lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix sql syntax error #yogosha5628 + 1 SQL injection

Browse Source
This commit is contained in:
Laurent Destailleur 2021-03-14 18:07:53 +01:00
parent 619df7bf23
commit bd838d0b8a
2 changed files with 120 additions and 111 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
htdocs/product/class/productcustomerprice.class.php
View File

@ -274,8 +274,8 @@ class Productcustomerprice extends CommonObject
/** /**
* Load object in memory from the database * Load object in memory from the database
* *
* @param int $id object * @param int $id ID of customer price
* @return int <0 if KO, >0 if OK * @return int <0 if KO, 0 if not found, >0 if OK
*/ */
public function fetch($id) public function fetch($id)
{ {
@ -301,7 +301,6 @@ class Productcustomerprice extends CommonObject
$sql .= " t.localtax2_tx,"; $sql .= " t.localtax2_tx,";
$sql .= " t.fk_user,"; $sql .= " t.fk_user,";
$sql .= " t.import_key"; $sql .= " t.import_key";
$sql .= " FROM ".MAIN_DB_PREFIX."product_customer_price as t"; $sql .= " FROM ".MAIN_DB_PREFIX."product_customer_price as t";
$sql .= " WHERE t.rowid = ".((int) $id); $sql .= " WHERE t.rowid = ".((int) $id);
@ -331,10 +330,15 @@ class Productcustomerprice extends CommonObject
$this->localtax2_tx = $obj->localtax2_tx; $this->localtax2_tx = $obj->localtax2_tx;
$this->fk_user = $obj->fk_user; $this->fk_user = $obj->fk_user;
$this->import_key = $obj->import_key; $this->import_key = $obj->import_key;
}
$this->db->free($resql); $this->db->free($resql);
return 1; return 1;
} else {
$this->db->free($resql);
return 0;
}
} else { } else {
$this->error = "Error ".$this->db->lasterror(); $this->error = "Error ".$this->db->lasterror();
return -1; return -1;
@ -487,7 +491,6 @@ class Productcustomerprice extends CommonObject
$sql = "SELECT"; $sql = "SELECT";
$sql .= " t.rowid,"; $sql .= " t.rowid,";
$sql .= " t.entity,"; $sql .= " t.entity,";
$sql .= " t.datec,"; $sql .= " t.datec,";
$sql .= " t.fk_product,"; $sql .= " t.fk_product,";
@ -514,20 +517,18 @@ class Productcustomerprice extends CommonObject
$sql .= " AND prod.rowid=t.fk_product "; $sql .= " AND prod.rowid=t.fk_product ";
$sql .= " AND prod.entity IN (".getEntity('product').")"; $sql .= " AND prod.entity IN (".getEntity('product').")";
$sql .= " AND t.entity IN (".getEntity('productprice').")"; $sql .= " AND t.entity IN (".getEntity('productprice').")";
// Manage filter // Manage filter
if (count($filter) > 0) { if (count($filter) > 0) {
foreach ($filter as $key => $value) { foreach ($filter as $key => $value) {
if (strpos($key, 'date')) { // To allow $filter['YEAR(s.dated)']=>$year if (strpos($key, 'date')) { // To allow $filter['YEAR(s.dated)']=>$year
$sql .= ' AND '.$key.' = \''.$value.'\''; $sql .= ' AND '.$key.' = \''.$value.'\'';
} elseif ($key == 'soc.nom') { } elseif ($key == 'soc.nom') {
$sql .= ' AND '.$key.' LIKE \'%'.$value.'%\''; $sql .= ' AND '.$key.' LIKE \'%'.$this->db->escape($value).'%\'';
} else { } else {
$sql .= ' AND '.$key.' = '.$value; $sql .= ' AND '.$key.' = '.((int) $value);
} }
} }
} }
$sql .= $this->db->order($sortfield, $sortorder); $sql .= $this->db->order($sortfield, $sortorder);
if (!empty($limit)) { if (!empty($limit)) {
$sql .= ' '.$this->db->plimit($limit + 1, $offset); $sql .= ' '.$this->db->plimit($limit + 1, $offset);

64
htdocs/societe/price.php
View File

@ -368,10 +368,10 @@ if (!empty($conf->global->PRODUIT_CUSTOMER_PRICES)) {
print load_fiche_titre($langs->trans('PriceByCustomer')); print load_fiche_titre($langs->trans('PriceByCustomer'));
$result = $prodcustprice->fetch(GETPOST('lineid', 'int')); $result = $prodcustprice->fetch(GETPOST('lineid', 'int'));
if ($result < 0) {
setEventMessages($prodcustprice->error, $prodcustprice->errors, 'errors');
}
if ($result <= 0) {
setEventMessages($prodcustprice->error, $prodcustprice->errors, 'errors');
} else {
print '<form action="'.$_SERVER["PHP_SELF"].'?socid='.$object->id.'" method="POST">'; print '<form action="'.$_SERVER["PHP_SELF"].'?socid='.$object->id.'" method="POST">';
print '<input type="hidden" name="token" value="'.newToken().'">'; print '<input type="hidden" name="token" value="'.newToken().'">';
print '<input type="hidden" name="action" value="update_customer_price_confirm">'; print '<input type="hidden" name="action" value="update_customer_price_confirm">';
@ -403,7 +403,7 @@ if (!empty($conf->global->PRODUIT_CUSTOMER_PRICES)) {
print '</tr>'; print '</tr>';
// Price // Price
print '<tr><td width="20%">'; print '<tr><td>';
$text = $langs->trans('SellingPrice'); $text = $langs->trans('SellingPrice');
print $form->textwithpicto($text, $langs->trans("PrecisionUnitIsLimitedToXDecimals", $conf->global->MAIN_MAX_DECIMALS_UNIT), 1, 1); print $form->textwithpicto($text, $langs->trans("PrecisionUnitIsLimitedToXDecimals", $conf->global->MAIN_MAX_DECIMALS_UNIT), 1, 1);
print '</td><td>'; print '</td><td>';
@ -427,7 +427,7 @@ if (!empty($conf->global->PRODUIT_CUSTOMER_PRICES)) {
print '</td></tr>'; print '</td></tr>';
// Update all child soc // Update all child soc
print '<tr><td width="15%">'; print '<tr><td>';
print $langs->trans('ForceUpdateChildPriceSoc'); print $langs->trans('ForceUpdateChildPriceSoc');
print '</td>'; print '</td>';
print '<td>'; print '<td>';
@ -444,23 +444,25 @@ if (!empty($conf->global->PRODUIT_CUSTOMER_PRICES)) {
print '</div>'; print '</div>';
print '<br></form>'; print '<br></form>';
}
} elseif ($action == 'showlog_customer_price') { } elseif ($action == 'showlog_customer_price') {
print '<br>'; print '<br>';
print '<!-- showlog_customer_price -->'."\n"; print '<!-- showlog_customer_price -->'."\n";
$filter = array( $filter = array(
't.fk_product' => GETPOST('prodid', 'int'), 't.fk_soc' => $socid 't.fk_product' => GETPOST('prodid', 'int'),
't.fk_soc' => $socid
); );
// Count total nb of records // Count total nb of records
$nbtotalofrecords = ''; $nbtotalofrecords = '';
if (empty($conf->global->MAIN_DISABLE_FULL_SCANLIST)) {
$nbtotalofrecords = $prodcustprice->fetch_all_log($sortorder, $sortfield, $conf->liste_limit, $offset, $filter);
}
$result = $prodcustprice->fetch_all_log($sortorder, $sortfield, $conf->liste_limit, $offset, $filter); $result = $prodcustprice->fetch_all_log($sortorder, $sortfield, $conf->liste_limit, $offset, $filter);
if ($result < 0) { if ($result < 0) {
setEventMessages($prodcustprice->error, $prodcustprice->errors, 'errors'); setEventMessages($prodcustprice->error, $prodcustprice->errors, 'errors');
} else {
if (empty($conf->global->MAIN_DISABLE_FULL_SCANLIST)) {
$nbtotalofrecords = $result;
}
} }
$option = '&socid='.GETPOST('socid', 'int').'&prodid='.GETPOST('prodid', 'int'); $option = '&socid='.GETPOST('socid', 'int').'&prodid='.GETPOST('prodid', 'int');
@ -485,14 +487,18 @@ if (!empty($conf->global->PRODUIT_CUSTOMER_PRICES)) {
print '<td class="right">'.$langs->trans("MinPrice").' '.$langs->trans("HT").'</td>'; print '<td class="right">'.$langs->trans("MinPrice").' '.$langs->trans("HT").'</td>';
print '<td class="right">'.$langs->trans("MinPrice").' '.$langs->trans("TTC").'</td>'; print '<td class="right">'.$langs->trans("MinPrice").' '.$langs->trans("TTC").'</td>';
print '<td class="right">'.$langs->trans("ChangedBy").'</td>'; print '<td class="right">'.$langs->trans("ChangedBy").'</td>';
print '<td>&nbsp;</td>'; print '<td></td>';
print '</tr>'; print '</tr>';
foreach ($prodcustprice->lines as $line) { foreach ($prodcustprice->lines as $line) {
print '<tr class="oddeven">';
$staticprod = new Product($db); $staticprod = new Product($db);
$staticprod->fetch($line->fk_product); $staticprod->fetch($line->fk_product);
$userstatic = new User($db);
$userstatic->fetch($line->fk_user);
print '<tr class="oddeven">';
print "<td>".$staticprod->getNomUrl(1)."</td>"; print "<td>".$staticprod->getNomUrl(1)."</td>";
print '<td>'.$line->ref_customer.'</td>'; print '<td>'.$line->ref_customer.'</td>';
print "<td>".dol_print_date($line->datec, "dayhour")."</td>"; print "<td>".dol_print_date($line->datec, "dayhour")."</td>";
@ -505,11 +511,10 @@ if (!empty($conf->global->PRODUIT_CUSTOMER_PRICES)) {
print '<td class="right">'.price($line->price_min_ttc).'</td>'; print '<td class="right">'.price($line->price_min_ttc).'</td>';
// User // User
$userstatic = new User($db);
$userstatic->fetch($line->fk_user);
print '<td class="right">'; print '<td class="right">';
print $userstatic->getLoginUrl(1); print $userstatic->getNomUrl(-1);
print '</td>'; print '</td>';
print '<td></td>';
} }
print "</table>"; print "</table>";
} else { } else {
@ -571,17 +576,22 @@ if (!empty($conf->global->PRODUIT_CUSTOMER_PRICES)) {
print '<td class="right">'.$langs->trans("MinPrice").' '.$langs->trans("HT").'</td>'; print '<td class="right">'.$langs->trans("MinPrice").' '.$langs->trans("HT").'</td>';
print '<td class="right">'.$langs->trans("MinPrice").' '.$langs->trans("TTC").'</td>'; print '<td class="right">'.$langs->trans("MinPrice").' '.$langs->trans("TTC").'</td>';
print '<td class="right">'.$langs->trans("ChangedBy").'</td>'; print '<td class="right">'.$langs->trans("ChangedBy").'</td>';
print '<td>&nbsp;</td>'; print '<td></td>';
print '</tr>'; print '</tr>';
if (count($prodcustprice->lines) > 0 || $search_prod) { if (count($prodcustprice->lines) > 0 || $search_prod) {
print '<tr class="liste_titre">'; print '<tr class="liste_titre">';
print '<td class="liste_titre"><input type="text" class="flat" name="search_prod" value="'.$search_prod.'" size="20"></td>'; print '<td class="liste_titre"><input type="text" class="flat" name="search_prod" value="'.$search_prod.'" size="20"></td>';
print '<td class="liste_titre" ><input type="text" class="flat" name="search_label" value="'.$search_label.'" size="20"></td>'; print '<td class="liste_titre" ><input type="text" class="flat" name="search_label" value="'.$search_label.'" size="20"></td>';
print '<td class="liste_titre" colspan="4">&nbsp;</td>'; print '<td class="liste_titre"></td>';
print '<td class="liste_titre" align="right"><input type="text" class="flat" name="search_price" value="'.$search_price.'" size="10"></td>'; print '<td class="liste_titre"></td>';
print '<td class="liste_titre" align="right"><input type="text" class="flat" name="search_price_ttc" value="'.$search_price_ttc.'" size="10"></td>'; print '<td class="liste_titre"></td>';
print '<td class="liste_titre" colspan="3">&nbsp;</td>'; print '<td class="liste_titre"></td>';
print '<td class="liste_titre" class="right"><input type="text" class="flat" name="search_price" value="'.$search_price.'" size="10"></td>';
print '<td class="liste_titre" class="right"><input type="text" class="flat" name="search_price_ttc" value="'.$search_price_ttc.'" size="10"></td>';
print '<td class="liste_titre"></td>';
print '<td class="liste_titre"></td>';
print '<td class="liste_titre"></td>';
// Print the search button // Print the search button
print '<td class="liste_titre maxwidthsearch">'; print '<td class="liste_titre maxwidthsearch">';
$searchpicto = $form->showFilterAndCheckAddButtons(0); $searchpicto = $form->showFilterAndCheckAddButtons(0);
@ -592,30 +602,28 @@ if (!empty($conf->global->PRODUIT_CUSTOMER_PRICES)) {
if (count($prodcustprice->lines) > 0) { if (count($prodcustprice->lines) > 0) {
foreach ($prodcustprice->lines as $line) { foreach ($prodcustprice->lines as $line) {
print '<tr class="oddeven">';
$staticprod = new Product($db); $staticprod = new Product($db);
$staticprod->fetch($line->fk_product); $staticprod->fetch($line->fk_product);
$userstatic = new User($db);
$userstatic->fetch($line->fk_user);
print '<tr class="oddeven">';
print "<td>".$staticprod->getNomUrl(1)."</td>"; print "<td>".$staticprod->getNomUrl(1)."</td>";
print "<td>".$staticprod->label."</td>"; print "<td>".$staticprod->label."</td>";
print '<td>'.$line->ref_customer.'</td>'; print '<td>'.$line->ref_customer.'</td>';
print "<td>".dol_print_date($line->datec, "dayhour")."</td>"; print "<td>".dol_print_date($line->datec, "dayhour")."</td>";
print '<td class="center">'.$langs->trans($line->price_base_type)."</td>"; print '<td class="center">'.$langs->trans($line->price_base_type)."</td>";
print '<td class="right">'.vatrate($line->tva_tx.($line->default_vat_code ? ' ('.$line->default_vat_code.')' : ''), true, $line->recuperableonly)."</td>"; print '<td class="right">'.vatrate($line->tva_tx.($line->default_vat_code ? ' ('.$line->default_vat_code.')' : ''), true, $line->recuperableonly)."</td>";
print '<td class="right">'.price($line->price)."</td>"; print '<td class="right">'.price($line->price)."</td>";
print '<td class="right">'.price($line->price_ttc)."</td>"; print '<td class="right">'.price($line->price_ttc)."</td>";
print '<td class="right">'.price($line->price_min).'</td>'; print '<td class="right">'.price($line->price_min).'</td>';
print '<td class="right">'.price($line->price_min_ttc).'</td>'; print '<td class="right">'.price($line->price_min_ttc).'</td>';
// User // User
$userstatic = new User($db);
$userstatic->fetch($line->fk_user);
print '<td class="right">'; print '<td class="right">';
print $userstatic->getLoginUrl(1); print $userstatic->getNomUrl(-1);
print '</td>'; print '</td>';
// Action // Action
if ($user->rights->produit->creer || $user->rights->service->creer) { if ($user->rights->produit->creer || $user->rights->service->creer) {
print '<td class="right nowraponall">'; print '<td class="right nowraponall">';