'
';
} else {
+ $isanemail = preg_match('/@/', $username);
+
$edituser = new User($db);
$result = $edituser->fetch('', $username, '', 1);
- if ($result == 0 && preg_match('/@/', $username))
+ if ($result == 0 && $isanemail)
{
$result = $edituser->fetch('', '', '', 1, -1, $username);
}
if ($result <= 0 && $edituser->error == 'USERNOTFOUND')
{
- $message = ''.$langs->trans("ErrorLoginDoesNotExists", $username).'
';
+ $message = '';
+ if (! $isanemail) {
+ $message .= $langs->trans("IfLoginExistPasswordRequestSent");
+ } else {
+ $message .= $langs->trans("IfEmailExistPasswordRequestSent");
+ }
+ $message .= '
';
$username = '';
} else {
if (!$edituser->email)
@@ -125,7 +133,14 @@ if ($action == 'buildnewpassword' && $username)
// Success
if ($edituser->send_password($user, $newpassword, 1) > 0)
{
- $message = ''.$langs->trans("PasswordChangeRequestSent", $edituser->login, dolObfuscateEmail($edituser->email)).'
';
+ $message = '';
+ if (! $isanemail) {
+ $message .= $langs->trans("IfLoginExistPasswordRequestSent");
+ } else {
+ $message .= $langs->trans("IfEmailExistPasswordRequestSent");
+ }
+ //$message .= $langs->trans("PasswordChangeRequestSent", $edituser->login, dolObfuscateEmail($edituser->email));
+ $message .= '
';
$username = '';
} else {
$message .= ''.$edituser->error.'
';
diff --git a/htdocs/variants/class/ProductAttribute.class.php b/htdocs/variants/class/ProductAttribute.class.php
index 52ee3153108..bbc3a188137 100644
--- a/htdocs/variants/class/ProductAttribute.class.php
+++ b/htdocs/variants/class/ProductAttribute.class.php
@@ -41,6 +41,12 @@ class ProductAttribute extends CommonObject
*/
public $ref;
+ /**
+ * External ref of the product attribute
+ * @var string
+ */
+ public $ref_ext;
+
/**
* Label of the product attribute
* @var string
@@ -79,7 +85,7 @@ class ProductAttribute extends CommonObject
return -1;
}
- $sql = "SELECT rowid, ref, label, rang FROM ".MAIN_DB_PREFIX."product_attribute WHERE rowid = ".(int) $id." AND entity IN (".getEntity('product').")";
+ $sql = "SELECT rowid, ref, ref_ext, label, rang FROM ".MAIN_DB_PREFIX."product_attribute WHERE rowid = ".(int) $id." AND entity IN (".getEntity('product').")";
$query = $this->db->query($sql);
@@ -91,6 +97,7 @@ class ProductAttribute extends CommonObject
$this->id = $obj->rowid;
$this->ref = $obj->ref;
+ $this->ref_ext = $obj->ref_ext;
$this->label = $obj->label;
$this->rang = $obj->rang;
@@ -106,7 +113,7 @@ class ProductAttribute extends CommonObject
{
$return = array();
- $sql = 'SELECT rowid, ref, label, rang FROM '.MAIN_DB_PREFIX."product_attribute WHERE entity IN (".getEntity('product').')';
+ $sql = 'SELECT rowid, ref, ref_ext, label, rang FROM '.MAIN_DB_PREFIX."product_attribute WHERE entity IN (".getEntity('product').')';
$sql .= $this->db->order('rang', 'asc');
$query = $this->db->query($sql);
if ($query)
@@ -115,6 +122,7 @@ class ProductAttribute extends CommonObject
$tmp = new ProductAttribute($this->db);
$tmp->id = $result->rowid;
$tmp->ref = $result->ref;
+ $tmp->ref_ext = $result->ref_ext;
$tmp->label = $result->label;
$tmp->rang = $result->rang;
@@ -147,8 +155,8 @@ class ProductAttribute extends CommonObject
//Ref must be uppercase
$this->ref = strtoupper($this->ref);
- $sql = "INSERT INTO ".MAIN_DB_PREFIX."product_attribute (ref, label, entity, rang)
- VALUES ('".$this->db->escape($this->ref)."', '".$this->db->escape($this->label)."', ".(int) $this->entity.", ".(int) $this->rang.")";
+ $sql = "INSERT INTO ".MAIN_DB_PREFIX."product_attribute (ref, ref_ext, label, entity, rang)
+ VALUES ('".$this->db->escape($this->ref)."', '".$this->db->escape($this->ref_ext)."', '".$this->db->escape($this->label)."', ".(int) $this->entity.", ".(int) $this->rang.")";
$query = $this->db->query($sql);
if ($query)
@@ -183,7 +191,7 @@ class ProductAttribute extends CommonObject
$this->ref = trim(strtoupper($this->ref));
$this->label = trim($this->label);
- $sql = "UPDATE ".MAIN_DB_PREFIX."product_attribute SET ref = '".$this->db->escape($this->ref)."', label = '".$this->db->escape($this->label)."', rang = ".(int) $this->rang." WHERE rowid = ".(int) $this->id;
+ $sql = "UPDATE ".MAIN_DB_PREFIX."product_attribute SET ref = '".$this->db->escape($this->ref)."', ref_ext = '".$this->db->escape($this->ref_ext)."', label = '".$this->db->escape($this->label)."', rang = ".(int) $this->rang." WHERE rowid = ".(int) $this->id;
if ($this->db->query($sql)) {
return 1;
diff --git a/htdocs/variants/class/ProductCombination.class.php b/htdocs/variants/class/ProductCombination.class.php
index b4dac8475c0..721d31ef3ca 100644
--- a/htdocs/variants/class/ProductCombination.class.php
+++ b/htdocs/variants/class/ProductCombination.class.php
@@ -27,7 +27,7 @@ class ProductCombination
* Database handler
* @var DoliDB
*/
- private $db;
+ public $db;
/**
* Rowid of combination
@@ -77,6 +77,12 @@ class ProductCombination
*/
public $combination_price_levels;
+ /**
+ * External ref
+ * @var string
+ */
+ public $variation_ref_ext = '';
+
/**
* Constructor
*
@@ -100,7 +106,7 @@ class ProductCombination
{
global $conf;
- $sql = "SELECT rowid, fk_product_parent, fk_product_child, variation_price, variation_price_percentage, variation_weight FROM ".MAIN_DB_PREFIX."product_attribute_combination WHERE rowid = ".(int) $rowid." AND entity IN (".getEntity('product').")";
+ $sql = "SELECT rowid, fk_product_parent, fk_product_child, variation_price, variation_price_percentage, variation_weight, variation_ref_ext FROM ".MAIN_DB_PREFIX."product_attribute_combination WHERE rowid = ".(int) $rowid." AND entity IN (".getEntity('product').")";
$query = $this->db->query($sql);
@@ -120,6 +126,7 @@ class ProductCombination
$this->variation_price = $obj->variation_price;
$this->variation_price_percentage = $obj->variation_price_percentage;
$this->variation_weight = $obj->variation_weight;
+ $this->variation_ref_ext = $obj->variation_ref_ext;
if (!empty($conf->global->PRODUIT_MULTIPRICES)) {
$this->fetchCombinationPriceLevels();
@@ -226,7 +233,6 @@ class ProductCombination
}
}
-
/**
* Retrieves information of a variant product and ID of its parent product.
*
@@ -295,6 +301,7 @@ class ProductCombination
$tmp->variation_price = $result->variation_price;
$tmp->variation_price_percentage = $result->variation_price_percentage;
$tmp->variation_weight = $result->variation_weight;
+ $tmp->variation_ref_ext = $result->variation_ref_ext;
if (!empty($conf->global->PRODUIT_MULTIPRICES)) {
$tmp->fetchCombinationPriceLevels();
@@ -339,10 +346,10 @@ class ProductCombination
/* $this->fk_product_child may be empty and will be filled later after subproduct has been created */
$sql = "INSERT INTO ".MAIN_DB_PREFIX."product_attribute_combination";
- $sql .= " (fk_product_parent, fk_product_child, variation_price, variation_price_percentage, variation_weight, entity)";
+ $sql .= " (fk_product_parent, fk_product_child, variation_price, variation_price_percentage, variation_weight, variation_ref_ext, entity)";
$sql .= " VALUES (".((int) $this->fk_product_parent).", ".((int) $this->fk_product_child).",";
$sql .= (float) $this->variation_price.", ".(int) $this->variation_price_percentage.",";
- $sql .= (float) $this->variation_weight.", ".(int) $this->entity.")";
+ $sql .= (float) $this->variation_weight.", '".$this->db->escape($this->variation_ref_ext)."', ".(int) $this->entity.")";
$resql = $this->db->query($sql);
if ($resql) {
@@ -375,7 +382,8 @@ class ProductCombination
$sql = "UPDATE ".MAIN_DB_PREFIX."product_attribute_combination";
$sql .= " SET fk_product_parent = ".(int) $this->fk_product_parent.", fk_product_child = ".(int) $this->fk_product_child.",";
$sql .= " variation_price = ".(float) $this->variation_price.", variation_price_percentage = ".(int) $this->variation_price_percentage.",";
- $sql .= " variation_weight = ".(float) $this->variation_weight." WHERE rowid = ".((int) $this->id);
+ $sql .= " variation_ref_ext = '".$this->db->escape($this->variation_ref_ext)."',";
+ $sql .= " variation_weight = ".(float) $this->variation_weight." WHERE rowid = ".((int) $this->id);
$resql = $this->db->query($sql);
if (!$resql) {
@@ -663,23 +671,24 @@ class ProductCombination
* @param bool|float $forced_pricevar If the price variation is forced
* @param bool|float $forced_weightvar If the weight variation is forced
* @param bool|string $forced_refvar If the reference is forced
+ * @param string $ref_ext External reference
* @return int <0 KO, >0 OK
*/
- public function createProductCombination(User $user, Product $product, array $combinations, array $variations, $price_var_percent = false, $forced_pricevar = false, $forced_weightvar = false, $forced_refvar = false)
+ public function createProductCombination(User $user, Product $product, array $combinations, array $variations, $price_var_percent = false, $forced_pricevar = false, $forced_weightvar = false, $forced_refvar = false, $ref_ext = '')
{
- global $db, $conf;
+ global $conf;
require_once DOL_DOCUMENT_ROOT.'/variants/class/ProductAttribute.class.php';
require_once DOL_DOCUMENT_ROOT.'/variants/class/ProductAttributeValue.class.php';
- $db->begin();
+ $this->db->begin();
$price_impact = array(1=>0); // init level price impact
$forced_refvar = trim($forced_refvar);
if (!empty($forced_refvar) && $forced_refvar != $product->ref) {
- $existingProduct = new Product($db);
+ $existingProduct = new Product($this->db);
$result = $existingProduct->fetch('', $forced_refvar);
if ($result > 0) {
$newproduct = $existingProduct;
@@ -705,7 +714,7 @@ class ProductCombination
$price_impact = $forced_pricevar;
}
- $newcomb = new ProductCombination($db);
+ $newcomb = new ProductCombination($this->db);
$existingCombination = $newcomb->fetchByProductCombination2ValuePairs($product->id, $combinations);
if ($existingCombination) {
@@ -718,13 +727,13 @@ class ProductCombination
if ($result < 0) {
$this->error = $newcomb->error;
$this->errors = $newcomb->errors;
- $db->rollback();
+ $this->db->rollback();
return -1;
}
}
- $prodattr = new ProductAttribute($db);
- $prodattrval = new ProductAttributeValue($db);
+ $prodattr = new ProductAttribute($this->db);
+ $prodattrval = new ProductAttributeValue($this->db);
// $combination contains list of attributes pairs key->value. Example: array('id Color'=>id Blue, 'id Size'=>id Small, 'id Option'=>id val a, ...)
//var_dump($combinations);
@@ -735,7 +744,7 @@ class ProductCombination
//If there is an existing combination, there is no need to duplicate the valuepair
if (!$existingCombination) {
- $tmp = new ProductCombination2ValuePair($db);
+ $tmp = new ProductCombination2ValuePair($this->db);
$tmp->fk_prod_attr = $currcombattr;
$tmp->fk_prod_attr_val = $currcombval;
$tmp->fk_prod_combination = $newcomb->id;
@@ -743,7 +752,7 @@ class ProductCombination
if ($tmp->create($user) < 0) { // Create 1 entry into product_attribute_combination2val
$this->error = $tmp->error;
$this->errors = $tmp->errors;
- $db->rollback();
+ $this->db->rollback();
return -1;
}
}
@@ -781,6 +790,7 @@ class ProductCombination
$newcomb->variation_price_percentage = $price_var_percent;
$newcomb->variation_price = $price_impact[1];
$newcomb->variation_weight = $weight_impact;
+ $newcomb->variation_ref_ext = $this->db->escape($ref_ext);
// Init price level
if ($conf->global->PRODUIT_MULTIPRICES) {
@@ -822,7 +832,7 @@ class ProductCombination
if ($newproduct->error != 'ErrorProductAlreadyExists') {
$this->error[] = $newproduct->error;
$this->errors = $newproduct->errors;
- $db->rollback();
+ $this->db->rollback();
return -1;
}
@@ -851,7 +861,7 @@ class ProductCombination
}
if ($res < 0) {
- $db->rollback();
+ $this->db->rollback();
return -1;
}
}
@@ -859,7 +869,7 @@ class ProductCombination
$result = $newproduct->update($newproduct->id, $user);
if ($result < 0)
{
- $db->rollback();
+ $this->db->rollback();
return -1;
}
}
@@ -870,11 +880,11 @@ class ProductCombination
{
$this->error = $newcomb->error;
$this->errors = $newcomb->errors;
- $db->rollback();
+ $this->db->rollback();
return -1;
}
- $db->commit();
+ $this->db->commit();
return $newproduct->id;
}
@@ -971,7 +981,7 @@ class ProductCombinationLevel
* Database handler
* @var DoliDB
*/
- private $db;
+ public $db;
/**
* @var string Name of table without prefix where object is stored
diff --git a/htdocs/webservices/server_productorservice.php b/htdocs/webservices/server_productorservice.php
index ae5f1f285a4..bf29795f0de 100644
--- a/htdocs/webservices/server_productorservice.php
+++ b/htdocs/webservices/server_productorservice.php
@@ -503,7 +503,7 @@ function createProductOrService($authentication, $product)
if ($product['barcode'] && !$product['barcode_type'])
{
- $errror++; $errorcode = 'KO'; $errorlabel = "You must set a barcode type when setting a barcode.";
+ $error++; $errorcode = 'KO'; $errorlabel = "You must set a barcode type when setting a barcode.";
}
@@ -593,7 +593,7 @@ function createProductOrService($authentication, $product)
if ($savstockreal != $getstockreal)
{
- $warehouse = new Entrepot($this->db);
+ $warehouse = new Entrepot($db);
$warehouse->fetch(0, $product['warehouse_ref']);
if ($warehouse->id > 0)
{
@@ -675,7 +675,7 @@ function updateProductOrService($authentication, $product)
if ($product['barcode'] && !$product['barcode_type'])
{
- $errror++; $errorcode = 'KO'; $errorlabel = "You must set a barcode type when setting a barcode.";
+ $error++; $errorcode = 'KO'; $errorlabel = "You must set a barcode type when setting a barcode.";
}
if (!$error)
@@ -762,7 +762,7 @@ function updateProductOrService($authentication, $product)
if ($savstockreal != $getstockreal)
{
- $warehouse = new Entrepot($this->db);
+ $warehouse = new Entrepot($db);
$warehouse->fetch(0, $product['warehouse_ref']);
if ($warehouse->id > 0)
{
@@ -841,8 +841,6 @@ function deleteProductOrService($authentication, $listofidstring)
{
global $db, $conf, $langs;
- $now = dol_now();
-
dol_syslog("Function: deleteProductOrService login=".$authentication['login']);
if ($authentication['entity']) $conf->entity = $authentication['entity'];
@@ -936,8 +934,6 @@ function getListOfProductsOrServices($authentication, $filterproduct)
{
global $db, $conf, $langs;
- $now = dol_now();
-
dol_syslog("Function: getListOfProductsOrServices login=".$authentication['login']);
if ($authentication['entity']) $conf->entity = $authentication['entity'];
diff --git a/htdocs/webservices/server_user.php b/htdocs/webservices/server_user.php
index bc43c4ab6d4..000bad4b563 100644
--- a/htdocs/webservices/server_user.php
+++ b/htdocs/webservices/server_user.php
@@ -540,7 +540,7 @@ function createUserFromThirdparty($authentication, $thirdpartywithuser)
$sql = "SELECT rowid";
$sql .= " FROM ".MAIN_DB_PREFIX."c_country";
$sql .= " WHERE active = 1";
- $sql .= " AND code='".$thirdparty->country_code."'";
+ $sql .= " AND code='".$db->escape($thirdparty->country_code)."'";
$resql = $db->query($sql);
if ($resql)
diff --git a/htdocs/website/class/websitepage.class.php b/htdocs/website/class/websitepage.class.php
index 2ed4b9a75a3..b5e29e04176 100644
--- a/htdocs/website/class/websitepage.class.php
+++ b/htdocs/website/class/websitepage.class.php
@@ -382,9 +382,9 @@ class WebsitePage extends CommonObject
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
if ($key == 't.rowid' || $key == 't.fk_website' || $key == 'status') {
- $sqlwhere[] = $key.'='.$value;
+ $sqlwhere[] = $key.' = '.$value;
} elseif ($key == 'type_container') {
- $sqlwhere[] = $key."='".$value."'";
+ $sqlwhere[] = $key." = '".$this->db->escape($value)."'";
} elseif ($key == 'lang' || $key == 't.lang') {
$listoflang = array();
$foundnull = 0;
diff --git a/htdocs/zapier/class/api_zapier.class.php b/htdocs/zapier/class/api_zapier.class.php
index 082ca5a5490..9fbaf56c303 100644
--- a/htdocs/zapier/class/api_zapier.class.php
+++ b/htdocs/zapier/class/api_zapier.class.php
@@ -174,7 +174,7 @@ class ZapierApi extends DolibarrApi
//if ($mode == 1) $sql.= " AND s.client IN (1, 3)";
//if ($mode == 2) $sql.= " AND s.client IN (2, 3)";
- $tmpobject = new Hook($db);
+ $tmpobject = new Hook($this->db);
if ($tmpobject->ismultientitymanaged) {
$sql .= ' AND t.entity IN ('.getEntity('hook').')';
}
@@ -200,23 +200,23 @@ class ZapierApi extends DolibarrApi
$sql .= " AND (".preg_replace_callback('/'.$regexstring.'/', 'DolibarrApi::_forge_criteria_callback', $sqlfilters).")";
}
- $sql .= $db->order($sortfield, $sortorder);
+ $sql .= $this->db->order($sortfield, $sortorder);
if ($limit) {
if ($page < 0) {
$page = 0;
}
$offset = $limit * $page;
- $sql .= $db->plimit($limit + 1, $offset);
+ $sql .= $this->db->plimit($limit + 1, $offset);
}
- $result = $db->query($sql);
+ $result = $this->db->query($sql);
$i = 0;
if ($result) {
- $num = $db->num_rows($result);
+ $num = $this->db->num_rows($result);
while ($i < $num) {
- $obj = $db->fetch_object($result);
- $hook_static = new Hook($db);
+ $obj = $this->db->fetch_object($result);
+ $hook_static = new Hook($this->db);
if ($hook_static->fetch($obj->rowid)) {
$obj_ret[] = $this->_cleanObjectDatas($hook_static);
}
diff --git a/htdocs/zapier/hook_list.php b/htdocs/zapier/hook_list.php
index ab69c576445..ac90713f13c 100644
--- a/htdocs/zapier/hook_list.php
+++ b/htdocs/zapier/hook_list.php
@@ -49,7 +49,7 @@ $id = GETPOST('id', 'int');
// Load variable for pagination
$limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
-$sortfield = GETPOST('sortfield', 'alpha');
+$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha') || (empty($toselect) && $massaction === '0')) {
diff --git a/htdocs/zapier/zapierindex.php b/htdocs/zapier/zapierindex.php
index 2ac566dc058..5ecdf24e6cd 100644
--- a/htdocs/zapier/zapierindex.php
+++ b/htdocs/zapier/zapierindex.php
@@ -67,156 +67,9 @@ print load_fiche_titre($langs->trans("ZapierForDolibarrArea"), '', 'zapier.png@z
print '';
-/* BEGIN MODULEBUILDER DRAFT MYOBJECT
-// Draft MyObject
-if (! empty($conf->zapier->enabled) && $user->rights->zapier->read)
-{
- $langs->load("orders");
-
- $sql = "SELECT c.rowid, c.ref, c.ref_client, c.total_ht, c.tva as total_tva, c.total_ttc, s.rowid as socid, s.nom as name, s.client, s.canvas";
- $sql.= ", s.code_client";
- $sql.= " FROM ".MAIN_DB_PREFIX."commande as c";
- $sql.= ", ".MAIN_DB_PREFIX."societe as s";
- if (! $user->rights->societe->client->voir && ! $socid) $sql.= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
- $sql.= " WHERE c.fk_soc = s.rowid";
- $sql.= " AND c.fk_statut = 0";
- $sql.= " AND c.entity IN (".getEntity('commande').")";
- if (! $user->rights->societe->client->voir && ! $socid) $sql.= " AND s.rowid = sc.fk_soc AND sc.fk_user = " .$user->id;
- if ($socid) $sql.= " AND c.fk_soc = ".$socid;
-
- $resql = $db->query($sql);
- if ($resql)
- {
- $total = 0;
- $num = $db->num_rows($resql);
-
- print '';
- print '
"; - - $db->free($resql); - } - else - { - dol_print_error($db); - } -} -END MODULEBUILDER DRAFT MYOBJECT */ - - print '
| '.$langs->trans("DraftOrders").($num?''.$num.'':'').' | ||
|---|---|---|
| '; - $orderstatic->id=$obj->rowid; - $orderstatic->ref=$obj->ref; - $orderstatic->ref_client=$obj->ref_client; - $orderstatic->total_ht = $obj->total_ht; - $orderstatic->total_tva = $obj->total_tva; - $orderstatic->total_ttc = $obj->total_ttc; - print $orderstatic->getNomUrl(1); - print ' | '; - print ''; - $companystatic->id=$obj->socid; - $companystatic->name=$obj->name; - $companystatic->client=$obj->client; - $companystatic->code_client = $obj->code_client; - $companystatic->code_fournisseur = $obj->code_fournisseur; - $companystatic->canvas=$obj->canvas; - print $companystatic->getNomUrl(1,'customer',16); - print ' | '; - print ''.price($obj->total_ttc).' |
| '.$langs->trans("Total").' | '.price($total)." | |
| '.$langs->trans("NoOrder").' | ||
"; - - $db->free($resql); - } - else - { - dol_print_error($db); - } -} -END MODULEBUILDER DRAFT MYOBJECT */ - - print '
';
-$NBMAX = 3;
-$max = 3;
-
-/* BEGIN MODULEBUILDER LASTMODIFIED MYOBJECT
-// Last modified myobject
-if (! empty($conf->zapier->enabled) && $user->rights->zapier->read)
-{
- $sql = "SELECT s.rowid, s.nom as name, s.client, s.datec, s.tms, s.canvas";
- $sql.= ", s.code_client";
- $sql.= " FROM ".MAIN_DB_PREFIX."societe as s";
- if (! $user->rights->societe->client->voir && ! $socid) $sql.= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
- $sql.= " WHERE s.client IN (1, 2, 3)";
- $sql.= " AND s.entity IN (".getEntity($companystatic->element).")";
- if (! $user->rights->societe->client->voir && ! $socid) $sql.= " AND s.rowid = sc.fk_soc AND sc.fk_user = " .$user->id;
- if ($socid) $sql.= " AND s.rowid = $socid";
- $sql .= " ORDER BY s.tms DESC";
- $sql .= $db->plimit($max, 0);
-
- $resql = $db->query($sql);
- if ($resql)
- {
- $num = $db->num_rows($resql);
- $i = 0;
-
- print '';
- print '
"; - } -} -*/ - print '
| '; - if (empty($conf->global->SOCIETE_DISABLE_PROSPECTS) && empty($conf->global->SOCIETE_DISABLE_CUSTOMERS)) print $langs->trans("BoxTitleLastCustomersOrProspects",$max); - else if (! empty($conf->global->SOCIETE_DISABLE_CUSTOMERS)) print $langs->trans("BoxTitleLastModifiedProspects",$max); - else print $langs->trans("BoxTitleLastModifiedCustomers",$max); - print ' | '; - print ''.$langs->trans("DateModificationShort").' | '; - print '|
|---|---|---|
| '.$companystatic->getNomUrl(1,'customer',48).' | '; - print ''; - print $companystatic->getLibCustProspStatut(); - print " | "; - print ''.dol_print_date($db->jdate($objp->tms),'day')." | "; - print '
| '.$langs->trans("None").' | ||
"; - } -} -*/ - print '