lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: #15106

Browse Source
This commit is contained in:
Laurent Destailleur 2005-11-30 23:31:19 +00:00
parent 1b3b76ec6e
commit e1a0e766fe
1 changed files with 21 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
htdocs/user.class.php
View File

@ -555,9 +555,12 @@ class User
{ {
global $langs; global $langs;
// Nettoyage parametres
$this->login = trim($this->login);
$this->db->begin(); $this->db->begin();
$sql = "SELECT login FROM ".MAIN_DB_PREFIX."user WHERE login ='".$this->login."';"; $sql = "SELECT login FROM ".MAIN_DB_PREFIX."user WHERE login ='".addslashes($this->login)."'";
$resql=$this->db->query($sql); $resql=$this->db->query($sql);
if ($resql) if ($resql)
{ {
@ -571,7 +574,7 @@ class User
} }
else else
{ {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."user (datec,login) VALUES(now(),'$this->login');"; $sql = "INSERT INTO ".MAIN_DB_PREFIX."user (datec,login) VALUES(now(),'".addslashes($this->login)."')";
$result=$this->db->query($sql); $result=$this->db->query($sql);
if ($result) if ($result)
@ -753,23 +756,31 @@ class User
{ {
global $langs; global $langs;
// Nettoyage parametres
$this->nom=trim($this->nom);
$this->prenom=trim($this->prenom);
$this->login=trim($this->login);
$this->pass=trim($this->pass);
$this->email=trim($this->email);
$this->note=trim($this->note);
$error=0; $error=0;
if (!strlen($this->code)) $this->code = $this->login; if (!strlen($this->code)) $this->code = $this->login;
$sql = "UPDATE ".MAIN_DB_PREFIX."user SET "; $sql = "UPDATE ".MAIN_DB_PREFIX."user SET ";
$sql .= " name = '$this->nom'"; $sql .= " name = '".addslashes($this->nom)."'";
$sql .= ", firstname = '$this->prenom'"; $sql .= ", firstname = '".addslashes($this->prenom)."'";
$sql .= ", login = '$this->login'"; $sql .= ", login = '".addslashes($this->login)."'";
if ($this->pass) $sql .= ", pass = '$this->pass'"; if ($this->pass) $sql .= ", pass = '".addslashes($this->pass)."'";
$sql .= ", admin = $this->admin"; $sql .= ", admin = $this->admin";
$sql .= ", office_phone = '$this->office_phone'"; $sql .= ", office_phone = '$this->office_phone'";
$sql .= ", office_fax = '$this->office_fax'"; $sql .= ", office_fax = '$this->office_fax'";
$sql .= ", user_mobile = '$this->user_mobile'"; $sql .= ", user_mobile = '$this->user_mobile'";
$sql .= ", email = '$this->email'"; $sql .= ", email = '".addslashes($this->email)."'";
$sql .= ", webcal_login = '$this->webcal_login'"; $sql .= ", webcal_login = '$this->webcal_login'";
$sql .= ", code = '$this->code'"; $sql .= ", code = '$this->code'";
$sql .= ", note = '$this->note'"; $sql .= ", note = '".addslashes($this->note)."'";
$sql .= " WHERE rowid = ".$this->id; $sql .= " WHERE rowid = ".$this->id;
$result = $this->db->query($sql); $result = $this->db->query($sql);
@ -853,8 +864,8 @@ class User
$sqlpass = $password; $sqlpass = $password;
} }
$this->pass=$password; $this->pass=$password;
$sql = "UPDATE ".MAIN_DB_PREFIX."user SET pass = '".$sqlpass."'"; $sql = "UPDATE ".MAIN_DB_PREFIX."user SET pass = '".addslashes($sqlpass)."'";
$sql.= " WHERE rowid = $this->id"; $sql.= " WHERE rowid = ".$this->id;
$result = $this->db->query($sql); $result = $this->db->query($sql);
if ($result) if ($result)