lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/3.5' into develop

Browse Source
This commit is contained in:
Laurent Destailleur 2014-06-09 15:30:41 +02:00
commit b124007c8c
21 changed files with 78 additions and 74 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
htdocs/core/class/fileupload.class.php
View File

@ -329,14 +329,14 @@ class FileUpload
$file->error = 'minFileSize'; $file->error = 'minFileSize';
return false; return false;
} }
if (is_int($this->options['max_number_of_files']) && ( if (is_numeric($this->options['max_number_of_files']) && (
count($this->getFileObjects()) >= $this->options['max_number_of_files']) count($this->getFileObjects()) >= $this->options['max_number_of_files'])
) { ) {
$file->error = 'maxNumberOfFiles'; $file->error = 'maxNumberOfFiles';
return false; return false;
} }
list($img_width, $img_height) = @getimagesize($uploaded_file); list($img_width, $img_height) = @getimagesize($uploaded_file);
if (is_int($img_width)) { if (is_numeric($img_width)) {
if ($this->options['max_width'] && $img_width > $this->options['max_width'] || if ($this->options['max_width'] && $img_width > $this->options['max_width'] ||
$this->options['max_height'] && $img_height > $this->options['max_height']) { $this->options['max_height'] && $img_height > $this->options['max_height']) {
$file->error = 'maxResolution'; $file->error = 'maxResolution';

2
htdocs/core/class/html.form.class.php
View File

@ -2668,7 +2668,7 @@ class Form
$autoOpen=true; $autoOpen=true;
$dialogconfirm='dialog-confirm'; $dialogconfirm='dialog-confirm';
$button=''; $button='';
if (! is_int($useajax)) if (! is_numeric($useajax))
{ {
$button=$useajax; $button=$useajax;
$useajax=1; $useajax=1;

2
htdocs/core/lib/pdf.lib.php
View File

@ -439,7 +439,7 @@ function pdf_pagehead(&$pdf,$outputlangs,$page_height)
if (! empty($conf->global->MAIN_USE_BACKGROUND_ON_PDF)) if (! empty($conf->global->MAIN_USE_BACKGROUND_ON_PDF))
{ {
$pdf->SetAutoPageBreak(0,0); // Disable auto pagebreak before adding image $pdf->SetAutoPageBreak(0,0); // Disable auto pagebreak before adding image
$pdf->Image($conf->mycompany->dir_output.'/logos/'.$conf->global->MAIN_USE_BACKGROUND_ON_PDF, 0, 0, 0, $page_height); $pdf->Image($conf->mycompany->dir_output.'/logos/'.$conf->global->MAIN_USE_BACKGROUND_ON_PDF, (isset($conf->global->MAIN_USE_BACKGROUND_ON_PDF_X)?$conf->global->MAIN_USE_BACKGROUND_ON_PDF_X:0), (isset($conf->global->MAIN_USE_BACKGROUND_ON_PDF_Y)?$conf->global->MAIN_USE_BACKGROUND_ON_PDF_Y:0), 0, $page_height);
$pdf->SetAutoPageBreak(1,0); // Restore pagebreak $pdf->SetAutoPageBreak(1,0); // Restore pagebreak
} }
} }

10
htdocs/core/lib/security2.lib.php
View File

@ -292,11 +292,11 @@ function dol_loginfunction($langs,$conf,$mysoc)
if (! empty($conf->global->MAIN_USE_JQUERY_THEME)) $jquerytheme = $conf->global->MAIN_USE_JQUERY_THEME; if (! empty($conf->global->MAIN_USE_JQUERY_THEME)) $jquerytheme = $conf->global->MAIN_USE_JQUERY_THEME;
// Set dol_hide_topmenu, dol_hide_leftmenu, dol_optimize_smallscreen, dol_nomousehover // Set dol_hide_topmenu, dol_hide_leftmenu, dol_optimize_smallscreen, dol_nomousehover
$dol_hide_topmenu=GETPOST('dol_hide_topmenu'); $dol_hide_topmenu=GETPOST('dol_hide_topmenu','int');
$dol_hide_leftmenu=GETPOST('dol_hide_leftmenu'); $dol_hide_leftmenu=GETPOST('dol_hide_leftmenu','int');
$dol_optimize_smallscreen=GETPOST('dol_optimize_smallscreen'); $dol_optimize_smallscreen=GETPOST('dol_optimize_smallscreen','int');
$dol_no_mouse_hover=GETPOST('dol_no_mouse_hover'); $dol_no_mouse_hover=GETPOST('dol_no_mouse_hover','int');
$dol_use_jmobile=GETPOST('dol_use_jmobile'); $dol_use_jmobile=GETPOST('dol_use_jmobile','int');
// Include login page template // Include login page template
include $template_dir.'login.tpl.php'; include $template_dir.'login.tpl.php';

2
htdocs/core/modules/modSociete.class.php
View File

@ -329,7 +329,7 @@ class modSociete extends DolibarrModules
unset($this->export_entities_array[$r]['s.code_fournisseur']); unset($this->export_entities_array[$r]['s.code_fournisseur']);
} }
// Add extra fields // Add extra fields
$sql="SELECT name, label FROM ".MAIN_DB_PREFIX."extrafields WHERE elementtype = 'socpeople'"; $sql="SELECT name, label, type, param FROM ".MAIN_DB_PREFIX."extrafields WHERE elementtype = 'socpeople'";
$resql=$this->db->query($sql); $resql=$this->db->query($sql);
if ($resql) // This can fail when class is used on old database (during migration for example) if ($resql) // This can fail when class is used on old database (during migration for example)
{ {

30
htdocs/main.inc.php
View File

@ -361,16 +361,16 @@ if (! defined('NOLOGIN'))
// It is not already authenticated and it requests the login / password // It is not already authenticated and it requests the login / password
include_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php'; include_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php';
$dol_dst_observed=GETPOST("dst_observed",3); $dol_dst_observed=GETPOST("dst_observed",'int',3);
$dol_dst_first=GETPOST("dst_first",3); $dol_dst_first=GETPOST("dst_first",'int',3);
$dol_dst_second=GETPOST("dst_second",3); $dol_dst_second=GETPOST("dst_second",'int',3);
$dol_screenwidth=GETPOST("screenwidth",3); $dol_screenwidth=GETPOST("screenwidth",'int',3);
$dol_screenheight=GETPOST("screenheight",3); $dol_screenheight=GETPOST("screenheight",'int',3);
$dol_hide_topmenu=GETPOST('dol_hide_topmenu',3); $dol_hide_topmenu=GETPOST('dol_hide_topmenu','int',3);
$dol_hide_leftmenu=GETPOST('dol_hide_leftmenu',3); $dol_hide_leftmenu=GETPOST('dol_hide_leftmenu','int',3);
$dol_optimize_smallscreen=GETPOST('dol_optimize_smallscreen',3); $dol_optimize_smallscreen=GETPOST('dol_optimize_smallscreen','int',3);
$dol_no_mouse_hover=GETPOST('dol_no_mouse_hover',3); $dol_no_mouse_hover=GETPOST('dol_no_mouse_hover','int',3);
$dol_use_jmobile=GETPOST('dol_use_jmobile',3); $dol_use_jmobile=GETPOST('dol_use_jmobile','int',3);
//dol_syslog("POST key=".join(array_keys($_POST),',').' value='.join($_POST,',')); //dol_syslog("POST key=".join(array_keys($_POST),',').' value='.join($_POST,','));
// If in demo mode, we check we go to home page through the public/demo/index.php page // If in demo mode, we check we go to home page through the public/demo/index.php page
@ -1037,11 +1037,11 @@ function top_htmlhead($head, $title='', $disablejs=0, $disablehead=0, $arrayofjs
$themeparam='?lang='.$langs->defaultlang.'&theme='.$conf->theme.(GETPOST('optioncss')?'&optioncss='.GETPOST('optioncss','alpha',1):'').'&userid='.$user->id.'&entity='.$conf->entity; $themeparam='?lang='.$langs->defaultlang.'&theme='.$conf->theme.(GETPOST('optioncss')?'&optioncss='.GETPOST('optioncss','alpha',1):'').'&userid='.$user->id.'&entity='.$conf->entity;
$themeparam.=($ext?'&'.$ext:''); $themeparam.=($ext?'&'.$ext:'');
if (! empty($_SESSION['dol_resetcache'])) $themeparam.='&dol_resetcache='.$_SESSION['dol_resetcache']; if (! empty($_SESSION['dol_resetcache'])) $themeparam.='&dol_resetcache='.$_SESSION['dol_resetcache'];
if (GETPOST('dol_hide_topmenu')) { $themeparam.='&dol_hide_topmenu='.GETPOST('dol_hide_topmenu'); } if (GETPOST('dol_hide_topmenu')) { $themeparam.='&dol_hide_topmenu='.GETPOST('dol_hide_topmenu','int'); }
if (GETPOST('dol_hide_leftmenu')) { $themeparam.='&dol_hide_leftmenu='.GETPOST('dol_hide_leftmenu'); } if (GETPOST('dol_hide_leftmenu')) { $themeparam.='&dol_hide_leftmenu='.GETPOST('dol_hide_leftmenu','int'); }
if (GETPOST('dol_optimize_smallscreen')) { $themeparam.='&dol_optimize_smallscreen='.GETPOST('dol_optimize_smallscreen'); } if (GETPOST('dol_optimize_smallscreen')) { $themeparam.='&dol_optimize_smallscreen='.GETPOST('dol_optimize_smallscreen','int'); }
if (GETPOST('dol_no_mouse_hover')) { $themeparam.='&dol_no_mouse_hover='.GETPOST('dol_no_mouse_hover'); } if (GETPOST('dol_no_mouse_hover')) { $themeparam.='&dol_no_mouse_hover='.GETPOST('dol_no_mouse_hover','int'); }
if (GETPOST('dol_use_jmobile')) { $themeparam.='&dol_use_jmobile='.GETPOST('dol_use_jmobile'); $conf->dol_use_jmobile=GETPOST('dol_use_jmobile'); } if (GETPOST('dol_use_jmobile')) { $themeparam.='&dol_use_jmobile='.GETPOST('dol_use_jmobile','int'); $conf->dol_use_jmobile=GETPOST('dol_use_jmobile','int'); }
//print 'themepath='.$themepath.' themeparam='.$themeparam;exit; //print 'themepath='.$themepath.' themeparam='.$themeparam;exit;
print '<link rel="stylesheet" type="text/css" title="default" href="'.$themepath.$themeparam.'">'."\n"; print '<link rel="stylesheet" type="text/css" title="default" href="'.$themepath.$themeparam.'">'."\n";

9
htdocs/master.inc.php
View File

@ -160,19 +160,22 @@ if (! defined('NOREQUIREDB'))
{ {
$conf->entity = GETPOST("entity",'int'); $conf->entity = GETPOST("entity",'int');
} }
else if (defined('DOLENTITY') && is_int(DOLENTITY)) // For public page with MultiCompany module else if (defined('DOLENTITY') && is_numeric(DOLENTITY)) // For public page with MultiCompany module
{ {
$conf->entity = DOLENTITY; $conf->entity = DOLENTITY;
} }
else if (!empty($_COOKIE['DOLENTITY'])) // For other application with MultiCompany module else if (!empty($_COOKIE['DOLENTITY'])) // For other application with MultiCompany module (TODO: We should remove this. entity to use should never be stored into client side)
{ {
$conf->entity = $_COOKIE['DOLENTITY']; $conf->entity = $_COOKIE['DOLENTITY'];
} }
else if (! empty($conf->multicompany->force_entity) && is_int($conf->multicompany->force_entity)) // To force entity in login page else if (! empty($conf->multicompany->force_entity) && is_numeric($conf->multicompany->force_entity)) // To force entity in login page
{ {
$conf->entity = $conf->multicompany->force_entity; $conf->entity = $conf->multicompany->force_entity;
} }
// Sanitize entity
if (! is_numeric($conf->entity)) $conf->entity=1;
//print "Will work with data into entity instance number '".$conf->entity."'"; //print "Will work with data into entity instance number '".$conf->entity."'";
// Here we read database (llx_const table) and define $conf->global->XXX var. // Here we read database (llx_const table) and define $conf->global->XXX var.

10
htdocs/public/demo/index.php
View File

@ -33,11 +33,11 @@ $langs->load("main");
$langs->load("install"); $langs->load("install");
$langs->load("other"); $langs->load("other");
$conf->dol_hide_topmenu=GETPOST('dol_hide_topmenu'); $conf->dol_hide_topmenu=GETPOST('dol_hide_topmenu','int');
$conf->dol_hide_leftmenu=GETPOST('dol_hide_leftmenu'); $conf->dol_hide_leftmenu=GETPOST('dol_hide_leftmenu','int');
$conf->dol_optimize_smallscreen=GETPOST('dol_optimize_smallscreen'); $conf->dol_optimize_smallscreen=GETPOST('dol_optimize_smallscreen','int');
$conf->dol_no_mouse_hover=GETPOST('dol_no_mouse_hover'); $conf->dol_no_mouse_hover=GETPOST('dol_no_mouse_hover','int');
$conf->dol_use_jmobile=GETPOST('dol_use_jmobile'); $conf->dol_use_jmobile=GETPOST('dol_use_jmobile','int');
// Security check // Security check
global $dolibarr_main_demo; global $dolibarr_main_demo;

2
htdocs/public/members/new.php
View File

@ -42,7 +42,7 @@ define("NOCSRFCHECK",1); // We accept to go on this page from external web site.
// Do not use GETPOST here, function is not defined and define must be done before including main.inc.php // Do not use GETPOST here, function is not defined and define must be done before including main.inc.php
// TODO This should be useless. Because entity must be retreive from object ref and not from url. // TODO This should be useless. Because entity must be retreive from object ref and not from url.
$entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1)); $entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1));
if (is_int($entity)) define("DOLENTITY", $entity); if (is_numeric($entity)) define("DOLENTITY", $entity);
require '../../main.inc.php'; require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/adherents/class/adherent.class.php'; require_once DOL_DOCUMENT_ROOT.'/adherents/class/adherent.class.php';

2
htdocs/public/members/public_card.php
View File

@ -31,7 +31,7 @@ define("NOCSRFCHECK",1); // We accept to go on this page from external web site.
// Do not use GETPOST here, function is not defined and define must be done before including main.inc.php // Do not use GETPOST here, function is not defined and define must be done before including main.inc.php
// TODO This should be useless. Because entity must be retreive from object ref and not from url. // TODO This should be useless. Because entity must be retreive from object ref and not from url.
$entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1)); $entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1));
if (is_int($entity)) define("DOLENTITY", $entity); if (is_numeric($entity)) define("DOLENTITY", $entity);
require '../../main.inc.php'; require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/adherents/class/adherent.class.php'; require_once DOL_DOCUMENT_ROOT.'/adherents/class/adherent.class.php';

2
htdocs/public/members/public_list.php
View File

@ -31,7 +31,7 @@ define("NOCSRFCHECK",1); // We accept to go on this page from external web site.
// Do not use GETPOST here, function is not defined and define must be done before including main.inc.php // Do not use GETPOST here, function is not defined and define must be done before including main.inc.php
// TODO This should be useless. Because entity must be retreive from object ref and not from url. // TODO This should be useless. Because entity must be retreive from object ref and not from url.
$entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1)); $entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1));
if (is_int($entity)) define("DOLENTITY", $entity); if (is_numeric($entity)) define("DOLENTITY", $entity);
require '../../main.inc.php'; require '../../main.inc.php';

2
htdocs/public/paybox/newpayment.php
View File

@ -31,7 +31,7 @@ define("NOCSRFCHECK",1); // We accept to go on this page from external web site.
// Do not use GETPOST here, function is not defined and define must be done before including main.inc.php // Do not use GETPOST here, function is not defined and define must be done before including main.inc.php
// TODO This should be useless. Because entity must be retreive from object ref and not from url. // TODO This should be useless. Because entity must be retreive from object ref and not from url.
$entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1)); $entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1));
if (is_int($entity)) define("DOLENTITY", $entity); if (is_numeric($entity)) define("DOLENTITY", $entity);
require '../../main.inc.php'; require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/paybox/lib/paybox.lib.php'; require_once DOL_DOCUMENT_ROOT.'/paybox/lib/paybox.lib.php';

2
htdocs/public/paybox/paymentko.php
View File

@ -30,7 +30,7 @@ define("NOCSRFCHECK",1); // We accept to go on this page from external web site.
// Do not use GETPOST here, function is not defined and define must be done before including main.inc.php // Do not use GETPOST here, function is not defined and define must be done before including main.inc.php
// TODO This should be useless. Because entity must be retreive from object ref and not from url. // TODO This should be useless. Because entity must be retreive from object ref and not from url.
$entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1)); $entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1));
if (is_int($entity)) define("DOLENTITY", $entity); if (is_numeric($entity)) define("DOLENTITY", $entity);
require '../../main.inc.php'; require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/paybox/lib/paybox.lib.php'; require_once DOL_DOCUMENT_ROOT.'/paybox/lib/paybox.lib.php';

2
htdocs/public/paybox/paymentok.php
View File

@ -30,7 +30,7 @@ define("NOCSRFCHECK",1); // We accept to go on this page from external web site.
// Do not use GETPOST here, function is not defined and define must be done before including main.inc.php // Do not use GETPOST here, function is not defined and define must be done before including main.inc.php
// TODO This should be useless. Because entity must be retreive from object ref and not from url. // TODO This should be useless. Because entity must be retreive from object ref and not from url.
$entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1)); $entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1));
if (is_int($entity)) define("DOLENTITY", $entity); if (is_numeric($entity)) define("DOLENTITY", $entity);
require '../../main.inc.php'; require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/paybox/lib/paybox.lib.php'; require_once DOL_DOCUMENT_ROOT.'/paybox/lib/paybox.lib.php';

2
htdocs/public/paypal/newpayment.php
View File

@ -33,7 +33,7 @@ define("NOCSRFCHECK",1); // We accept to go on this page from external web site.
// Do not use GETPOST here, function is not defined and define must be done before including main.inc.php // Do not use GETPOST here, function is not defined and define must be done before including main.inc.php
// TODO This should be useless. Because entity must be retreive from object ref and not from url. // TODO This should be useless. Because entity must be retreive from object ref and not from url.
$entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1)); $entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1));
if (is_int($entity)) define("DOLENTITY", $entity); if (is_numeric($entity)) define("DOLENTITY", $entity);
require '../../main.inc.php'; require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/paypal/lib/paypal.lib.php'; require_once DOL_DOCUMENT_ROOT.'/paypal/lib/paypal.lib.php';

2
htdocs/public/paypal/paymentko.php
View File

@ -33,7 +33,7 @@ define("NOCSRFCHECK",1); // We accept to go on this page from external web site.
// Do not use GETPOST here, function is not defined and define must be done before including main.inc.php // Do not use GETPOST here, function is not defined and define must be done before including main.inc.php
// TODO This should be useless. Because entity must be retreive from object ref and not from url. // TODO This should be useless. Because entity must be retreive from object ref and not from url.
$entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1)); $entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1));
if (is_int($entity)) define("DOLENTITY", $entity); if (is_numeric($entity)) define("DOLENTITY", $entity);
require '../../main.inc.php'; require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/paypal/lib/paypal.lib.php'; require_once DOL_DOCUMENT_ROOT.'/paypal/lib/paypal.lib.php';

2
htdocs/public/paypal/paymentok.php
View File

@ -33,7 +33,7 @@ define("NOCSRFCHECK",1); // We accept to go on this page from external web site.
// Do not use GETPOST here, function is not defined and define must be done before including main.inc.php // Do not use GETPOST here, function is not defined and define must be done before including main.inc.php
// TODO This should be useless. Because entity must be retreive from object ref and not from url. // TODO This should be useless. Because entity must be retreive from object ref and not from url.
$entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1)); $entity=(! empty($_GET['entity']) ? (int) $_GET['entity'] : (! empty($_POST['entity']) ? (int) $_POST['entity'] : 1));
if (is_int($entity)) define("DOLENTITY", $entity); if (is_numeric($entity)) define("DOLENTITY", $entity);
require '../../main.inc.php'; require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/paypal/lib/paypal.lib.php'; require_once DOL_DOCUMENT_ROOT.'/paypal/lib/paypal.lib.php';

4
htdocs/user/class/user.class.php
View File

@ -809,7 +809,7 @@ class User extends CommonObject
$sql = "SELECT login FROM ".MAIN_DB_PREFIX."user"; $sql = "SELECT login FROM ".MAIN_DB_PREFIX."user";
$sql.= " WHERE login ='".$this->db->escape($this->login)."'"; $sql.= " WHERE login ='".$this->db->escape($this->login)."'";
$sql.= " AND entity IN (0,".$conf->entity.")"; $sql.= " AND entity IN (0,".$this->db->escape($conf->entity).")";
dol_syslog(get_class($this)."::create sql=".$sql, LOG_DEBUG); dol_syslog(get_class($this)."::create sql=".$sql, LOG_DEBUG);
$resql=$this->db->query($sql); $resql=$this->db->query($sql);
@ -828,7 +828,7 @@ class User extends CommonObject
else else
{ {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."user (datec,login,ldap_sid,entity)"; $sql = "INSERT INTO ".MAIN_DB_PREFIX."user (datec,login,ldap_sid,entity)";
$sql.= " VALUES('".$this->db->idate($this->datec)."','".$this->db->escape($this->login)."','".$this->ldap_sid."',".$this->entity.")"; $sql.= " VALUES('".$this->db->idate($this->datec)."','".$this->db->escape($this->login)."','".$this->ldap_sid."',".$this->db->escape($this->entity).")";
$result=$this->db->query($sql); $result=$this->db->query($sql);
dol_syslog(get_class($this)."::create sql=".$sql, LOG_DEBUG); dol_syslog(get_class($this)."::create sql=".$sql, LOG_DEBUG);

4
htdocs/user/class/usergroup.class.php
View File

@ -589,7 +589,7 @@ class UserGroup extends CommonObject
$sql.= ") VALUES ("; $sql.= ") VALUES (";
$sql.= "'".$this->db->idate($now)."'"; $sql.= "'".$this->db->idate($now)."'";
$sql.= ",'".$this->db->escape($this->nom)."'"; $sql.= ",'".$this->db->escape($this->nom)."'";
$sql.= ",".$entity; $sql.= ",".$this->db->escape($entity);
$sql.= ")"; $sql.= ")";
dol_syslog(get_class($this)."::create sql=".$sql, LOG_DEBUG); dol_syslog(get_class($this)."::create sql=".$sql, LOG_DEBUG);
@ -640,7 +640,7 @@ class UserGroup extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."usergroup SET "; $sql = "UPDATE ".MAIN_DB_PREFIX."usergroup SET ";
$sql.= " nom = '" . $this->db->escape($this->nom) . "'"; $sql.= " nom = '" . $this->db->escape($this->nom) . "'";
$sql.= ", entity = " . $entity; $sql.= ", entity = " . $this->db->escape($entity);
$sql.= ", note = '" . $this->db->escape($this->note) . "'"; $sql.= ", note = '" . $this->db->escape($this->note) . "'";
$sql.= " WHERE rowid = " . $this->id; $sql.= " WHERE rowid = " . $this->id;

39
htdocs/user/fiche.php
View File

@ -178,16 +178,16 @@ if ($action == 'add' && $canadduser)
if (! $message) if (! $message)
{ {
$object->lastname = GETPOST("lastname"); $object->lastname = GETPOST("lastname",'alpha');
$object->firstname = GETPOST("firstname"); $object->firstname = GETPOST("firstname",'alpha');
$object->login = GETPOST("login"); $object->login = GETPOST("login",'alpha');
$object->admin = GETPOST("admin"); $object->admin = GETPOST("admin",'alpha');
$object->office_phone = GETPOST("office_phone"); $object->office_phone = GETPOST("office_phone",'alpha');
$object->office_fax = GETPOST("office_fax"); $object->office_fax = GETPOST("office_fax",'alpha');
$object->user_mobile = GETPOST("user_mobile"); $object->user_mobile = GETPOST("user_mobile");
$object->skype = GETPOST("skype"); $object->skype = GETPOST("skype");
$object->email = GETPOST("email"); $object->email = GETPOST("email",'alpha');
$object->job = GETPOST("job"); $object->job = GETPOST("job",'alpha');
$object->signature = GETPOST("signature"); $object->signature = GETPOST("signature");
$object->accountancy_code = GETPOST("accountancy_code"); $object->accountancy_code = GETPOST("accountancy_code");
$object->note = GETPOST("note"); $object->note = GETPOST("note");
@ -200,6 +200,7 @@ if ($action == 'add' && $canadduser)
// If multicompany is off, admin users must all be on entity 0. // If multicompany is off, admin users must all be on entity 0.
if (! empty($conf->multicompany->enabled)) if (! empty($conf->multicompany->enabled))
{ {
$entity=GETPOST('entity','int');
if (! empty($_POST["superadmin"])) if (! empty($_POST["superadmin"]))
{ {
$object->entity = 0; $object->entity = 0;
@ -210,12 +211,12 @@ if ($action == 'add' && $canadduser)
} }
else else
{ {
$object->entity = (empty($_POST["entity"]) ? 0 : $_POST["entity"]); $object->entity = (empty($entity) ? 0 : $entity);
} }
} }
else else
{ {
$object->entity = (empty($_POST["entity"]) ? 0 : $_POST["entity"]); $object->entity = (empty($entity) ? 0 : $entity);
} }
$db->begin(); $db->begin();
@ -316,17 +317,17 @@ if ($action == 'update' && ! $_POST["cancel"])
$object->oldcopy=dol_clone($object); $object->oldcopy=dol_clone($object);
$object->lastname = GETPOST("lastname"); $object->lastname = GETPOST("lastname",'alpha');
$object->firstname = GETPOST("firstname"); $object->firstname = GETPOST("firstname",'alpha');
$object->login = GETPOST("login"); $object->login = GETPOST("login",'alpha');
$object->pass = GETPOST("password"); $object->pass = GETPOST("password");
$object->admin = empty($user->admin)?0:GETPOST("admin"); // A user can only be set admin by an admin $object->admin = empty($user->admin)?0:GETPOST("admin"); // A user can only be set admin by an admin
$object->office_phone=GETPOST("office_phone"); $object->office_phone=GETPOST("office_phone",'alpha');
$object->office_fax = GETPOST("office_fax"); $object->office_fax = GETPOST("office_fax",'alpha');
$object->user_mobile= GETPOST("user_mobile"); $object->user_mobile= GETPOST("user_mobile");
$object->skype = GETPOST("skype"); $object->skype = GETPOST("skype");
$object->email = GETPOST("email"); $object->email = GETPOST("email",'alpha');
$object->job = GETPOST("job"); $object->job = GETPOST("job",'alpha');
$object->signature = GETPOST("signature"); $object->signature = GETPOST("signature");
$object->accountancy_code = GETPOST("accountancy_code"); $object->accountancy_code = GETPOST("accountancy_code");
$object->openid = GETPOST("openid"); $object->openid = GETPOST("openid");
@ -384,8 +385,8 @@ if ($action == 'update' && ! $_POST["cancel"])
$contact->fetch($contactid); $contact->fetch($contactid);
$sql = "UPDATE ".MAIN_DB_PREFIX."user"; $sql = "UPDATE ".MAIN_DB_PREFIX."user";
$sql.= " SET fk_socpeople=".$contactid; $sql.= " SET fk_socpeople=".$db->escape($contactid);
if ($contact->socid) $sql.=", fk_societe=".$contact->socid; if ($contact->socid) $sql.=", fk_societe=".$db->escape($contact->socid);
$sql.= " WHERE rowid=".$object->id; $sql.= " WHERE rowid=".$object->id;
} }
else else