lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Suppression des addslashes. En effet, les donnes ne doivent jamais contenir une valeur "transforme" de leur valeur mais c'est uniquement dans l'ordre insert que le addslashes doit etre ajout. Ceci ces donnes peuvent etre manipules par d'autres portions de code que le insert qui elle requiert la donne d'origine.

Browse Source
This commit is contained in:
Laurent Destailleur 2006-06-07 21:03:19 +00:00
parent 50dca584c4
commit d04e921c60
3 changed files with 44 additions and 57 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
htdocs/commande/commande.class.php
View File

@ -504,8 +504,8 @@ class Commande
{ {
global $conf; global $conf;
// Nettoyage parametres // Nettoyage parametres
$qty = ereg_replace(',','.',$qty); $qty = price2num($qty);
$pu = ereg_replace(',','.',$pu); $pu = price2num($pu);
$desc=trim($desc); $desc=trim($desc);
$product_desc=trim($product_desc); $product_desc=trim($product_desc);
if (strlen(trim($qty))==0) if (strlen(trim($qty))==0)
@ -542,20 +542,10 @@ class Commande
} }
} }
$remise = 0; $remise = 0;
$price = round(ereg_replace(',','.',$pu), 2); $price = round(price2num($pu), 2);
$subprice = $price; $subprice = $price;
// appliquait la remise 2 fois : sur la ligne et le HT
/*
if (trim(strlen($remise_percent)) > 0)
{
$remise = round(($pu * $remise_percent / 100), 2);
$price = $pu - $remise;
}
*/
$sql = 'INSERT INTO '.MAIN_DB_PREFIX.'commandedet (fk_commande,label,description,fk_product, price,qty,tva_tx, remise_percent, subprice, remise)'; $sql = 'INSERT INTO '.MAIN_DB_PREFIX.'commandedet (fk_commande,label,description,fk_product, price,qty,tva_tx, remise_percent, subprice, remise)';
if ($conf->global->PRODUIT_CHANGE_PROD_DESC) if ($conf->global->PRODUIT_CHANGE_PROD_DESC)
{ {
$sql .= " VALUES ($this->id, '" . addslashes($desc) . "','" . addslashes($product_desc) . "',$fk_product,".price2num($price).", '$qty', $txtva, $remise_percent,'".price2num($subprice)."','".price2num( $remise)."') ;"; $sql .= " VALUES ($this->id, '" . addslashes($desc) . "','" . addslashes($product_desc) . "',$fk_product,".price2num($price).", '$qty', $txtva, $remise_percent,'".price2num($subprice)."','".price2num( $remise)."') ;";

7
htdocs/compta/facture.php
View File

@ -1563,11 +1563,8 @@ else
$sql.= ' l.remise_percent, l.subprice,'; $sql.= ' l.remise_percent, l.subprice,';
$sql.= ' '.$db->pdate('l.date_start').' as date_start,'; $sql.= ' '.$db->pdate('l.date_start').' as date_start,';
$sql.= ' '.$db->pdate('l.date_end').' as date_end,'; $sql.= ' '.$db->pdate('l.date_end').' as date_end,';
$sql .= ' p.ref, p.fk_product_type, p.label as product'; $sql.= ' p.ref, p.fk_product_type, p.label as product,';
if ($conf->global->FAC_ADD_PROD_DESC && !$conf->global->PRODUIT_CHANGE_PROD_DESC) $sql.= ' p.description as product_desc';
{
$sql.= ', p.description as product_desc';
}
$sql.= ' FROM '.MAIN_DB_PREFIX.'facturedet as l'; $sql.= ' FROM '.MAIN_DB_PREFIX.'facturedet as l';
$sql.= ' LEFT JOIN '.MAIN_DB_PREFIX.'product p ON l.fk_product=p.rowid'; $sql.= ' LEFT JOIN '.MAIN_DB_PREFIX.'product p ON l.fk_product=p.rowid';
$sql.= ' WHERE l.fk_facture = '.$fac->id; $sql.= ' WHERE l.fk_facture = '.$fac->id;

8
htdocs/product/fiche.php
View File

@ -256,8 +256,8 @@ if ($_POST["action"] == 'addincommande')
$commande = New Commande($db); $commande = New Commande($db);
$commande->fetch($_POST["commandeid"]); $commande->fetch($_POST["commandeid"]);
$result = $commande->addline(addslashes($product->libelle), $result = $commande->addline($product->libelle,
addslashes($product->description), $product->description,
$product->price, $product->price,
$_POST["qty"], $_POST["qty"],
$product->tva_tx, $product->tva_tx,
@ -281,8 +281,8 @@ if ($_POST["action"] == 'addinfacture' && $user->rights->facture->creer)
$facture->fetch($_POST["factureid"]); $facture->fetch($_POST["factureid"]);
$facture->addline($_POST["factureid"], $facture->addline($_POST["factureid"],
addslashes($product->libelle), $product->libelle,
addslashes($product->description), $product->description,
"", // volontairement laissé vide pour fonctionnement module multiprix "", // volontairement laissé vide pour fonctionnement module multiprix
$_POST["qty"], $_POST["qty"],
$product->tva_tx, $product->tva_tx,