From 74ecb0792575424571a6c26dab22374b09f3e63d Mon Sep 17 00:00:00 2001 From: atm-florian Date: Wed, 8 Dec 2021 16:03:21 +0100 Subject: [PATCH 1/4] FIX: printFieldListWhere called twice (at different locations) for the same SQL query, can result in syntax errors --- htdocs/product/stock/replenish.php | 5 ----- 1 file changed, 5 deletions(-) diff --git a/htdocs/product/stock/replenish.php b/htdocs/product/stock/replenish.php index c925d7f0f62..64f77eead74 100644 --- a/htdocs/product/stock/replenish.php +++ b/htdocs/product/stock/replenish.php @@ -505,11 +505,6 @@ if ($includeproductswithoutdesiredqty == 'on') { $includeproductswithoutdesiredqtychecked = 'checked'; } -// Add where from hooks -$parameters = array(); -$reshook = $hookmanager->executeHooks('printFieldListWhere', $parameters); // Note that $action and $object may have been modified by hook -$sql .= $hookmanager->resPrint; - $nbtotalofrecords = ''; if (empty($conf->global->MAIN_DISABLE_FULL_SCANLIST)) { $result = $db->query($sql); From 1123bf3cde436caafd38b07255cfe8959d6e327b Mon Sep 17 00:00:00 2001 From: Maxime Kohlhaas Date: Thu, 9 Dec 2021 09:34:00 +0100 Subject: [PATCH 2/4] =?UTF-8?q?Fix=20#18586=20:=20special=20char=20"?= =?UTF-8?q?=E2=80=A6"=20not=20allowed=20in=20XML=20file=20and=20added=20by?= =?UTF-8?q?=20dol=5Ftrunc?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- htdocs/compta/prelevement/class/bonprelevement.class.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/htdocs/compta/prelevement/class/bonprelevement.class.php b/htdocs/compta/prelevement/class/bonprelevement.class.php index 721d7c10111..92c0db1f55e 100644 --- a/htdocs/compta/prelevement/class/bonprelevement.class.php +++ b/htdocs/compta/prelevement/class/bonprelevement.class.php @@ -1936,7 +1936,7 @@ class BonPrelevement extends CommonObject $XML_DEBITOR .= ' '.$CrLf; $XML_DEBITOR .= ' '.$CrLf; // Add EndToEndId. Must be a unique ID for each payment (for example by including bank, buyer or seller, date, checksum) - $XML_DEBITOR .= ' '.(($conf->global->PRELEVEMENT_END_TO_END != "") ? $conf->global->PRELEVEMENT_END_TO_END : ('AS-'.dol_trunc($row_ref, 20)).'-'.$Rowing).''.$CrLf; // ISO20022 states that EndToEndId has a MaxLength of 35 characters + $XML_DEBITOR .= ' '.(($conf->global->PRELEVEMENT_END_TO_END != "") ? $conf->global->PRELEVEMENT_END_TO_END : ('AS-'.dol_trunc($row_ref, 20, 'right', 'UTF-8', true)).'-'.$Rowing).''.$CrLf; // ISO20022 states that EndToEndId has a MaxLength of 35 characters $XML_DEBITOR .= ' '.$CrLf; $XML_DEBITOR .= ' '.round($row_somme, 2).''.$CrLf; $XML_DEBITOR .= ' '.$CrLf; @@ -1968,7 +1968,7 @@ class BonPrelevement extends CommonObject $XML_DEBITOR .= ' '.$CrLf; $XML_DEBITOR .= ' '.$CrLf; // A string with some information on payment - 140 max - $XML_DEBITOR .= ' '.(($conf->global->PRELEVEMENT_USTRD != "") ? $conf->global->PRELEVEMENT_USTRD : dol_trunc($row_ref, 135)).''.$CrLf; // 140 max + $XML_DEBITOR .= ' '.(($conf->global->PRELEVEMENT_USTRD != "") ? $conf->global->PRELEVEMENT_USTRD : dol_trunc($row_ref, 135, 'right', 'UTF-8', true)).''.$CrLf; // 140 max $XML_DEBITOR .= ' '.$CrLf; $XML_DEBITOR .= ' '.$CrLf; return $XML_DEBITOR; @@ -1978,7 +1978,7 @@ class BonPrelevement extends CommonObject $XML_CREDITOR .= ' '.$CrLf; $XML_CREDITOR .= ' '.$CrLf; // Add EndToEndId. Must be a unique ID for each payment (for example by including bank, buyer or seller, date, checksum) - $XML_CREDITOR .= ' '.(($conf->global->PRELEVEMENT_END_TO_END != "") ? $conf->global->PRELEVEMENT_END_TO_END : ('AS-'.dol_trunc($row_ref, 20)).'-'.$Rowing).''.$CrLf; // ISO20022 states that EndToEndId has a MaxLength of 35 characters + $XML_CREDITOR .= ' '.(($conf->global->PRELEVEMENT_END_TO_END != "") ? $conf->global->PRELEVEMENT_END_TO_END : ('AS-'.dol_trunc($row_ref, 20, 'right', 'UTF-8', true)).'-'.$Rowing).''.$CrLf; // ISO20022 states that EndToEndId has a MaxLength of 35 characters $XML_CREDITOR .= ' '.$CrLf; $XML_CREDITOR .= ' '.$CrLf; $XML_CREDITOR .= ' '.round($row_somme, 2).''.$CrLf; @@ -2015,7 +2015,7 @@ class BonPrelevement extends CommonObject $XML_CREDITOR .= ' '.$CrLf; $XML_CREDITOR .= ' '.$CrLf; // A string with some information on payment - 140 max - $XML_CREDITOR .= ' '.(($conf->global->PRELEVEMENT_USTRD != "") ? $conf->global->PRELEVEMENT_USTRD : dol_trunc($row_ref, 135)).''.$CrLf; // 140 max + $XML_CREDITOR .= ' '.(($conf->global->PRELEVEMENT_USTRD != "") ? $conf->global->PRELEVEMENT_USTRD : dol_trunc($row_ref, 135, 'right', 'UTF-8', true)).''.$CrLf; // 140 max $XML_CREDITOR .= ' '.$CrLf; $XML_CREDITOR .= ' '.$CrLf; return $XML_CREDITOR; From 10984260052e26aa47c756220d7432b28ee074d4 Mon Sep 17 00:00:00 2001 From: Regis Houssin Date: Thu, 9 Dec 2021 10:31:02 +0100 Subject: [PATCH 3/4] FIX wrong syntax of sql request --- htdocs/core/class/html.formaccounting.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/core/class/html.formaccounting.class.php b/htdocs/core/class/html.formaccounting.class.php index fbfde88198b..dc6e6d8c6cd 100644 --- a/htdocs/core/class/html.formaccounting.class.php +++ b/htdocs/core/class/html.formaccounting.class.php @@ -456,7 +456,7 @@ class FormAccounting extends Form $sql = "SELECT code_compta, code_compta_fournisseur, nom as name"; $sql .= " FROM ".MAIN_DB_PREFIX."societe"; $sql .= " WHERE entity IN (".getEntity('societe').")"; - $sql .= " AND client IN (1,3) OR fournisseur = 1"; + $sql .= " AND (client IN (1,3) OR fournisseur = 1)"; $resql = $this->db->query($sql); if ($resql) { From 783ddcc6716052556970206af718d42000206fb3 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Thu, 9 Dec 2021 18:01:44 +0100 Subject: [PATCH 4/4] Fix phpcs --- htdocs/install/repair.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/install/repair.php b/htdocs/install/repair.php index 4aba1d10c4b..9ce982cb458 100644 --- a/htdocs/install/repair.php +++ b/htdocs/install/repair.php @@ -1180,7 +1180,7 @@ if ($ok && GETPOST('clean_perm_table', 'alpha')) { foreach ($conf->modules as $key => $val) { $listofmods .= ($listofmods ? ',' : '')."'".$db->escape($val)."'"; } - $sql = 'SELECT id, libelle as label, module from '.MAIN_DB_PREFIX.'rights_def WHERE module NOT IN ('.$db->sanitize($listofmods, 1).') AND id > 100000'; + $sql = "SELECT id, libelle as label, module from ".MAIN_DB_PREFIX."rights_def WHERE module NOT IN (".$db->sanitize($listofmods, 1).") AND id > 100000"; $resql = $db->query($sql); if ($resql) { $num = $db->num_rows($resql); @@ -1191,7 +1191,7 @@ if ($ok && GETPOST('clean_perm_table', 'alpha')) { if ($obj->id > 0) { print 'Found line with id '.$obj->id.', label "'.$obj->label.'" of module "'.$obj->module.'" to delete'; if (GETPOST('clean_perm_table', 'alpha') == 'confirmed') { - $sqldelete = 'DELETE FROM '.MAIN_DB_PREFIX.'rights_def WHERE id = '.$obj->id; + $sqldelete = "DELETE FROM ".MAIN_DB_PREFIX."rights_def WHERE id = ".((int) $obj->id); $resqldelete = $db->query($sqldelete); if (!$resqldelete) { dol_print_error($db);