'.$langs->trans("MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED").' ';
if (isset($conf->global->MAIN_MAIL_SENDMODE_EMAILING) && in_array($conf->global->MAIN_MAIL_SENDMODE_EMAILING, array('smtps', 'swiftmailer'))) {
if (function_exists('openssl_open')) {
- print yn($conf->global->MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED_EMAILING);
+ print yn(getDolGlobalInt('MAIN_MAIL_EMAIL_SMTP_ALLOW_SELF_SIGNED_EMAILING'));
} else {
print yn(0).' ('.$langs->trans("YourPHPDoesNotHaveSSLSupport").')';
}
@@ -503,11 +503,9 @@ if ($action == 'edit') {
print ' ';
/*
// Warning 1
- if ($linuxlike)
- {
+ if ($linuxlike) {
$sendmailoption=ini_get('mail.force_extra_parameters');
- if (empty($sendmailoption) || ! preg_match('/ba/',$sendmailoption))
- {
+ if (empty($sendmailoption) || ! preg_match('/ba/',$sendmailoption)) {
print info_admin($langs->trans("SendmailOptionNotComplete"));
}
}*/
diff --git a/htdocs/admin/notification.php b/htdocs/admin/notification.php
index 1192034e052..e1cf115626f 100644
--- a/htdocs/admin/notification.php
+++ b/htdocs/admin/notification.php
@@ -92,7 +92,7 @@ if ($action == 'settemplates') {
if ($action == 'setvalue' && $user->admin) {
$db->begin();
- $result = dolibarr_set_const($db, "NOTIFICATION_EMAIL_FROM", GETPOST("email_from", "restricthtml"), 'chaine', 0, '', $conf->entity);
+ $result = dolibarr_set_const($db, "NOTIFICATION_EMAIL_FROM", GETPOST("email_from", "alphawithlgt"), 'chaine', 0, '', $conf->entity);
if ($result < 0) {
$error++;
}
@@ -270,7 +270,7 @@ if ($conf->global->MAIN_FEATURES_LEVEL >= 2) {
}
$helptext = '';
- form_constantes($constantes, 2, $helptext);
+ form_constantes($constantes, 3, $helptext);
} else {
print '';
print '';
diff --git a/htdocs/admin/order_extrafields.php b/htdocs/admin/order_extrafields.php
index 701156303bb..e11ac077cc6 100644
--- a/htdocs/admin/order_extrafields.php
+++ b/htdocs/admin/order_extrafields.php
@@ -93,12 +93,7 @@ if ($action != 'create' && $action != 'edit') {
}
-/* ************************************************************************** */
-/* */
-/* Creation of an optional field */
-/* */
-/* ************************************************************************** */
-
+// Creation of an optional field
if ($action == 'create') {
print '
';
print load_fiche_titre($langs->trans('NewAttribute'));
@@ -106,11 +101,7 @@ if ($action == 'create') {
require DOL_DOCUMENT_ROOT.'/core/tpl/admin_extrafields_add.tpl.php';
}
-/* ************************************************************************** */
-/* */
-/* Edition of an optional field */
-/* */
-/* ************************************************************************** */
+// Edition of an optional field
if ($action == 'edit' && !empty($attrname)) {
print " ";
print load_fiche_titre($langs->trans("FieldEdition", $attrname));
diff --git a/htdocs/admin/orderdet_extrafields.php b/htdocs/admin/orderdet_extrafields.php
index 6869d7897b3..c89ff3e3655 100644
--- a/htdocs/admin/orderdet_extrafields.php
+++ b/htdocs/admin/orderdet_extrafields.php
@@ -94,12 +94,7 @@ if ($action != 'create' && $action != 'edit') {
}
-/* ************************************************************************** */
-/* */
-/* Creation of an optional field */
-/* */
-/* ************************************************************************** */
-
+// Creation of an optional field
if ($action == 'create') {
print '
';
print load_fiche_titre($langs->trans('NewAttribute'));
@@ -107,11 +102,7 @@ if ($action == 'create') {
require DOL_DOCUMENT_ROOT.'/core/tpl/admin_extrafields_add.tpl.php';
}
-/* ************************************************************************** */
-/* */
-/* Edition of an optional field */
-/* */
-/* ************************************************************************** */
+// Edition of an optional field
if ($action == 'edit' && !empty($attrname)) {
print " ";
print load_fiche_titre($langs->trans("FieldEdition", $attrname));
diff --git a/htdocs/admin/perms.php b/htdocs/admin/perms.php
index e60f2118f2c..31304c85819 100644
--- a/htdocs/admin/perms.php
+++ b/htdocs/admin/perms.php
@@ -132,7 +132,7 @@ print ' '."\n";
$sql = "SELECT r.id, r.libelle as label, r.module, r.module_position, r.perms, r.subperms, r.bydefault";
$sql .= " FROM ".MAIN_DB_PREFIX."rights_def as r";
$sql .= " WHERE r.libelle NOT LIKE 'tou%'"; // On ignore droits "tous"
-$sql .= " AND r.entity = ".$entity;
+$sql .= " AND r.entity = ".((int) $entity);
if (empty($conf->global->MAIN_USE_ADVANCED_PERMS)) {
$sql .= " AND r.perms NOT LIKE '%_advance'"; // Hide advanced perms if option is not enabled
}
diff --git a/htdocs/admin/reception_extrafields.php b/htdocs/admin/reception_extrafields.php
index 9dea1bf8fd7..ab7d18b1331 100644
--- a/htdocs/admin/reception_extrafields.php
+++ b/htdocs/admin/reception_extrafields.php
@@ -99,12 +99,7 @@ if ($action != 'create' && $action != 'edit') {
}
-/* ************************************************************************** */
-/* */
-/* Creation of an optional field */
-/* */
-/* ************************************************************************** */
-
+// Creation of an optional field
if ($action == 'create') {
print " ";
print load_fiche_titre($langs->trans('NewAttribute'));
@@ -112,11 +107,7 @@ if ($action == 'create') {
require DOL_DOCUMENT_ROOT.'/core/tpl/admin_extrafields_add.tpl.php';
}
-/* ************************************************************************** */
-/* */
-/* Edition of an optional field */
-/* */
-/* ************************************************************************** */
+// Edition of an optional field
if ($action == 'edit' && !empty($attrname)) {
print " ";
print load_fiche_titre($langs->trans("FieldEdition", $attrname));
diff --git a/htdocs/admin/resource_extrafields.php b/htdocs/admin/resource_extrafields.php
index ff13b5f4573..c4967f75313 100644
--- a/htdocs/admin/resource_extrafields.php
+++ b/htdocs/admin/resource_extrafields.php
@@ -92,13 +92,7 @@ if ($action != 'create' && $action != 'edit') {
print "";
}
-
-/* ************************************************************************** */
-/* */
-/* Creation of an optional field */
-/* */
-/* ************************************************************************** */
-
+// Creation of an optional field
if ($action == 'create') {
print '
';
print load_fiche_titre($langs->trans('NewAttribute'));
@@ -106,11 +100,7 @@ if ($action == 'create') {
require DOL_DOCUMENT_ROOT.'/core/tpl/admin_extrafields_add.tpl.php';
}
-/* ************************************************************************** */
-/* */
-/* Edition of an optional field */
-/* */
-/* ************************************************************************** */
+// Edition of an optional field
if ($action == 'edit' && !empty($attrname)) {
print " ";
print load_fiche_titre($langs->trans("FieldEdition", $attrname));
diff --git a/htdocs/admin/supplierinvoice_extrafields.php b/htdocs/admin/supplierinvoice_extrafields.php
index 59e0e857161..4121073dec2 100644
--- a/htdocs/admin/supplierinvoice_extrafields.php
+++ b/htdocs/admin/supplierinvoice_extrafields.php
@@ -93,13 +93,7 @@ if ($action != 'create' && $action != 'edit') {
print "";
}
-
-/* ************************************************************************** */
-/* */
-/* Creation of an optional field */
-/* */
-/* ************************************************************************** */
-
+// Creation of an optional field
if ($action == 'create') {
print '
';
print load_fiche_titre($langs->trans('NewAttribute'));
@@ -107,11 +101,7 @@ if ($action == 'create') {
require DOL_DOCUMENT_ROOT.'/core/tpl/admin_extrafields_add.tpl.php';
}
-/* ************************************************************************** */
-/* */
-/* Edition of an optional field */
-/* */
-/* ************************************************************************** */
+// Edition of an optional field
if ($action == 'edit' && !empty($attrname)) {
print " ";
print load_fiche_titre($langs->trans("FieldEdition", $attrname));
diff --git a/htdocs/admin/supplierinvoicedet_extrafields.php b/htdocs/admin/supplierinvoicedet_extrafields.php
index 61a14a34844..0156eed5072 100644
--- a/htdocs/admin/supplierinvoicedet_extrafields.php
+++ b/htdocs/admin/supplierinvoicedet_extrafields.php
@@ -95,13 +95,7 @@ if ($action != 'create' && $action != 'edit') {
print "";
}
-
-/* ************************************************************************** */
-/* */
-/* Creation of an optional field */
-/* */
-/* ************************************************************************** */
-
+// Creation of an optional field
if ($action == 'create') {
print '
';
print load_fiche_titre($langs->trans('NewAttribute'));
@@ -109,11 +103,7 @@ if ($action == 'create') {
require DOL_DOCUMENT_ROOT.'/core/tpl/admin_extrafields_add.tpl.php';
}
-/* ************************************************************************** */
-/* */
-/* Edition of an optional field */
-/* */
-/* ************************************************************************** */
+// Edition of an optional field
if ($action == 'edit' && !empty($attrname)) {
print " ";
print load_fiche_titre($langs->trans("FieldEdition", $attrname));
diff --git a/htdocs/admin/supplierorder_extrafields.php b/htdocs/admin/supplierorder_extrafields.php
index 5e0cfb38d4c..5a49c8f5bfd 100644
--- a/htdocs/admin/supplierorder_extrafields.php
+++ b/htdocs/admin/supplierorder_extrafields.php
@@ -93,13 +93,7 @@ if ($action != 'create' && $action != 'edit') {
print "";
}
-
-/* ************************************************************************** */
-/* */
-/* Creation of an optional field */
-/* */
-/* ************************************************************************** */
-
+// Creation of an optional field
if ($action == 'create') {
print '
';
print load_fiche_titre($langs->trans('NewAttribute'));
@@ -107,11 +101,7 @@ if ($action == 'create') {
require DOL_DOCUMENT_ROOT.'/core/tpl/admin_extrafields_add.tpl.php';
}
-/* ************************************************************************** */
-/* */
-/* Edition of an optional field */
-/* */
-/* ************************************************************************** */
+// Edition of an optional field
if ($action == 'edit' && !empty($attrname)) {
print " ";
print load_fiche_titre($langs->trans("FieldEdition", $attrname));
diff --git a/htdocs/admin/supplierorderdet_extrafields.php b/htdocs/admin/supplierorderdet_extrafields.php
index 25689c7b9f5..07f223d59c8 100644
--- a/htdocs/admin/supplierorderdet_extrafields.php
+++ b/htdocs/admin/supplierorderdet_extrafields.php
@@ -94,13 +94,7 @@ if ($action != 'create' && $action != 'edit') {
print "";
}
-
-/* ************************************************************************** */
-/* */
-/* Creation of an optional field */
-/* */
-/* ************************************************************************** */
-
+// Creation of an optional field
if ($action == 'create') {
print '
';
print load_fiche_titre($langs->trans('NewAttribute'));
@@ -108,11 +102,7 @@ if ($action == 'create') {
require DOL_DOCUMENT_ROOT.'/core/tpl/admin_extrafields_add.tpl.php';
}
-/* ************************************************************************** */
-/* */
-/* Edition of an optional field */
-/* */
-/* ************************************************************************** */
+// Edition of an optional field
if ($action == 'edit' && !empty($attrname)) {
print " ";
print load_fiche_titre($langs->trans("FieldEdition", $attrname));
diff --git a/htdocs/admin/system/constall.php b/htdocs/admin/system/constall.php
index 14756541d55..96cb98809ef 100644
--- a/htdocs/admin/system/constall.php
+++ b/htdocs/admin/system/constall.php
@@ -223,7 +223,7 @@ if (empty($conf->multicompany->enabled)) {
} else {
// If multicompany mode, superadmin (user->entity=0) can see everything, admin are limited to their entities.
if ($user->entity) {
- $sql .= " WHERE entity IN (".$user->entity.",".$conf->entity.")";
+ $sql .= " WHERE entity IN (".$db->sanitize($user->entity.",".$conf->entity).")";
}
}
$sql .= " ORDER BY entity, name ASC";
diff --git a/htdocs/admin/system/dolibarr.php b/htdocs/admin/system/dolibarr.php
index cfdc196d79d..b4131a4bdde 100644
--- a/htdocs/admin/system/dolibarr.php
+++ b/htdocs/admin/system/dolibarr.php
@@ -484,7 +484,7 @@ if (empty($conf->multicompany->enabled)) {
} else {
// If multicompany mode, superadmin (user->entity=0) can see everything, admin are limited to their entities.
if ($user->entity) {
- $sql .= " WHERE entity IN (".$user->entity.",".$conf->entity.")";
+ $sql .= " WHERE entity IN (".$db->sanitize($user->entity.",".$conf->entity).")";
}
}
$sql .= " ORDER BY entity, name ASC";
diff --git a/htdocs/admin/ticket_extrafields.php b/htdocs/admin/ticket_extrafields.php
index 4a50beaa32e..0a4a851dae2 100644
--- a/htdocs/admin/ticket_extrafields.php
+++ b/htdocs/admin/ticket_extrafields.php
@@ -84,12 +84,7 @@ if ($action != 'create' && $action != 'edit') {
print "";
}
-/* ************************************************************************** */
-/* */
-/* Creation d'un champ optionnel */
-/* */
-/* ************************************************************************** */
-
+// Creation of an optional field
if ($action == 'create') {
print " ";
print load_fiche_titre($langs->trans('NewAttribute'));
@@ -97,11 +92,7 @@ if ($action == 'create') {
include DOL_DOCUMENT_ROOT.'/core/tpl/admin_extrafields_add.tpl.php';
}
-/* ************************************************************************** */
-/* */
-/* Edition d'un champ optionnel */
-/* */
-/* ************************************************************************** */
+// Edition of an optional field
if ($action == 'edit' && !empty($attrname)) {
print " ";
print load_fiche_titre($langs->trans("FieldEdition", $attrname));
diff --git a/htdocs/asset/admin/assets_type_extrafields.php b/htdocs/asset/admin/assets_type_extrafields.php
index 6d2799e0228..165361f7f57 100644
--- a/htdocs/asset/admin/assets_type_extrafields.php
+++ b/htdocs/asset/admin/assets_type_extrafields.php
@@ -82,13 +82,7 @@ if ($action != 'create' && $action != 'edit') {
print "";
}
-
-/* ************************************************************************** */
-/* */
-/* Creation of an optional field */
-/* */
-/* ************************************************************************** */
-
+// Creation of an optional field
if ($action == 'create') {
print " ";
print load_fiche_titre($langs->trans('NewAttribute'));
@@ -96,11 +90,7 @@ if ($action == 'create') {
require DOL_DOCUMENT_ROOT.'/core/tpl/admin_extrafields_add.tpl.php';
}
-/* ************************************************************************** */
-/* */
-/* Edition of an optional field */
-/* */
-/* ************************************************************************** */
+// Edition of an optional field
if ($action == 'edit' && !empty($attrname)) {
print " ";
print load_fiche_titre($langs->trans("FieldEdition", $attrname));
diff --git a/htdocs/asset/class/asset_type.class.php b/htdocs/asset/class/asset_type.class.php
index 6b345aaef68..17943f4dfd4 100644
--- a/htdocs/asset/class/asset_type.class.php
+++ b/htdocs/asset/class/asset_type.class.php
@@ -332,7 +332,7 @@ class AssetType extends CommonObject
/**
* Return array of Asset objects for asset type this->id (or all if this->id not defined)
*
- * @param string $excludefilter Filter to exclude
+ * @param string $excludefilter Filter to exclude. This parameter must not be provided by input of users
* @param int $mode 0=Return array of asset instance
* 1=Return array of asset instance without extra data
* 2=Return array of asset id only
diff --git a/htdocs/asset/document.php b/htdocs/asset/document.php
index e5db1465fb6..ce8adad8e34 100644
--- a/htdocs/asset/document.php
+++ b/htdocs/asset/document.php
@@ -82,8 +82,10 @@ include DOL_DOCUMENT_ROOT.'/core/actions_linkedfiles.inc.php';
*/
$title = $langs->trans('Assets')." - ".$langs->trans('Documents');
-$helpurl = '';
-llxHeader('', $title, $helpurl);
+
+$help_url = '';
+
+llxHeader('', $title, $help_url);
$form = new Form($db);
diff --git a/htdocs/asset/info.php b/htdocs/asset/info.php
index f6d34454ad4..7a8f4c20ce2 100644
--- a/htdocs/asset/info.php
+++ b/htdocs/asset/info.php
@@ -57,8 +57,10 @@ $object->fetch($id);
$form = new Form($db);
$title = $langs->trans('Asset')." - ".$langs->trans('Info');
-$helpurl = "";
-llxHeader('', $title, $helpurl);
+
+$help_url = "";
+
+llxHeader('', $title, $help_url);
$object->info($id);
diff --git a/htdocs/asset/type.php b/htdocs/asset/type.php
index 9d7e848b6d3..6103b963e21 100644
--- a/htdocs/asset/type.php
+++ b/htdocs/asset/type.php
@@ -196,8 +196,9 @@ if ($action == 'confirm_delete' && $user->rights->asset->write) {
$form = new Form($db);
-$helpurl = '';
-llxHeader('', $langs->trans("AssetsTypeSetup"), $helpurl);
+$help_url = '';
+
+llxHeader('', $langs->trans("AssetsTypeSetup"), $help_url);
// List of asset type
diff --git a/htdocs/barcode/printsheet.php b/htdocs/barcode/printsheet.php
index a8033cf1c7a..ff57587d1b4 100644
--- a/htdocs/barcode/printsheet.php
+++ b/htdocs/barcode/printsheet.php
@@ -286,7 +286,7 @@ print '';
// Sheet format
print '
';
-print '
';
+print '
';
print $langs->trans("DescADHERENT_ETIQUETTE_TYPE").' ';
print '
';
// List of possible labels (defined into $_Avery_Labels variable set into core/lib/format_cards.lib.php)
@@ -302,7 +302,7 @@ print '
';
// Number of stickers to print
print '
';
-print '
';
+print '
';
print $langs->trans("NumberOfStickers").' ';
print '
';
print ' ';
diff --git a/htdocs/bom/bom_list.php b/htdocs/bom/bom_list.php
index eb1852699c0..62fb6002760 100644
--- a/htdocs/bom/bom_list.php
+++ b/htdocs/bom/bom_list.php
@@ -76,18 +76,6 @@ if (!$sortorder) {
$sortorder = "ASC";
}
-// Security check
-if (empty($conf->bom->enabled)) {
- accessforbidden('Module not enabled');
-}
-$socid = 0;
-if ($user->socid > 0) {
- // Protection if external user
- //$socid = $user->socid;
- accessforbidden();
-}
-//$result = restrictedArea($user, 'bom', $id, '');
-
// Initialize array of search criterias
$search_all = GETPOST("search_all", 'alpha');
$search = array();
@@ -133,6 +121,13 @@ $permissiontoread = $user->rights->bom->read;
$permissiontoadd = $user->rights->bom->write;
$permissiontodelete = $user->rights->bom->delete;
+// Security check
+if ($user->socid > 0) {
+ // Protection if external user
+ accessforbidden();
+}
+$result = restrictedArea($user, 'bom');
+
/*
* Actions
diff --git a/htdocs/bom/class/api_boms.class.php b/htdocs/bom/class/api_boms.class.php
index 24ec68d0e2f..b0f536140dd 100644
--- a/htdocs/bom/class/api_boms.class.php
+++ b/htdocs/bom/class/api_boms.class.php
@@ -134,14 +134,14 @@ class Boms extends DolibarrApi
$sql .= " AND t.fk_soc = sc.fk_soc";
}
if ($restrictonsocid && $socid) {
- $sql .= " AND t.fk_soc = ".$socid;
+ $sql .= " AND t.fk_soc = ".((int) $socid);
}
if ($restrictonsocid && $search_sale > 0) {
$sql .= " AND t.rowid = sc.fk_soc"; // Join for the needed table to filter by sale
}
// Insert sale filter
if ($restrictonsocid && $search_sale > 0) {
- $sql .= " AND sc.fk_user = ".$search_sale;
+ $sql .= " AND sc.fk_user = ".((int) $search_sale);
}
if ($sqlfilters) {
if (!DolibarrApi::_checkFilters($sqlfilters)) {
diff --git a/htdocs/categories/admin/categorie_extrafields.php b/htdocs/categories/admin/categorie_extrafields.php
index 0d691995c29..02cd6e2a784 100644
--- a/htdocs/categories/admin/categorie_extrafields.php
+++ b/htdocs/categories/admin/categorie_extrafields.php
@@ -86,13 +86,7 @@ if ($action != 'create' && $action != 'edit') {
print "
";
}
-
-/* ************************************************************************** */
-/* */
-/* Creation of an optional field */
-/* */
-/* ************************************************************************** */
-
+// Creation of an optional field
if ($action == 'create') {
print '
';
print load_fiche_titre($langs->trans('NewAttribute'));
@@ -100,11 +94,7 @@ if ($action == 'create') {
require DOL_DOCUMENT_ROOT.'/core/tpl/admin_extrafields_add.tpl.php';
}
-/* ************************************************************************** */
-/* */
-/* Edition of an optional field */
-/* */
-/* ************************************************************************** */
+// Edition of an optional field
if ($action == 'edit' && !empty($attrname)) {
print "
";
print load_fiche_titre($langs->trans("FieldEdition", $attrname));
diff --git a/htdocs/categories/card.php b/htdocs/categories/card.php
index 9f275033b01..734f2e89506 100644
--- a/htdocs/categories/card.php
+++ b/htdocs/categories/card.php
@@ -208,8 +208,9 @@ if (($action == 'add' || $action == 'confirmed') && $user->rights->categorie->cr
$form = new Form($db);
$formother = new FormOther($db);
-$helpurl = 'EN:Module_Categories|FR:Module_Catégories';
-llxHeader("", $langs->trans("Categories"), $helpurl);
+$help_url = 'EN:Module_Categories|FR:Module_Catégories|DE:Modul_Kategorien';
+
+llxHeader("", $langs->trans("Categories"), $help_url);
if ($user->rights->categorie->creer) {
// Create or add
diff --git a/htdocs/categories/class/categorie.class.php b/htdocs/categories/class/categorie.class.php
index ba8ffe0e89f..880b0cc69df 100644
--- a/htdocs/categories/class/categorie.class.php
+++ b/htdocs/categories/class/categorie.class.php
@@ -1300,7 +1300,7 @@ class Categorie extends CommonObject
$sql = "SELECT c.rowid";
$sql .= " FROM ".MAIN_DB_PREFIX."categorie as c ";
$sql .= " WHERE c.entity IN (".getEntity('category').")";
- $sql .= " AND c.type = ".$type;
+ $sql .= " AND c.type = ".((int) $type);
$sql .= " AND c.fk_parent = ".$this->fk_parent;
$sql .= " AND c.label = '".$this->db->escape($this->label)."'";
@@ -1792,7 +1792,7 @@ class Categorie extends CommonObject
$sql = "SELECT rowid";
$sql .= " FROM ".MAIN_DB_PREFIX."categorie_lang";
$sql .= " WHERE fk_category=".$this->id;
- $sql .= " AND lang='".$key."'";
+ $sql .= " AND lang = '".$this->db->escape($key)."'";
$result = $this->db->query($sql);
diff --git a/htdocs/categories/viewcat.php b/htdocs/categories/viewcat.php
index dedb368202d..817c750a571 100644
--- a/htdocs/categories/viewcat.php
+++ b/htdocs/categories/viewcat.php
@@ -207,8 +207,10 @@ $formother = new FormOther($db);
$arrayofjs = array('/includes/jquery/plugins/jquerytreeview/jquery.treeview.js', '/includes/jquery/plugins/jquerytreeview/lib/jquery.cookie.js');
$arrayofcss = array('/includes/jquery/plugins/jquerytreeview/jquery.treeview.css');
-$helpurl = '';
-llxHeader("", $langs->trans("Categories"), $helpurl, '', 0, 0, $arrayofjs, $arrayofcss);
+
+$help_url = '';
+
+llxHeader("", $langs->trans("Categories"), $help_url, '', 0, 0, $arrayofjs, $arrayofcss);
$title = Categorie::$MAP_TYPE_TITLE_AREA[$type];
diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php
index 391b418f5b8..db26bc4ad22 100644
--- a/htdocs/comm/action/card.php
+++ b/htdocs/comm/action/card.php
@@ -1896,7 +1896,8 @@ if ($id > 0) {
if (!empty($conf->global->AGENDA_USE_EVENT_TYPE)) {
print '
'.$langs->trans("Type").' ';
print $object->getTypePicto();
- print $langs->trans($object->type).' ';
+ print $langs->trans("Action".$object->type_code);
+ print '';
}
// Full day event
diff --git a/htdocs/comm/action/class/actioncomm.class.php b/htdocs/comm/action/class/actioncomm.class.php
index 21c130cafac..4bef5ddcd16 100644
--- a/htdocs/comm/action/class/actioncomm.class.php
+++ b/htdocs/comm/action/class/actioncomm.class.php
@@ -1227,17 +1227,17 @@ class ActionComm extends CommonObject
$sql .= " FROM ".MAIN_DB_PREFIX."actioncomm as a";
$sql .= " WHERE a.entity IN (".getEntity('agenda').")";
if (!empty($socid)) {
- $sql .= " AND a.fk_soc = ".$socid;
+ $sql .= " AND a.fk_soc = ".((int) $socid);
}
if (!empty($elementtype)) {
if ($elementtype == 'project') {
- $sql .= ' AND a.fk_project = '.$fk_element;
+ $sql .= ' AND a.fk_project = '.((int) $fk_element);
} elseif ($elementtype == 'contact') {
$sql .= ' AND a.id IN';
$sql .= " (SELECT fk_actioncomm FROM ".MAIN_DB_PREFIX."actioncomm_resources WHERE";
- $sql .= " element_type = 'socpeople' AND fk_element = ".$fk_element.')';
+ $sql .= " element_type = 'socpeople' AND fk_element = ".((int) $fk_element).')';
} else {
- $sql .= " AND a.fk_element = ".(int) $fk_element." AND a.elementtype = '".$db->escape($elementtype)."'";
+ $sql .= " AND a.fk_element = ".((int) $fk_element)." AND a.elementtype = '".$db->escape($elementtype)."'";
}
}
if (!empty($filter)) {
diff --git a/htdocs/comm/action/class/api_agendaevents.class.php b/htdocs/comm/action/class/api_agendaevents.class.php
index 9ad3dd8ce51..5d57b9624e3 100644
--- a/htdocs/comm/action/class/api_agendaevents.class.php
+++ b/htdocs/comm/action/class/api_agendaevents.class.php
@@ -147,14 +147,14 @@ class AgendaEvents extends DolibarrApi
}
}
if ($user_ids) {
- $sql .= " AND t.fk_user_action IN (".$user_ids.")";
+ $sql .= " AND t.fk_user_action IN (".$this->db->sanitize($user_ids).")";
}
if ($socid > 0) {
- $sql .= " AND t.fk_soc = ".$socid;
+ $sql .= " AND t.fk_soc = ".((int) $socid);
}
// Insert sale filter
if ($search_sale > 0) {
- $sql .= " AND sc.fk_user = ".$search_sale;
+ $sql .= " AND sc.fk_user = ".((int) $search_sale);
}
// Add sql filters
if ($sqlfilters) {
diff --git a/htdocs/comm/action/index.php b/htdocs/comm/action/index.php
index 6c92f07085b..b8d443d8096 100644
--- a/htdocs/comm/action/index.php
+++ b/htdocs/comm/action/index.php
@@ -115,8 +115,8 @@ if ($dateselect > 0) {
}
// Set actioncode (this code must be same for setting actioncode into peruser, listacton and index)
-if (GETPOST('search_actioncode', 'array')) {
- $actioncode = GETPOST('search_actioncode', 'array', 3);
+if (GETPOST('search_actioncode', 'array:aZ09')) {
+ $actioncode = GETPOST('search_actioncode', 'array:aZ09', 3);
if (!count($actioncode)) {
$actioncode = '0';
}
@@ -669,18 +669,18 @@ if (!empty($actioncode)) {
$sql .= " AND ca.type = 'systemauto'";
} else {
if (is_array($actioncode)) {
- $sql .= " AND ca.code IN ('".implode("','", $actioncode)."')";
+ $sql .= " AND ca.code IN (".$db->sanitize("'".implode("','", $actioncode)."'", 1).")";
} else {
- $sql .= " AND ca.code IN ('".implode("','", explode(',', $actioncode))."')";
+ $sql .= " AND ca.code IN (".$db->sanitize("'".implode("','", explode(',', $actioncode))."'", 1).")";
}
}
}
}
if ($resourceid > 0) {
- $sql .= " AND r.element_type = 'action' AND r.element_id = a.id AND r.resource_id = ".$db->escape($resourceid);
+ $sql .= " AND r.element_type = 'action' AND r.element_id = a.id AND r.resource_id = ".((int) $resourceid);
}
if ($pid) {
- $sql .= " AND a.fk_project=".$db->escape($pid);
+ $sql .= " AND a.fk_project=".((int) $pid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND (a.fk_soc IS NULL OR sc.fk_user = ".$user->id.")";
diff --git a/htdocs/comm/action/list.php b/htdocs/comm/action/list.php
index 64ed79d87ca..888a13fb4b8 100644
--- a/htdocs/comm/action/list.php
+++ b/htdocs/comm/action/list.php
@@ -429,31 +429,31 @@ if (!empty($actioncode)) {
$sql .= " AND c.type = 'systemauto'";
} else {
if (is_array($actioncode)) {
- $sql .= " AND c.code IN ('".implode("','", $actioncode)."')";
+ $sql .= " AND c.code IN (".$db->sanitize("'".implode("','", $actioncode)."'", 1).")";
} else {
- $sql .= " AND c.code IN ('".implode("','", explode(',', $actioncode))."')";
+ $sql .= " AND c.code IN (".$db->sanitize("'".implode("','", explode(',', $actioncode))."'", 1).")";
}
}
}
}
if ($resourceid > 0) {
- $sql .= " AND r.element_type = 'action' AND r.element_id = a.id AND r.resource_id = ".$db->escape($resourceid);
+ $sql .= " AND r.element_type = 'action' AND r.element_id = a.id AND r.resource_id = ".((int) $resourceid);
}
if ($pid) {
- $sql .= " AND a.fk_project=".$db->escape($pid);
+ $sql .= " AND a.fk_project=".((int) $pid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND (a.fk_soc IS NULL OR sc.fk_user = ".$user->id.")";
}
if ($socid > 0) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
// We must filter on assignement table
if ($filtert > 0 || $usergroup > 0) {
$sql .= " AND ar.fk_actioncomm = a.id AND ar.element_type='user'";
}
if ($type) {
- $sql .= " AND c.id = ".(int) $type;
+ $sql .= " AND c.id = ".((int) $type);
}
if ($search_status == '0') {
$sql .= " AND a.percent = 0";
@@ -486,10 +486,10 @@ if ($search_note) {
if ($filtert > 0 || $usergroup > 0) {
$sql .= " AND (";
if ($filtert > 0) {
- $sql .= "(ar.fk_element = ".$filtert." OR (ar.fk_element IS NULL AND a.fk_user_action=".$filtert."))"; // The OR is for backward compatibility
+ $sql .= "(ar.fk_element = ".((int) $filtert)." OR (ar.fk_element IS NULL AND a.fk_user_action = ".((int) $filtert)."))"; // The OR is for backward compatibility
}
if ($usergroup > 0) {
- $sql .= ($filtert > 0 ? " OR " : "")." ugu.fk_usergroup = ".$usergroup;
+ $sql .= ($filtert > 0 ? " OR " : "")." ugu.fk_usergroup = ".((int) $usergroup);
}
$sql .= ")";
}
diff --git a/htdocs/comm/action/pertype.php b/htdocs/comm/action/pertype.php
index dc70fb30743..3b55399a58a 100644
--- a/htdocs/comm/action/pertype.php
+++ b/htdocs/comm/action/pertype.php
@@ -540,24 +540,24 @@ if (!empty($actioncode)) {
$sql .= " AND ca.type = 'systemauto'";
} else {
if (is_array($actioncode)) {
- $sql .= " AND ca.code IN ('".implode("','", $actioncode)."')";
+ $sql .= " AND ca.code IN (".$db->sanitize("'".implode("','", $actioncode)."'", 1).")";
} else {
- $sql .= " AND ca.code IN ('".implode("','", explode(',', $actioncode))."')";
+ $sql .= " AND ca.code IN (".$db->sanitize("'".implode("','", explode(',', $actioncode))."'", 1).")";
}
}
}
}
if ($resourceid > 0) {
- $sql .= " AND r.element_type = 'action' AND r.element_id = a.id AND r.resource_id = ".$db->escape($resourceid);
+ $sql .= " AND r.element_type = 'action' AND r.element_id = a.id AND r.resource_id = ".((int) $resourceid);
}
if ($pid) {
- $sql .= " AND a.fk_project=".$db->escape($pid);
+ $sql .= " AND a.fk_project=".((int) $pid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND (a.fk_soc IS NULL OR sc.fk_user = ".$user->id.")";
}
if ($socid > 0) {
- $sql .= ' AND a.fk_soc = '.$socid;
+ $sql .= ' AND a.fk_soc = '.((int) $socid);
}
// We must filter on assignement table
if ($filtert > 0 || $usergroup > 0) {
diff --git a/htdocs/comm/action/peruser.php b/htdocs/comm/action/peruser.php
index 388363f63fc..8c440395083 100644
--- a/htdocs/comm/action/peruser.php
+++ b/htdocs/comm/action/peruser.php
@@ -105,8 +105,8 @@ $type = GETPOST("search_type", 'alpha') ?GETPOST("search_type", 'alpha') : GETPO
$maxprint = ((GETPOST("maxprint", 'int') != '') ?GETPOST("maxprint", 'int') : $conf->global->AGENDA_MAX_EVENTS_DAY_VIEW);
$optioncss = GETPOST('optioncss', 'aZ'); // Option for the css output (always '' except when 'print')
// Set actioncode (this code must be same for setting actioncode into peruser, listacton and index)
-if (GETPOST('search_actioncode', 'array')) {
- $actioncode = GETPOST('search_actioncode', 'array', 3);
+if (GETPOST('search_actioncode', 'array:aZ09')) {
+ $actioncode = GETPOST('search_actioncode', 'array:aZ09', 3);
if (!count($actioncode)) {
$actioncode = '0';
}
@@ -562,24 +562,24 @@ if (!empty($actioncode)) {
$sql .= " AND ca.type = 'systemauto'";
} else {
if (is_array($actioncode)) {
- $sql .= " AND ca.code IN ('".implode("','", $actioncode)."')";
+ $sql .= " AND ca.code IN (".$db->sanitize("'".implode("','", $actioncode)."'", 1).")";
} else {
- $sql .= " AND ca.code IN ('".implode("','", explode(',', $actioncode))."')";
+ $sql .= " AND ca.code IN (".$db->sanitize("'".implode("','", explode(',', $actioncode))."'", 1).")";
}
}
}
}
if ($resourceid > 0) {
- $sql .= " AND r.element_type = 'action' AND r.element_id = a.id AND r.resource_id = ".$db->escape($resourceid);
+ $sql .= " AND r.element_type = 'action' AND r.element_id = a.id AND r.resource_id = ".((int) $resourceid);
}
if ($pid) {
- $sql .= " AND a.fk_project=".$db->escape($pid);
+ $sql .= " AND a.fk_project = ".((int) $pid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND (a.fk_soc IS NULL OR sc.fk_user = ".$user->id.")";
}
if ($socid > 0) {
- $sql .= ' AND a.fk_soc = '.$socid;
+ $sql .= ' AND a.fk_soc = '.((int) $socid);
}
// We must filter on assignement table
if ($filtert > 0 || $usergroup > 0) {
diff --git a/htdocs/comm/admin/propal_extrafields.php b/htdocs/comm/admin/propal_extrafields.php
index e314d0b3e66..bfa62eba7fc 100644
--- a/htdocs/comm/admin/propal_extrafields.php
+++ b/htdocs/comm/admin/propal_extrafields.php
@@ -86,13 +86,7 @@ if ($action != 'create' && $action != 'edit') {
print "
";
}
-
-/* ************************************************************************** */
-/* */
-/* Creation of an optional field */
-/* */
-/* ************************************************************************** */
-
+// Creation of an optional field
if ($action == 'create') {
print "
";
print load_fiche_titre($langs->trans('NewAttribute'));
@@ -100,11 +94,7 @@ if ($action == 'create') {
require DOL_DOCUMENT_ROOT.'/core/tpl/admin_extrafields_add.tpl.php';
}
-/* ************************************************************************** */
-/* */
-/* Edition of an optional field */
-/* */
-/* ************************************************************************** */
+// Edition of an optional field
if ($action == 'edit' && !empty($attrname)) {
print "
";
print load_fiche_titre($langs->trans("FieldEdition", $attrname));
diff --git a/htdocs/comm/admin/propaldet_extrafields.php b/htdocs/comm/admin/propaldet_extrafields.php
index 4cbe35b31c5..834722f2afd 100644
--- a/htdocs/comm/admin/propaldet_extrafields.php
+++ b/htdocs/comm/admin/propaldet_extrafields.php
@@ -94,13 +94,7 @@ if ($action != 'create' && $action != 'edit') {
print "
";
}
-
-/* ************************************************************************** */
-/* */
-/* Creation of an optional field */
-/* */
-/* ************************************************************************** */
-
+// Creation of an optional field
if ($action == 'create') {
print '
';
print load_fiche_titre($langs->trans('NewAttribute'));
@@ -108,11 +102,7 @@ if ($action == 'create') {
require DOL_DOCUMENT_ROOT.'/core/tpl/admin_extrafields_add.tpl.php';
}
-/* ************************************************************************** */
-/* */
-/* Edition of an optional field */
-/* */
-/* ************************************************************************** */
+// Edition of an optional field
if ($action == 'edit' && !empty($attrname)) {
print "
";
print load_fiche_titre($langs->trans("FieldEdition", $attrname));
diff --git a/htdocs/comm/contact.php b/htdocs/comm/contact.php
index b1e8b3c3768..8a921e1c358 100644
--- a/htdocs/comm/contact.php
+++ b/htdocs/comm/contact.php
@@ -101,7 +101,7 @@ if ($type == "f") {
$sql .= " AND s.fournisseur = 1";
}
if ($socid) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
if (dol_strlen($stcomm)) {
diff --git a/htdocs/comm/index.php b/htdocs/comm/index.php
index b720ff638c9..b727a18b76f 100644
--- a/htdocs/comm/index.php
+++ b/htdocs/comm/index.php
@@ -169,7 +169,7 @@ if (!empty($conf->propal->enabled) && $user->rights->propal->lire) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
}
if ($socid) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
$resql = $db->query($sql);
diff --git a/htdocs/comm/mailing/class/advtargetemailing.class.php b/htdocs/comm/mailing/class/advtargetemailing.class.php
index c811b673197..063fb6c7f00 100644
--- a/htdocs/comm/mailing/class/advtargetemailing.class.php
+++ b/htdocs/comm/mailing/class/advtargetemailing.class.php
@@ -559,34 +559,34 @@ class AdvanceTargetingMailing extends CommonObject
$sqlwhere[] = " (t.parent IN (SELECT rowid FROM ".MAIN_DB_PREFIX."societe WHERE (".$str.")))";
}
if (!empty($arrayquery['cust_status']) && count($arrayquery['cust_status']) > 0) {
- $sqlwhere[] = " (t.status IN (".implode(',', $arrayquery['cust_status'])."))";
+ $sqlwhere[] = " (t.status IN (".$this->db->sanitize(implode(',', $arrayquery['cust_status']))."))";
}
if (!empty($arrayquery['cust_typecust']) && count($arrayquery['cust_typecust']) > 0) {
- $sqlwhere[] = " (t.client IN (".implode(',', $arrayquery['cust_typecust'])."))";
+ $sqlwhere[] = " (t.client IN (".$this->db->sanitize(implode(',', $arrayquery['cust_typecust']))."))";
}
if (!empty($arrayquery['cust_comm_status']) && count($arrayquery['cust_comm_status'] > 0)) {
- $sqlwhere[] = " (t.fk_stcomm IN (".implode(',', $arrayquery['cust_comm_status'])."))";
+ $sqlwhere[] = " (t.fk_stcomm IN (".$this->db->sanitize(implode(',', $arrayquery['cust_comm_status']))."))";
}
if (!empty($arrayquery['cust_prospect_status']) && count($arrayquery['cust_prospect_status']) > 0) {
- $sqlwhere[] = " (t.fk_prospectlevel IN ('".implode("','", $arrayquery['cust_prospect_status'])."'))";
+ $sqlwhere[] = " (t.fk_prospectlevel IN (".$this->db->sanitize("'".implode("','", $arrayquery['cust_prospect_status'])."'", 1)."))";
}
if (!empty($arrayquery['cust_typeent']) && count($arrayquery['cust_typeent']) > 0) {
- $sqlwhere[] = " (t.fk_typent IN (".implode(',', $arrayquery['cust_typeent'])."))";
+ $sqlwhere[] = " (t.fk_typent IN (".$this->db->sanitize(implode(',', $arrayquery['cust_typeent']))."))";
}
if (!empty($arrayquery['cust_saleman']) && count($arrayquery['cust_saleman']) > 0) {
- $sqlwhere[] = " (saleman.fk_user IN (".implode(',', $arrayquery['cust_saleman'])."))";
+ $sqlwhere[] = " (saleman.fk_user IN (".$this->db->sanitize(implode(',', $arrayquery['cust_saleman']))."))";
}
if (!empty($arrayquery['cust_country']) && count($arrayquery['cust_country']) > 0) {
- $sqlwhere[] = " (t.fk_pays IN (".implode(',', $arrayquery['cust_country'])."))";
+ $sqlwhere[] = " (t.fk_pays IN (".$this->db->sanitize(implode(',', $arrayquery['cust_country']))."))";
}
if (!empty($arrayquery['cust_effectif_id']) && count($arrayquery['cust_effectif_id']) > 0) {
- $sqlwhere[] = " (t.fk_effectif IN (".implode(',', $arrayquery['cust_effectif_id'])."))";
+ $sqlwhere[] = " (t.fk_effectif IN (".$this->db->sanitize(implode(',', $arrayquery['cust_effectif_id']))."))";
}
if (!empty($arrayquery['cust_categ']) && count($arrayquery['cust_categ']) > 0) {
- $sqlwhere[] = " (custcateg.fk_categorie IN (".implode(',', $arrayquery['cust_categ'])."))";
+ $sqlwhere[] = " (custcateg.fk_categorie IN (".$this->db->sanitize(implode(',', $arrayquery['cust_categ']))."))";
}
if (!empty($arrayquery['cust_language']) && count($arrayquery['cust_language']) > 0) {
- $sqlwhere[] = " (t.default_lang IN ('".implode("','", $arrayquery['cust_language'])."'))";
+ $sqlwhere[] = " (t.default_lang IN (".$this->db->sanitize("'".implode("','", $arrayquery['cust_language'])."'", 1)."))";
}
//Standard Extrafield feature
@@ -618,7 +618,7 @@ class AdvanceTargetingMailing extends CommonObject
}
} else {
if (is_array($arrayquery['options_'.$key])) {
- $sqlwhere[] = " (te.".$key." IN ('".implode("','", $arrayquery['options_'.$key])."'))";
+ $sqlwhere[] = " (te.".$key." IN (".$this->db->sanitize("'".implode("','", $arrayquery['options_'.$key])."'", 1)."))";
} elseif (!empty($arrayquery['options_'.$key])) {
$sqlwhere[] = " (te.".$key." LIKE '".$this->db->escape($arrayquery['options_'.$key])."')";
}
@@ -703,7 +703,7 @@ class AdvanceTargetingMailing extends CommonObject
$sqlwhere[] = " (t.statut IN (".$this->db->sanitize($this->db->escape(implode(',', $arrayquery['contact_status'])))."))";
}
if (!empty($arrayquery['contact_civility']) && count($arrayquery['contact_civility']) > 0) {
- $sqlwhere[] = " (t.civility IN ('".$this->db->sanitize($this->db->escape(implode("','", $arrayquery['contact_civility'])))."'))";
+ $sqlwhere[] = " (t.civility IN (".$this->db->sanitize("'".implode("','", $arrayquery['contact_civility'])."'", 1)."))";
}
if ($arrayquery['contact_no_email'] != '') {
$tmpwhere = '';
@@ -762,7 +762,7 @@ class AdvanceTargetingMailing extends CommonObject
}
} else {
if (is_array($arrayquery['options_'.$key.'_cnct'])) {
- $sqlwhere[] = " (te.".$key." IN ('".implode("','", $arrayquery['options_'.$key.'_cnct'])."'))";
+ $sqlwhere[] = " (te.".$key." IN (".$this->db->sanitize("'".implode("','", $arrayquery['options_'.$key.'_cnct'])."'", 1)."))";
} elseif (!empty($arrayquery['options_'.$key.'_cnct'])) {
$sqlwhere[] = " (te.".$key." LIKE '".$this->db->escape($arrayquery['options_'.$key.'_cnct'])."')";
}
@@ -797,34 +797,34 @@ class AdvanceTargetingMailing extends CommonObject
$sqlwhere[] = " (ts.parent IN (SELECT rowid FROM ".MAIN_DB_PREFIX."societe WHERE (".$str.")))";
}
if (!empty($arrayquery['cust_status']) && count($arrayquery['cust_status']) > 0) {
- $sqlwhere[] = " (ts.status IN (".implode(',', $arrayquery['cust_status'])."))";
+ $sqlwhere[] = " (ts.status IN (".$this->db->sanitize(implode(',', $arrayquery['cust_status']))."))";
}
if (!empty($arrayquery['cust_typecust']) && count($arrayquery['cust_typecust']) > 0) {
- $sqlwhere[] = " (ts.client IN (".implode(',', $arrayquery['cust_typecust'])."))";
+ $sqlwhere[] = " (ts.client IN (".$this->db->sanitize(implode(',', $arrayquery['cust_typecust']))."))";
}
if (!empty($arrayquery['cust_comm_status']) && count($arrayquery['cust_comm_status'] > 0)) {
- $sqlwhere[] = " (ts.fk_stcomm IN (".implode(',', $arrayquery['cust_comm_status'])."))";
+ $sqlwhere[] = " (ts.fk_stcomm IN (".$this->db->sanitize(implode(',', $arrayquery['cust_comm_status']))."))";
}
if (!empty($arrayquery['cust_prospect_status']) && count($arrayquery['cust_prospect_status']) > 0) {
- $sqlwhere[] = " (ts.fk_prospectlevel IN ('".implode("','", $arrayquery['cust_prospect_status'])."'))";
+ $sqlwhere[] = " (ts.fk_prospectlevel IN ('".$this->db->sanitize(implode("','", $arrayquery['cust_prospect_status']))."'))";
}
if (!empty($arrayquery['cust_typeent']) && count($arrayquery['cust_typeent']) > 0) {
- $sqlwhere[] = " (ts.fk_typent IN (".implode(',', $arrayquery['cust_typeent'])."))";
+ $sqlwhere[] = " (ts.fk_typent IN (".$this->db->sanitize(implode(',', $arrayquery['cust_typeent']))."))";
}
if (!empty($arrayquery['cust_saleman']) && count($arrayquery['cust_saleman']) > 0) {
- $sqlwhere[] = " (saleman.fk_user IN (".implode(',', $arrayquery['cust_saleman'])."))";
+ $sqlwhere[] = " (saleman.fk_user IN (".$this->db->sanitize(implode(',', $arrayquery['cust_saleman']))."))";
}
if (!empty($arrayquery['cust_country']) && count($arrayquery['cust_country']) > 0) {
- $sqlwhere[] = " (ts.fk_pays IN (".implode(',', $arrayquery['cust_country'])."))";
+ $sqlwhere[] = " (ts.fk_pays IN (".$this->db->sanitize(implode(',', $arrayquery['cust_country']))."))";
}
if (!empty($arrayquery['cust_effectif_id']) && count($arrayquery['cust_effectif_id']) > 0) {
- $sqlwhere[] = " (ts.fk_effectif IN (".implode(',', $arrayquery['cust_effectif_id'])."))";
+ $sqlwhere[] = " (ts.fk_effectif IN (".$this->db->sanitize(implode(',', $arrayquery['cust_effectif_id']))."))";
}
if (!empty($arrayquery['cust_categ']) && count($arrayquery['cust_categ']) > 0) {
- $sqlwhere[] = " (custcateg.fk_categorie IN (".implode(',', $arrayquery['cust_categ'])."))";
+ $sqlwhere[] = " (custcateg.fk_categorie IN (".$this->db->sanitize(implode(',', $arrayquery['cust_categ']))."))";
}
if (!empty($arrayquery['cust_language']) && count($arrayquery['cust_language']) > 0) {
- $sqlwhere[] = " (ts.default_lang IN ('".implode("','", $arrayquery['cust_language'])."'))";
+ $sqlwhere[] = " (ts.default_lang IN ('".$this->db->sanitize(implode("','", $arrayquery['cust_language']))."'))";
}
//Standard Extrafield feature
@@ -860,7 +860,7 @@ class AdvanceTargetingMailing extends CommonObject
}
} else {
if (is_array($arrayquery['options_'.$key])) {
- $sqlwhere[] = " (tse.".$key." IN ('".implode("','", $arrayquery['options_'.$key])."'))";
+ $sqlwhere[] = " (tse.".$key." IN (".$this->db->sanitize("'".implode("','", $arrayquery['options_'.$key])."'", 1)."))";
} elseif (!empty($arrayquery['options_'.$key])) {
$sqlwhere[] = " (tse.".$key." LIKE '".$this->db->escape($arrayquery['options_'.$key])."')";
}
diff --git a/htdocs/comm/propal/card.php b/htdocs/comm/propal/card.php
index 2b27d7ee451..c8c94e7e95a 100644
--- a/htdocs/comm/propal/card.php
+++ b/htdocs/comm/propal/card.php
@@ -300,6 +300,7 @@ if (empty($reshook)) {
}
} elseif ($action == 'setecheance' && $usercancreate) {
$result = $object->set_echeance($user, dol_mktime(12, 0, 0, $_POST['echmonth'], $_POST['echday'], $_POST['echyear']));
+ $result = $object->generateDocument($model, $outputlangs, $hidedetails, $hidedesc, $hideref);
if ($result < 0) {
dol_print_error($db, $object->error);
}
diff --git a/htdocs/comm/propal/class/api_proposals.class.php b/htdocs/comm/propal/class/api_proposals.class.php
index 84d7cf23385..9f5cdea8000 100644
--- a/htdocs/comm/propal/class/api_proposals.class.php
+++ b/htdocs/comm/propal/class/api_proposals.class.php
@@ -181,14 +181,14 @@ class Proposals extends DolibarrApi
$sql .= " AND t.fk_soc = sc.fk_soc";
}
if ($socids) {
- $sql .= " AND t.fk_soc IN (".$socids.")";
+ $sql .= " AND t.fk_soc IN (".$this->db->sanitize($socids).")";
}
if ($search_sale > 0) {
$sql .= " AND t.rowid = sc.fk_soc"; // Join for the needed table to filter by sale
}
// Insert sale filter
if ($search_sale > 0) {
- $sql .= " AND sc.fk_user = ".$search_sale;
+ $sql .= " AND sc.fk_user = ".((int) $search_sale);
}
// Add sql filters
if ($sqlfilters) {
diff --git a/htdocs/comm/propal/class/propal.class.php b/htdocs/comm/propal/class/propal.class.php
index 197c9c7074f..3674356af20 100644
--- a/htdocs/comm/propal/class/propal.class.php
+++ b/htdocs/comm/propal/class/propal.class.php
@@ -2734,7 +2734,7 @@ class Propal extends CommonObject
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
}
if ($socid) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
if ($draft) {
$sql .= " AND p.fk_statut = ".self::STATUS_DRAFT;
@@ -2821,7 +2821,7 @@ class Propal extends CommonObject
if (count($linkedInvoices) > 0) {
$sql = "SELECT rowid as facid, ref, total, datef as df, fk_user_author, fk_statut, paye";
$sql .= " FROM ".MAIN_DB_PREFIX."facture";
- $sql .= " WHERE rowid IN (".implode(',', $linkedInvoices).")";
+ $sql .= " WHERE rowid IN (".$this->db->sanitize(implode(',', $linkedInvoices)).")";
dol_syslog(get_class($this)."::InvoiceArrayList", LOG_DEBUG);
$resql = $this->db->query($sql);
diff --git a/htdocs/comm/propal/index.php b/htdocs/comm/propal/index.php
index 812561a63b1..2005e51571b 100644
--- a/htdocs/comm/propal/index.php
+++ b/htdocs/comm/propal/index.php
@@ -106,7 +106,7 @@ if ($user->socid) {
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
}
-$sql .= " AND p.fk_statut IN (".implode(" ,", $listofstatus).")";
+$sql .= " AND p.fk_statut IN (".$db->sanitize(implode(" ,", $listofstatus)).")";
$sql .= " GROUP BY p.fk_statut";
$resql = $db->query($sql);
if ($resql) {
@@ -372,7 +372,7 @@ if (!empty($conf->propal->enabled) && $user->rights->propale->lire) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
}
if ($socid) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
$sql .= " ORDER BY p.rowid DESC";
diff --git a/htdocs/comm/propal/list.php b/htdocs/comm/propal/list.php
index 4c8ee0894f5..b4c63365bf8 100644
--- a/htdocs/comm/propal/list.php
+++ b/htdocs/comm/propal/list.php
@@ -565,7 +565,7 @@ if ($socid > 0) {
$sql .= ' AND s.rowid = '.$socid;
}
if ($search_status != '' && $search_status != '-1') {
- $sql .= ' AND p.fk_statut IN ('.$db->sanitize($db->escape($search_status)).')';
+ $sql .= ' AND p.fk_statut IN ('.$db->sanitize($search_status).')';
}
if ($search_date_start) {
$sql .= " AND p.datep >= '".$db->idate($search_date_start)."'";
diff --git a/htdocs/comm/propal/stats/index.php b/htdocs/comm/propal/stats/index.php
index 3cb6de90a8d..4ae18df12f8 100644
--- a/htdocs/comm/propal/stats/index.php
+++ b/htdocs/comm/propal/stats/index.php
@@ -103,7 +103,7 @@ dol_mkdir($dir);
$stats = new PropaleStats($db, $socid, ($userid > 0 ? $userid : 0), $mode, ($typent_id > 0 ? $typent_id : 0), ($categ_id > 0 ? $categ_id : 0));
if ($object_status != '' && $object_status >= 0) {
- $stats->where .= ' AND p.fk_statut IN ('.$db->sanitize($db->escape($object_status)).')';
+ $stats->where .= ' AND p.fk_statut IN ('.$db->sanitize($object_status).')';
}
// Build graphic number of object
diff --git a/htdocs/commande/class/api_orders.class.php b/htdocs/commande/class/api_orders.class.php
index 768e6a78c70..17b7d4285b4 100644
--- a/htdocs/commande/class/api_orders.class.php
+++ b/htdocs/commande/class/api_orders.class.php
@@ -184,14 +184,14 @@ class Orders extends DolibarrApi
$sql .= " AND t.fk_soc = sc.fk_soc";
}
if ($socids) {
- $sql .= " AND t.fk_soc IN (".$socids.")";
+ $sql .= " AND t.fk_soc IN (".$this->db->sanitize($socids).")";
}
if ($search_sale > 0) {
$sql .= " AND t.rowid = sc.fk_soc"; // Join for the needed table to filter by sale
}
// Insert sale filter
if ($search_sale > 0) {
- $sql .= " AND sc.fk_user = ".$search_sale;
+ $sql .= " AND sc.fk_user = ".((int) $search_sale);
}
// Add sql filters
if ($sqlfilters) {
diff --git a/htdocs/commande/class/commande.class.php b/htdocs/commande/class/commande.class.php
index b29b594f8f2..14fc65cf18d 100644
--- a/htdocs/commande/class/commande.class.php
+++ b/htdocs/commande/class/commande.class.php
@@ -2300,8 +2300,8 @@ class Commande extends CommonOrder
if (count($array_of_product)) {
$sql = "SELECT fk_product, sum(ps.reel) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."product_stock as ps";
- $sql .= " WHERE ps.fk_product IN (".join(',', $array_of_product).")";
- $sql .= ' GROUP BY fk_product ';
+ $sql .= " WHERE ps.fk_product IN (".$this->db->sanitize(join(',', $array_of_product)).")";
+ $sql .= ' GROUP BY fk_product';
$resql = $this->db->query($sql);
if ($resql) {
$num = $this->db->num_rows($resql);
diff --git a/htdocs/commande/index.php b/htdocs/commande/index.php
index 4b6fcc7d8aa..66798c94157 100644
--- a/htdocs/commande/index.php
+++ b/htdocs/commande/index.php
@@ -209,7 +209,7 @@ if (!empty($conf->commande->enabled)) {
$sql .= " AND c.entity IN (".getEntity('commande').")";
$sql .= " AND c.fk_statut = 0";
if ($socid) {
- $sql .= " AND c.fk_soc = ".$socid;
+ $sql .= " AND c.fk_soc = ".((int) $socid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
diff --git a/htdocs/commande/list.php b/htdocs/commande/list.php
index 73ac91c7098..117f7557db3 100644
--- a/htdocs/commande/list.php
+++ b/htdocs/commande/list.php
@@ -426,10 +426,10 @@ if ($search_state) {
$sql .= natural_search("state.nom", $search_state);
}
if ($search_country) {
- $sql .= " AND s.fk_pays IN (".$search_country.')';
+ $sql .= " AND s.fk_pays IN (".$db->sanitize($search_country).')';
}
if ($search_type_thirdparty) {
- $sql .= " AND s.fk_typent IN (".$search_type_thirdparty.')';
+ $sql .= " AND s.fk_typent IN (".$db->sanitize($search_type_thirdparty).')';
}
if ($search_company) {
$sql .= natural_search('s.nom', $search_company);
diff --git a/htdocs/commande/stats/index.php b/htdocs/commande/stats/index.php
index 0c9b80c3883..090d07baf81 100644
--- a/htdocs/commande/stats/index.php
+++ b/htdocs/commande/stats/index.php
@@ -96,12 +96,12 @@ dol_mkdir($dir);
$stats = new CommandeStats($db, $socid, $mode, ($userid > 0 ? $userid : 0), ($typent_id > 0 ? $typent_id : 0), ($categ_id > 0 ? $categ_id : 0));
if ($mode == 'customer') {
if ($object_status != '' && $object_status >= -1) {
- $stats->where .= ' AND c.fk_statut IN ('.$db->sanitize($db->escape($object_status)).')';
+ $stats->where .= ' AND c.fk_statut IN ('.$db->sanitize($object_status).')';
}
}
if ($mode == 'supplier') {
if ($object_status != '' && $object_status >= 0) {
- $stats->where .= ' AND c.fk_statut IN ('.$db->sanitize($db->escape($object_status)).')';
+ $stats->where .= ' AND c.fk_statut IN ('.$db->sanitize($object_status).')';
}
}
diff --git a/htdocs/compta/accounting-files.php b/htdocs/compta/accounting-files.php
index 596abdf0e97..d369f36c32f 100644
--- a/htdocs/compta/accounting-files.php
+++ b/htdocs/compta/accounting-files.php
@@ -34,6 +34,7 @@ if ((array_key_exists('action', $_GET) && $_GET['action'] == 'dl') || (array_key
require '../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/company.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
+require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
require_once DOL_DOCUMENT_ROOT.'/compta/facture/class/facture.class.php';
require_once DOL_DOCUMENT_ROOT.'/compta/paiement/class/paiement.class.php';
require_once DOL_DOCUMENT_ROOT.'/salaries/class/paymentsalary.class.php';
@@ -56,13 +57,12 @@ $date_start = GETPOST('date_start', 'alpha');
$date_startDay = GETPOST('date_startday', 'int');
$date_startMonth = GETPOST('date_startmonth', 'int');
$date_startYear = GETPOST('date_startyear', 'int');
-$date_start = ($date_startDay) ?dol_mktime(0, 0, 0, $date_startMonth, $date_startDay, $date_startYear) : strtotime($date_start);
+$date_start = ($date_startDay ? dol_mktime(0, 0, 0, $date_startMonth, $date_startDay, $date_startYear, 'tzuserrel') : dol_stringtotime($date_start));
$date_stop = GETPOST('date_stop', 'alpha');
$date_stopDay = GETPOST('date_stopday', 'int');
$date_stopMonth = GETPOST('date_stopmonth', 'int');
$date_stopYear = GETPOST('date_stopyear', 'int');
-//FIXME doldate
-$date_stop = ($date_stopDay) ?dol_mktime(23, 59, 59, $date_stopMonth, $date_stopDay, $date_stopYear) : strtotime($date_stop);
+$date_stop = ($date_stopDay ? dol_mktime(23, 59, 59, $date_stopMonth, $date_stopDay, $date_stopYear, 'tzuserrel') : dol_stringtotime($date_stop));
$action = GETPOST('action', 'aZ09');
// Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context
@@ -126,6 +126,17 @@ if (empty($entity)) {
$error = 0;
+$listofchoices = array(
+ 'selectinvoices'=>array('label'=>'Invoices', 'lang'=>'bills', 'enabled' => !empty($conf->facture->enabled), 'perms' => !empty($user->rights->facture->lire)),
+ 'selectsupplierinvoices'=>array('label'=>'BillsSuppliers', 'lang'=>'bills', 'enabled' => !empty($conf->supplier_invoice->enabled), 'perms' => !empty($user->rights->fournisseur->facture->lire)),
+ 'selectexpensereports'=>array('label'=>'ExpenseReports', 'lang'=>'trips', 'enabled' => !empty($conf->expensereport->enabled), 'perms' => !empty($user->rights->expensereport->lire)),
+ 'selectdonations'=>array('label'=>'Donations', 'lang'=>'donation', 'enabled' => !empty($conf->don->enabled), 'perms' => !empty($user->rights->don->lire)),
+ 'selectsocialcontributions'=>array('label'=>'SocialContributions', 'enabled' => !empty($conf->tax->enabled), 'perms' => !empty($user->rights->tax->charges->lire)),
+ 'selectpaymentsofsalaries'=>array('label'=>'SalariesPayments', 'lang'=>'salaries', 'enabled' => !empty($conf->salaries->enabled), 'perms' => !empty($user->rights->salaries->read)),
+ 'selectvariouspayment'=>array('label'=>'VariousPayment', 'enabled' => !empty($conf->banque->enabled), 'perms' => !empty($user->rights->banque->lire)),
+ 'selectloanspayment'=>array('label'=>'PaymentLoan', 'enabled' => !empty($conf->loan->enabled), 'perms' => !empty($user->rights->loan->read)),
+);
+
/*
@@ -155,90 +166,90 @@ if (($action == 'searchfiles' || $action == 'dl')) {
$wheretail = " '".$db->idate($date_start)."' AND '".$db->idate($date_stop)."'";
// Customer invoices
- if (GETPOST('selectinvoices')) {
+ if (GETPOST('selectinvoices') && !empty($listofchoices['selectinvoices']['perms'])) {
if (!empty($sql)) {
$sql .= " UNION ALL";
}
$sql .= "SELECT t.rowid as id, t.entity, t.ref, t.paye as paid, t.total as total_ht, t.total_ttc, t.tva as total_vat, t.multicurrency_code as currency, t.fk_soc, t.datef as date, t.date_lim_reglement as date_due, 'Invoice' as item, s.nom as thirdparty_name, s.code_client as thirdparty_code, c.code as country_code, s.tva_intra as vatnum, ".PAY_CREDIT." as sens";
$sql .= " FROM ".MAIN_DB_PREFIX."facture as t LEFT JOIN ".MAIN_DB_PREFIX."societe as s ON s.rowid = t.fk_soc LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON c.rowid = s.fk_pays";
$sql .= " WHERE datef between ".$wheretail;
- $sql .= " AND t.entity IN (".($entity == 1 ? '0,1' : $entity).')';
+ $sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : $entity).')';
$sql .= " AND t.fk_statut <> ".Facture::STATUS_DRAFT;
}
// Vendor invoices
- if (GETPOST('selectsupplierinvoices')) {
+ if (GETPOST('selectsupplierinvoices') && !empty($listofchoices['selectsupplierinvoices']['perms'])) {
if (!empty($sql)) {
$sql .= " UNION ALL";
}
$sql .= " SELECT t.rowid as id, t.entity, t.ref, t.paye as paid, t.total_ht, t.total_ttc, t.total_tva as total_vat, t.multicurrency_code as currency, t.fk_soc, t.datef as date, t.date_lim_reglement as date_due, 'SupplierInvoice' as item, s.nom as thirdparty_name, s.code_fournisseur as thirdparty_code, c.code as country_code, s.tva_intra as vatnum, ".PAY_DEBIT." as sens";
$sql .= " FROM ".MAIN_DB_PREFIX."facture_fourn as t LEFT JOIN ".MAIN_DB_PREFIX."societe as s ON s.rowid = t.fk_soc LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON c.rowid = s.fk_pays";
$sql .= " WHERE datef between ".$wheretail;
- $sql .= " AND t.entity IN (".($entity == 1 ? '0,1' : $entity).')';
+ $sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : $entity).')';
$sql .= " AND t.fk_statut <> ".FactureFournisseur::STATUS_DRAFT;
}
// Expense reports
- if (GETPOST('selectexpensereports')) {
+ if (GETPOST('selectexpensereports') && !empty($listofchoices['selectexpensereports']['perms'])) {
if (!empty($sql)) {
$sql .= " UNION ALL";
}
$sql .= " SELECT t.rowid as id, t.entity, t.ref, t.paid, t.total_ht, t.total_ttc, t.total_tva as total_vat, t.multicurrency_code as currency, t.fk_user_author as fk_soc, t.date_fin as date, t.date_fin as date_due, 'ExpenseReport' as item, CONCAT(CONCAT(u.lastname, ' '), u.firstname) as thirdparty_name, '' as thirdparty_code, c.code as country_code, '' as vatnum, ".PAY_DEBIT." as sens";
$sql .= " FROM ".MAIN_DB_PREFIX."expensereport as t LEFT JOIN ".MAIN_DB_PREFIX."user as u ON u.rowid = t.fk_user_author LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON c.rowid = u.fk_country";
$sql .= " WHERE date_fin between ".$wheretail;
- $sql .= " AND t.entity IN (".($entity == 1 ? '0,1' : $entity).')';
+ $sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : $entity).')';
$sql .= " AND t.fk_statut <> ".ExpenseReport::STATUS_DRAFT;
}
// Donations
- if (GETPOST('selectdonations')) {
+ if (GETPOST('selectdonations') && !empty($listofchoices['selectdonations']['perms'])) {
if (!empty($sql)) {
$sql .= " UNION ALL";
}
$sql .= " SELECT t.rowid as id, t.entity, t.ref, paid, amount as total_ht, amount as total_ttc, 0 as total_vat, '".$db->escape($conf->currency)."' as currency, 0 as fk_soc, t.datedon as date, t.datedon as date_due, 'Donation' as item, t.societe as thirdparty_name, '' as thirdparty_code, c.code as country_code, '' as vatnum, ".PAY_CREDIT." as sens";
$sql .= " FROM ".MAIN_DB_PREFIX."don as t LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON c.rowid = t.fk_country";
$sql .= " WHERE datedon between ".$wheretail;
- $sql .= " AND t.entity IN (".($entity == 1 ? '0,1' : $entity).')';
+ $sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : $entity).')';
$sql .= " AND t.fk_statut <> ".Don::STATUS_DRAFT;
}
// Payments of salaries
- if (GETPOST('selectpaymentsofsalaries')) {
+ if (GETPOST('selectpaymentsofsalaries') && !empty($listofchoices['selectpaymentsofsalaries']['perms'])) {
if (!empty($sql)) {
$sql .= " UNION ALL";
}
$sql .= " SELECT t.rowid as id, t.entity, t.label as ref, 1 as paid, amount as total_ht, amount as total_ttc, 0 as total_vat, '".$db->escape($conf->currency)."' as currency, t.fk_user as fk_soc, t.datep as date, t.dateep as date_due, 'SalaryPayment' as item, CONCAT(CONCAT(u.lastname, ' '), u.firstname) as thirdparty_name, '' as thirdparty_code, c.code as country_code, '' as vatnum, ".PAY_DEBIT." as sens";
$sql .= " FROM ".MAIN_DB_PREFIX."payment_salary as t LEFT JOIN ".MAIN_DB_PREFIX."user as u ON u.rowid = t.fk_user LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON c.rowid = u.fk_country";
$sql .= " WHERE datep between ".$wheretail;
- $sql .= " AND t.entity IN (".($entity == 1 ? '0,1' : $entity).')';
+ $sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : $entity).')';
//$sql.=" AND fk_statut <> ".PaymentSalary::STATUS_DRAFT;
}
// Social contributions
- if (GETPOST('selectsocialcontributions')) {
+ if (GETPOST('selectsocialcontributions') && !empty($listofchoices['selectsocialcontributions']['perms'])) {
if (!empty($sql)) {
$sql .= " UNION ALL";
}
$sql .= " SELECT t.rowid as id, t.entity, t.libelle as ref, t.paye as paid, t.amount as total_ht, t.amount as total_ttc, 0 as total_vat, '".$db->escape($conf->currency)."' as currency, 0 as fk_soc, t.date_ech as date, t.periode as date_due, 'SocialContributions' as item, '' as thirdparty_name, '' as thirdparty_code, '' as country_code, '' as vatnum, ".PAY_DEBIT." as sens";
$sql .= " FROM ".MAIN_DB_PREFIX."chargesociales as t";
$sql .= " WHERE t.date_ech between ".$wheretail;
- $sql .= " AND t.entity IN (".($entity == 1 ? '0,1' : $entity).')';
+ $sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : $entity).')';
//$sql.=" AND fk_statut <> ".ChargeSociales::STATUS_DRAFT;
}
// Various payments
- if (GETPOST('selectvariouspayment')) {
+ if (GETPOST('selectvariouspayment') && !empty($listofchoices['selectvariouspayment']['perms'])) {
if (!empty($sql)) {
$sql .= " UNION ALL";
}
$sql .= " SELECT t.rowid as id, t.entity, t.ref, 1 as paid, t.amount as total_ht, t.amount as total_ttc, 0 as total_vat, '".$db->escape($conf->currency)."' as currency, 0 as fk_soc, t.datep as date, t.datep as date_due, 'VariousPayment' as item, '' as thirdparty_name, '' as thirdparty_code, '' as country_code, '' as vatnum, sens";
$sql .= " FROM ".MAIN_DB_PREFIX."payment_various as t";
$sql .= " WHERE datep between ".$wheretail;
- $sql .= " AND t.entity IN (".($entity == 1 ? '0,1' : $entity).')';
+ $sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : $entity).')';
}
// Loan payments
- if (GETPOST('selectloanspayment')) {
+ if (GETPOST('selectloanspayment') && !empty($listofchoices['selectloanspayment']['perms'])) {
if (!empty($sql)) {
$sql .= " UNION ALL";
}
$sql .= " SELECT t.rowid as id, l.entity, l.label as ref, 1 as paid, (t.amount_capital+t.amount_insurance+t.amount_interest) as total_ht, (t.amount_capital+t.amount_insurance+t.amount_interest) as total_ttc, 0 as total_vat, '".$db->escape($conf->currency)."' as currency, 0 as fk_soc, t.datep as date, t.datep as date_due, 'LoanPayment' as item, '' as thirdparty_name, '' as thirdparty_code, '' as country_code, '' as vatnum, ".PAY_DEBIT." as sens";
$sql .= " FROM ".MAIN_DB_PREFIX."payment_loan as t LEFT JOIN ".MAIN_DB_PREFIX."loan as l ON l.rowid = t.fk_loan";
$sql .= " WHERE datep between ".$wheretail;
- $sql .= " AND l.entity IN (".($entity == 1 ? '0,1' : $entity).')';
+ $sql .= " AND l.entity IN (".$db->sanitize($entity == 1 ? '0,1' : $entity).')';
}
if ($sql) {
@@ -539,8 +550,11 @@ print '
';
print '
'.$langs->trans("ExportAccountingSourceDocHelp", $langs->transnoentitiesnoconv("Accounting"), $langs->transnoentitiesnoconv("Journals")).' ';
print '
';
-print $langs->trans("ReportPeriod").': '.$form->selectDate($date_start, 'date_start', 0, 0, 0, "", 1, 1, 0);
-print ' - '.$form->selectDate($date_stop, 'date_stop', 0, 0, 0, "", 1, 1, 0)."\n";
+print $langs->trans("ReportPeriod").': ';
+print $form->selectDate($date_start, 'date_start', 0, 0, 0, "", 1, 1, 0, '', '', '', '', 1, '', '', 'tzuserrel');
+print ' - ';
+print $form->selectDate($date_stop, 'date_stop', 0, 0, 0, "", 1, 1, 0, '', '', '', '', 1, '', '', 'tzuserrel');
+print "\n";
// Export is for current company only
if (!empty($conf->multicompany->enabled) && is_object($mc)) {
@@ -558,22 +572,16 @@ if (!empty($conf->multicompany->enabled) && is_object($mc)) {
print '
';
-$listofchoices = array(
- 'selectinvoices'=>array('label'=>'Invoices', 'lang'=>'bills', 'enabled' => !empty($conf->facture->enabled)),
- 'selectsupplierinvoices'=>array('label'=>'BillsSuppliers', 'lang'=>'bills', 'enabled' => !empty($conf->supplier_invoice->enabled)),
- 'selectexpensereports'=>array('label'=>'ExpenseReports', 'lang'=>'trips', 'enabled' => !empty($conf->expensereport->enabled)),
- 'selectdonations'=>array('label'=>'Donations', 'lang'=>'donation', 'enabled' => !empty($conf->don->enabled)),
- 'selectsocialcontributions'=>array('label'=>'SocialContributions', 'enabled' => !empty($conf->tax->enabled)),
- 'selectpaymentsofsalaries'=>array('label'=>'SalariesPayments', 'lang'=>'salaries', 'enabled' => !empty($conf->salaries->enabled)),
- 'selectvariouspayment'=>array('label'=>'VariousPayment', 'enabled' => !empty($conf->banque->enabled)),
- 'selectloanspayment'=>array('label'=>'PaymentLoan', 'enabled' => !empty($conf->loan->enabled)),
-);
foreach ($listofchoices as $choice => $val) {
if (empty($val['enabled'])) {
continue; // list not qualified
}
+ $disabled = '';
+ if (empty($val['perms'])) {
+ $disabled = ' disabled';
+ }
$checked = (((!GETPOSTISSET('search') && $action != 'searchfiles') || GETPOST($choice)) ? ' checked="checked"' : '');
- print '
'.$langs->trans($val['label']).'
';
+ print '
'.$langs->trans($val['label']).'
';
}
print '
';
diff --git a/htdocs/compta/bank/account_statement_document.php b/htdocs/compta/bank/account_statement_document.php
index ea4911e7050..e144f6acbe0 100644
--- a/htdocs/compta/bank/account_statement_document.php
+++ b/htdocs/compta/bank/account_statement_document.php
@@ -79,12 +79,12 @@ $result = restrictedArea($user, 'banque', $object->id, 'bank_account', '', '');
// Define number of receipt to show (current, previous or next one ?)
$found = false;
-if ($_GET["rel"] == 'prev') {
+if (GETPOST("rel") == 'prev') {
// Recherche valeur pour num = numero releve precedent
$sql = "SELECT DISTINCT(b.num_releve) as num";
$sql .= " FROM ".MAIN_DB_PREFIX."bank as b";
$sql .= " WHERE b.num_releve < '".$db->escape($numref)."'";
- $sql .= " AND b.fk_account = ".$id;
+ $sql .= " AND b.fk_account = ".((int) $id);
$sql .= " ORDER BY b.num_releve DESC";
dol_syslog("htdocs/compta/bank/releve.php", LOG_DEBUG);
@@ -97,12 +97,12 @@ if ($_GET["rel"] == 'prev') {
$found = true;
}
}
-} elseif ($_GET["rel"] == 'next') {
+} elseif (GETPOST("rel") == 'next') {
// Recherche valeur pour num = numero releve precedent
$sql = "SELECT DISTINCT(b.num_releve) as num";
$sql .= " FROM ".MAIN_DB_PREFIX."bank as b";
$sql .= " WHERE b.num_releve > '".$db->escape($numref)."'";
- $sql .= " AND b.fk_account = ".$id;
+ $sql .= " AND b.fk_account = ".((int) $id);
$sql .= " ORDER BY b.num_releve ASC";
dol_syslog("htdocs/compta/bank/releve.php", LOG_DEBUG);
diff --git a/htdocs/compta/bank/annuel.php b/htdocs/compta/bank/annuel.php
index 45ae92480a0..686b14362cc 100644
--- a/htdocs/compta/bank/annuel.php
+++ b/htdocs/compta/bank/annuel.php
@@ -267,7 +267,7 @@ if ($result < 0) {
$sql .= " WHERE b.fk_account = ba.rowid";
$sql .= " AND ba.entity IN (".getEntity('bank_account').")";
if ($id && $_GET["option"] != 'all') {
- $sql .= " AND b.fk_account IN (".$id.")";
+ $sql .= " AND b.fk_account IN (".$db->sanitize($id).")";
}
$resql = $db->query($sql);
@@ -299,7 +299,7 @@ if ($result < 0) {
$sql .= " AND b.datev <= '".($year - $annee)."-12-31 23:59:59'";
$sql .= " AND b.amount > 0";
if ($id && $_GET["option"] != 'all') {
- $sql .= " AND b.fk_account IN (".$id.")";
+ $sql .= " AND b.fk_account IN (".$db->sanitize($id).")";
}
$sql .= " GROUP BY date_format(b.datev,'%m');";
@@ -381,7 +381,7 @@ if ($result < 0) {
$sql .= " AND b.datev <= '".($year - $annee)."-12-31 23:59:59'";
$sql .= " AND b.amount < 0";
if ($id && $_GET["option"] != 'all') {
- $sql .= " AND b.fk_account IN (".$id.")";
+ $sql .= " AND b.fk_account IN (".$db->sanitize($id).")";
}
$sql .= " GROUP BY date_format(b.datev,'%m');";
diff --git a/htdocs/compta/bank/bankentries_list.php b/htdocs/compta/bank/bankentries_list.php
index 37ef8a5da76..f07b38045f2 100644
--- a/htdocs/compta/bank/bankentries_list.php
+++ b/htdocs/compta/bank/bankentries_list.php
@@ -581,7 +581,7 @@ if (is_array($extrafields->attributes[$object->table_element]['label']) && count
$sql .= " WHERE b.fk_account = ba.rowid";
$sql .= " AND ba.entity IN (".getEntity('bank_account').")";
if ($search_account > 0) {
- $sql .= " AND b.fk_account = ".$search_account;
+ $sql .= " AND b.fk_account = ".((int) $search_account);
}
// Search period criteria
if (dol_strlen($search_dt_start) > 0) {
@@ -607,7 +607,7 @@ if ($search_num_releve) {
$sql .= natural_search("b.num_releve", $search_num_releve);
}
if ($search_conciliated != '' && $search_conciliated != '-1') {
- $sql .= " AND b.rappro = ".urlencode($search_conciliated);
+ $sql .= " AND b.rappro = ".((int) $search_conciliated);
}
if ($search_thirdparty_user) {
$sql.= " AND (b.rowid IN ";
diff --git a/htdocs/compta/bank/card.php b/htdocs/compta/bank/card.php
index ccc834835a4..bf74035d553 100644
--- a/htdocs/compta/bank/card.php
+++ b/htdocs/compta/bank/card.php
@@ -305,8 +305,10 @@ if (!empty($conf->accounting->enabled)) {
$countrynotdefined = $langs->trans("ErrorSetACountryFirst").' ('.$langs->trans("SeeAbove").')';
$title = $langs->trans("FinancialAccount")." - ".$langs->trans("Card");
-$helpurl = "EN:Module_Banks_and_Cash";
-llxHeader("", $title, $helpurl);
+
+$help_url = "EN:Module_Banks_and_Cash|FR:Module_Banques_et_Caisses";
+
+llxHeader("", $title, $help_url);
// Creation
diff --git a/htdocs/compta/bank/class/account.class.php b/htdocs/compta/bank/class/account.class.php
index be38f1311d7..451f855a5fe 100644
--- a/htdocs/compta/bank/class/account.class.php
+++ b/htdocs/compta/bank/class/account.class.php
@@ -943,7 +943,7 @@ class Account extends CommonObject
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'accounting_journal as aj ON aj.rowid=ba.fk_accountancy_journal';
$sql .= " WHERE ba.entity IN (".getEntity($this->element).")";
if ($id) {
- $sql .= " AND ba.rowid = ".$id;
+ $sql .= " AND ba.rowid = ".((int) $id);
}
if ($ref) {
$sql .= " AND ba.ref = '".$this->db->escape($ref)."'";
diff --git a/htdocs/compta/bank/document.php b/htdocs/compta/bank/document.php
index 35102281ae9..6f0ffed4153 100644
--- a/htdocs/compta/bank/document.php
+++ b/htdocs/compta/bank/document.php
@@ -92,8 +92,10 @@ include DOL_DOCUMENT_ROOT.'/core/actions_linkedfiles.inc.php';
*/
$title = $langs->trans("FinancialAccount").' - '.$langs->trans("Documents");
-$helpurl = "";
-llxHeader('', $title, $helpurl);
+
+$help_url = "EN:Module_Banks_and_Cash|FR:Module_Banques_et_Caisses";
+
+llxHeader("", $title, $help_url);
$form = new Form($db);
diff --git a/htdocs/compta/bank/graph.php b/htdocs/compta/bank/graph.php
index 6dd588f51e1..4c0efec57d2 100644
--- a/htdocs/compta/bank/graph.php
+++ b/htdocs/compta/bank/graph.php
@@ -35,10 +35,10 @@ $WIDTH = DolGraph::getDefaultGraphSizeForStats('width', 768);
$HEIGHT = DolGraph::getDefaultGraphSizeForStats('height', 200);
// Security check
-if (isset($_GET["account"]) || isset($_GET["ref"])) {
- $id = isset($_GET["account"]) ? $_GET["account"] : (isset($_GET["ref"]) ? $_GET["ref"] : '');
+if (GETPOST('account') || GETPOST('ref')) {
+ $id = GETPOST('account') ? GETPOST('account') : GETPOST('ref');
}
-$fieldid = isset($_GET["ref"]) ? 'ref' : 'rowid';
+$fieldid = GETPOST('ref') ? 'ref' : 'rowid';
if ($user->socid) {
$socid = $user->socid;
}
@@ -66,19 +66,19 @@ $datetime = dol_now();
$year = dol_print_date($datetime, "%Y");
$month = dol_print_date($datetime, "%m");
$day = dol_print_date($datetime, "%d");
-if (GETPOST("year")) {
- $year = sprintf("%04d", GETPOST("year"));
+if (GETPOST("year", 'int')) {
+ $year = sprintf("%04d", GETPOST("year", 'int'));
}
-if (GETPOST("month")) {
- $month = sprintf("%02d", GETPOST("month"));
+if (GETPOST("month", 'int')) {
+ $month = sprintf("%02d", GETPOST("month", 'int'));
}
$object = new Account($db);
-if ($_GET["account"] && !preg_match('/,/', $_GET["account"])) { // if for a particular account and not a list
- $result = $object->fetch(GETPOST("account", "int"));
+if (GETPOST('account') && !preg_match('/,/', GETPOST('account'))) { // if for a particular account and not a list
+ $result = $object->fetch(GETPOST('account', 'int'));
}
-if ($_GET["ref"]) {
+if (GETPOST("ref")) {
$result = $object->fetch(0, GETPOST("ref"));
$account = $object->id;
}
@@ -96,7 +96,7 @@ if ($result < 0) {
$sql .= " WHERE b.fk_account = ba.rowid";
$sql .= " AND ba.entity IN (".getEntity('bank_account').")";
if ($account && $_GET["option"] != 'all') {
- $sql .= " AND b.fk_account IN (".$account.")";
+ $sql .= " AND b.fk_account IN (".$db->sanitize($account).")";
}
$resql = $db->query($sql);
@@ -138,7 +138,7 @@ if ($result < 0) {
$sql .= " AND b.datev >= '".$db->escape($year)."-".$db->escape($month)."-01 00:00:00'";
$sql .= " AND b.datev < '".$db->escape($yearnext)."-".$db->escape($monthnext)."-01 00:00:00'";
if ($account && $_GET["option"] != 'all') {
- $sql .= " AND b.fk_account IN (".$account.")";
+ $sql .= " AND b.fk_account IN (".$db->sanitize($account).")";
}
$sql .= " GROUP BY date_format(b.datev,'%Y%m%d')";
@@ -166,7 +166,7 @@ if ($result < 0) {
$sql .= " AND ba.entity IN (".getEntity('bank_account').")";
$sql .= " AND b.datev < '".$db->escape($year)."-".sprintf("%02s", $month)."-01'";
if ($account && $_GET["option"] != 'all') {
- $sql .= " AND b.fk_account IN (".$account.")";
+ $sql .= " AND b.fk_account IN (".$db->sanitize($account).")";
}
$resql = $db->query($sql);
@@ -280,7 +280,7 @@ if ($result < 0) {
$sql .= " AND b.datev >= '".$db->escape($year)."-01-01 00:00:00'";
$sql .= " AND b.datev <= '".$db->escape($year)."-12-31 23:59:59'";
if ($account && $_GET["option"] != 'all') {
- $sql .= " AND b.fk_account IN (".$account.")";
+ $sql .= " AND b.fk_account IN (".$db->sanitize($account).")";
}
$sql .= " GROUP BY date_format(b.datev,'%Y%m%d')";
@@ -308,7 +308,7 @@ if ($result < 0) {
$sql .= " AND ba.entity IN (".getEntity('bank_account').")";
$sql .= " AND b.datev < '".$db->escape($year)."-01-01'";
if ($account && $_GET["option"] != 'all') {
- $sql .= " AND b.fk_account IN (".$account.")";
+ $sql .= " AND b.fk_account IN (".$db->sanitize($account).")";
}
$resql = $db->query($sql);
@@ -416,7 +416,7 @@ if ($result < 0) {
$sql .= " WHERE b.fk_account = ba.rowid";
$sql .= " AND ba.entity IN (".getEntity('bank_account').")";
if ($account && $_GET["option"] != 'all') {
- $sql .= " AND b.fk_account IN (".$account.")";
+ $sql .= " AND b.fk_account IN (".$db->sanitize($account).")";
}
$sql .= " GROUP BY date_format(b.datev,'%Y%m%d')";
@@ -541,7 +541,7 @@ if ($result < 0) {
$sql .= " AND b.datev < '".$db->escape($yearnext)."-".$db->escape($monthnext)."-01 00:00:00'";
$sql .= " AND b.amount > 0";
if ($account && $_GET["option"] != 'all') {
- $sql .= " AND b.fk_account IN (".$account.")";
+ $sql .= " AND b.fk_account IN (".$db->sanitize($account).")";
}
$sql .= " GROUP BY date_format(b.datev,'%d')";
@@ -576,7 +576,7 @@ if ($result < 0) {
$sql .= " AND b.datev < '".$db->escape($yearnext)."-".$db->escape($monthnext)."-01 00:00:00'";
$sql .= " AND b.amount < 0";
if ($account && $_GET["option"] != 'all') {
- $sql .= " AND b.fk_account IN (".$account.")";
+ $sql .= " AND b.fk_account IN (".$db->sanitize($account).")";
}
$sql .= " GROUP BY date_format(b.datev,'%d')";
@@ -650,7 +650,7 @@ if ($result < 0) {
$sql .= " AND b.datev <= '".$db->escape($year)."-12-31 23:59:59'";
$sql .= " AND b.amount > 0";
if ($account && $_GET["option"] != 'all') {
- $sql .= " AND b.fk_account IN (".$account.")";
+ $sql .= " AND b.fk_account IN (".$db->sanitize($account).")";
}
$sql .= " GROUP BY date_format(b.datev,'%m');";
@@ -677,7 +677,7 @@ if ($result < 0) {
$sql .= " AND b.datev <= '".$db->escape($year)."-12-31 23:59:59'";
$sql .= " AND b.amount < 0";
if ($account && $_GET["option"] != 'all') {
- $sql .= " AND b.fk_account IN (".$account.")";
+ $sql .= " AND b.fk_account IN (".$db->sanitize($account).")";
}
$sql .= " GROUP BY date_format(b.datev,'%m')";
diff --git a/htdocs/compta/bank/various_payment/list.php b/htdocs/compta/bank/various_payment/list.php
index 39cbb91fde1..65542598351 100644
--- a/htdocs/compta/bank/various_payment/list.php
+++ b/htdocs/compta/bank/various_payment/list.php
@@ -264,10 +264,6 @@ if ($search_accountancy_subledger > 0) {
if ($typeid > 0) {
$sql .= " AND v.fk_typepayment=".$typeid;
}
-if ($filtre) {
- $filtre = str_replace(":", "=", $filtre);
- $sql .= " AND ".$filtre;
-}
if ($search_all) {
$sql .= natural_search(array_keys($fieldstosearchall), $search_all);
}
diff --git a/htdocs/compta/deplacement/class/deplacementstats.class.php b/htdocs/compta/deplacement/class/deplacementstats.class.php
index bb99b477584..64cee98c33b 100644
--- a/htdocs/compta/deplacement/class/deplacementstats.class.php
+++ b/htdocs/compta/deplacement/class/deplacementstats.class.php
@@ -64,13 +64,13 @@ class DeplacementStats extends Stats
$this->where = " fk_statut > 0";
$this->where .= " AND entity = ".$conf->entity;
- if ($this->socid) {
- $this->where .= " AND fk_soc = ".$this->socid;
+ if ($this->socid > 0) {
+ $this->where .= " AND fk_soc = ".((int) $this->socid);
}
if (is_array($this->userid) && count($this->userid) > 0) {
- $this->where .= ' AND fk_user IN ('.join(',', $this->userid).')';
+ $this->where .= ' AND fk_user IN ('.$this->db->sanitize(join(',', $this->userid)).')';
} elseif ($this->userid > 0) {
- $this->where .= ' AND fk_user = '.$this->userid;
+ $this->where .= ' AND fk_user = '.((int) $this->userid);
}
}
diff --git a/htdocs/compta/deplacement/index.php b/htdocs/compta/deplacement/index.php
index 780835b0c5e..547f0676b7b 100644
--- a/htdocs/compta/deplacement/index.php
+++ b/htdocs/compta/deplacement/index.php
@@ -76,7 +76,7 @@ $sql = "SELECT count(d.rowid) as nb, sum(d.km) as km, d.type";
$sql .= " FROM ".MAIN_DB_PREFIX."deplacement as d";
$sql .= " WHERE d.entity = ".$conf->entity;
if (empty($user->rights->deplacement->readall) && empty($user->rights->deplacement->lire_tous)) {
- $sql .= ' AND d.fk_user IN ('.join(',', $childids).')';
+ $sql .= ' AND d.fk_user IN ('.$db->sanitize(join(',', $childids)).')';
}
$sql .= " GROUP BY d.type";
$sql .= " ORDER BY d.type";
@@ -156,13 +156,13 @@ if (!$user->rights->societe->client->voir && !$user->socid) {
$sql .= " WHERE u.rowid = d.fk_user";
$sql .= " AND d.entity = ".$conf->entity;
if (empty($user->rights->deplacement->readall) && empty($user->rights->deplacement->lire_tous)) {
- $sql .= ' AND d.fk_user IN ('.join(',', $childids).')';
+ $sql .= ' AND d.fk_user IN ('.$db->sanitize(join(',', $childids)).')';
}
if (!$user->rights->societe->client->voir && !$user->socid) {
$sql .= " AND d.fk_soc = s. rowid AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
}
if ($socid) {
- $sql .= " AND d.fk_soc = ".$socid;
+ $sql .= " AND d.fk_soc = ".((int) $socid);
}
$sql .= $db->order("d.tms", "DESC");
$sql .= $db->plimit($max, 0);
diff --git a/htdocs/compta/deplacement/list.php b/htdocs/compta/deplacement/list.php
index 46d17c30e96..61d30ea1345 100644
--- a/htdocs/compta/deplacement/list.php
+++ b/htdocs/compta/deplacement/list.php
@@ -102,17 +102,17 @@ if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " WHERE d.fk_user = u.rowid";
$sql .= " AND d.entity = ".$conf->entity;
if (empty($user->rights->deplacement->readall) && empty($user->rights->deplacement->lire_tous)) {
- $sql .= ' AND d.fk_user IN ('.join(',', $childids).')';
+ $sql .= ' AND d.fk_user IN ('.$db->sanitize(join(',', $childids)).')';
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND (sc.fk_user = ".$user->id." OR d.fk_soc IS NULL) ";
}
if ($socid) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
if ($search_ref) {
- $sql .= " AND d.rowid=".$search_ref;
+ $sql .= " AND d.rowid = ".((int) $search_ref);
}
if ($search_name) {
$sql .= natural_search('u.lastname', $search_name);
diff --git a/htdocs/compta/facture/admin/facturedet_cust_extrafields.php b/htdocs/compta/facture/admin/facturedet_cust_extrafields.php
index 82520c02fac..05aa47737be 100644
--- a/htdocs/compta/facture/admin/facturedet_cust_extrafields.php
+++ b/htdocs/compta/facture/admin/facturedet_cust_extrafields.php
@@ -91,7 +91,7 @@ if ($action != 'create' && $action != 'edit') {
/*
*
- * Creation d'un champ optionnel
+ * Creation of an optional field
*
*/
@@ -104,7 +104,7 @@ if ($action == 'create') {
/*
*
- * Edition d'un champ optionnel
+ * Edition of an optional field
*
*/
if ($action == 'edit' && !empty($attrname)) {
diff --git a/htdocs/compta/facture/admin/facturedet_rec_cust_extrafields.php b/htdocs/compta/facture/admin/facturedet_rec_cust_extrafields.php
index 5264ee5472c..6ebdfae6277 100644
--- a/htdocs/compta/facture/admin/facturedet_rec_cust_extrafields.php
+++ b/htdocs/compta/facture/admin/facturedet_rec_cust_extrafields.php
@@ -91,7 +91,7 @@ if ($action != 'create' && $action != 'edit') {
/*
*
- * Creation d'un champ optionnel
+ * Creation of an optional field
*
*/
@@ -104,7 +104,7 @@ if ($action == 'create') {
/*
*
- * Edition d'un champ optionnel
+ * Edition of an optional field
*
*/
if ($action == 'edit' && !empty($attrname)) {
diff --git a/htdocs/compta/facture/card.php b/htdocs/compta/facture/card.php
index cd1905f528f..fd8a9c1045d 100644
--- a/htdocs/compta/facture/card.php
+++ b/htdocs/compta/facture/card.php
@@ -2571,7 +2571,7 @@ if (empty($reshook)) {
$sql .= ' SET situation_cycle_ref='.$newCycle;
$sql .= ' , situation_final=0';
$sql .= ' , situation_counter='.$object->situation_counter;
- $sql .= ' WHERE rowid IN ('.implode(',', $linkedCreditNotesList).')';
+ $sql .= ' WHERE rowid IN ('.$db->sanitize(implode(',', $linkedCreditNotesList)).')';
$resql = $db->query($sql);
if (!$resql) {
@@ -2815,9 +2815,10 @@ if (!empty($conf->projet->enabled)) {
$now = dol_now();
$title = $langs->trans('InvoiceCustomer')." - ".$langs->trans('Card');
-$helpurl = "EN:Customers_Invoices|FR:Factures_Clients|ES:Facturas_a_clientes";
-llxHeader('', $title, $helpurl);
+$help_url = "EN:Customers_Invoices|FR:Factures_Clients|ES:Facturas_a_clientes";
+
+llxHeader('', $title, $help_url);
// Mode creation
diff --git a/htdocs/compta/facture/class/api_invoices.class.php b/htdocs/compta/facture/class/api_invoices.class.php
index c16d79d2574..9c224b057ab 100644
--- a/htdocs/compta/facture/class/api_invoices.class.php
+++ b/htdocs/compta/facture/class/api_invoices.class.php
@@ -1,6 +1,6 @@
-/* Copyright (C) 2020 Thibault FOUCART
+ * Copyright (C) 2020 Thibault FOUCART
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -191,7 +191,7 @@ class Invoices extends DolibarrApi
$sql .= " AND t.fk_soc = sc.fk_soc";
}
if ($socids) {
- $sql .= " AND t.fk_soc IN (".$socids.")";
+ $sql .= " AND t.fk_soc IN (".$this->db->sanitize($socids).")";
}
if ($search_sale > 0) {
diff --git a/htdocs/compta/facture/class/facture.class.php b/htdocs/compta/facture/class/facture.class.php
index b0690675b53..1afa9347f67 100644
--- a/htdocs/compta/facture/class/facture.class.php
+++ b/htdocs/compta/facture/class/facture.class.php
@@ -2248,7 +2248,7 @@ class Facture extends CommonInvoice
if (count($list_rowid_det)) {
$sql = 'UPDATE '.MAIN_DB_PREFIX.'societe_remise_except';
$sql .= ' SET fk_facture = NULL, fk_facture_line = NULL';
- $sql .= ' WHERE fk_facture_line IN ('.join(',', $list_rowid_det).')';
+ $sql .= ' WHERE fk_facture_line IN ('.$this->db->sanitize(join(',', $list_rowid_det)).')';
dol_syslog(get_class($this)."::delete", LOG_DEBUG);
if (!$this->db->query($sql)) {
@@ -4033,7 +4033,7 @@ class Facture extends CommonInvoice
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
}
if ($socid) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
if ($draft) {
$sql .= " AND f.fk_statut = ".self::STATUS_DRAFT;
@@ -4158,13 +4158,13 @@ class Facture extends CommonInvoice
$sqlSit .= " AND fs.fk_statut in (".self::STATUS_VALIDATED.",".self::STATUS_CLOSED.")";
$sqlSit .= " GROUP BY fs.situation_cycle_ref";
$sqlSit .= " ORDER BY fs.situation_counter";
- $sql .= " AND ( f.type != ".self::TYPE_SITUATION." OR f.rowid IN (".$sqlSit.") )"; // Type non 5 si facture non avoir
+ $sql .= " AND ( f.type != ".self::TYPE_SITUATION." OR f.rowid IN (".$this->db->sanitize($sqlSit).") )"; // Type non 5 si facture non avoir
} else {
$sql .= " AND f.type != ".self::TYPE_SITUATION; // Type non 5 si facture non avoir
}
if ($socid > 0) {
- $sql .= " AND f.fk_soc = ".$socid;
+ $sql .= " AND f.fk_soc = ".((int) $socid);
}
$sql .= " ORDER BY f.ref";
diff --git a/htdocs/compta/facture/document.php b/htdocs/compta/facture/document.php
index 4c0544e3810..f4937679504 100644
--- a/htdocs/compta/facture/document.php
+++ b/htdocs/compta/facture/document.php
@@ -91,8 +91,10 @@ include DOL_DOCUMENT_ROOT.'/core/actions_linkedfiles.inc.php';
*/
$title = $langs->trans('InvoiceCustomer')." - ".$langs->trans('Documents');
-$helpurl = "EN:Customers_Invoices|FR:Factures_Clients|ES:Facturas_a_clientes";
-llxHeader('', $title, $helpurl);
+
+$help_url = "EN:Customers_Invoices|FR:Factures_Clients|ES:Facturas_a_clientes";
+
+llxHeader('', $title, $help_url);
$form = new Form($db);
diff --git a/htdocs/compta/facture/index.php b/htdocs/compta/facture/index.php
index 4939fbb6a95..a4d6dd6fec7 100644
--- a/htdocs/compta/facture/index.php
+++ b/htdocs/compta/facture/index.php
@@ -232,7 +232,7 @@ function getDraftTable($maxCount = 500, $socid = 0)
$sql .= " AND f.entity IN (".getEntity('facture').")";
$sql .= " AND f.fk_statut = ".Facture::STATUS_DRAFT;
if ($socid) {
- $sql .= " AND f.fk_soc = ".$socid;
+ $sql .= " AND f.fk_soc = ".((int) $socid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
@@ -329,7 +329,7 @@ function getLatestEditTable($maxCount = 5, $socid = 0)
$sql .= " WHERE f.fk_soc = s.rowid";
$sql .= " AND f.entity IN (".getEntity('facture').")";
if ($socid) {
- $sql .= " AND f.fk_soc = ".$socid;
+ $sql .= " AND f.fk_soc = ".((int) $socid);
}
if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
@@ -432,7 +432,7 @@ function getOpenTable($maxCount = 500, $socid = 0)
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
}
if ($socid) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
$sql .= " ORDER BY f.rowid DESC";
$sql .= $db->plimit($maxCount, 0);
diff --git a/htdocs/compta/facture/list.php b/htdocs/compta/facture/list.php
index 31365b33b58..6cf770cb79c 100644
--- a/htdocs/compta/facture/list.php
+++ b/htdocs/compta/facture/list.php
@@ -513,14 +513,7 @@ if ($userid) {
if ($userid == -1) {
$sql .= ' AND f.fk_user_author IS NULL';
} else {
- $sql .= ' AND f.fk_user_author = '.$userid;
- }
-}
-if ($filtre) {
- $aFilter = explode(',', $filtre);
- foreach ($aFilter as $filter) {
- $filt = explode(':', $filter);
- $sql .= ' AND '.$db->escape(trim($filt[0])).' = '.$db->escape(trim($filt[1]));
+ $sql .= ' AND f.fk_user_author = '.((int) $userid);
}
}
if ($search_ref) {
diff --git a/htdocs/compta/facture/stats/index.php b/htdocs/compta/facture/stats/index.php
index 2818fa5f3b9..96c414db350 100644
--- a/htdocs/compta/facture/stats/index.php
+++ b/htdocs/compta/facture/stats/index.php
@@ -103,16 +103,16 @@ dol_mkdir($dir);
$stats = new FactureStats($db, $socid, $mode, ($userid > 0 ? $userid : 0), ($typent_id > 0 ? $typent_id : 0), ($categ_id > 0 ? $categ_id : 0));
if ($mode == 'customer') {
if ($object_status != '' && $object_status >= 0) {
- $stats->where .= ' AND f.fk_statut IN ('.$db->sanitize($db->escape($object_status)).')';
+ $stats->where .= ' AND f.fk_statut IN ('.$db->sanitize($object_status).')';
}
if (is_array($custcats) && !empty($custcats)) {
$stats->from .= ' LEFT JOIN '.MAIN_DB_PREFIX.'categorie_societe as cat ON (f.fk_soc = cat.fk_soc)';
- $stats->where .= ' AND cat.fk_categorie IN ('.implode(',', $custcats).')';
+ $stats->where .= ' AND cat.fk_categorie IN ('.$db->sanitize(implode(',', $custcats)).')';
}
}
if ($mode == 'supplier') {
if ($object_status != '' && $object_status >= 0) {
- $stats->where .= ' AND f.fk_statut IN ('.$db->sanitize($db->escape($object_status)).')';
+ $stats->where .= ' AND f.fk_statut IN ('.$db->sanitize($object_status).')';
}
}
diff --git a/htdocs/compta/index.php b/htdocs/compta/index.php
index a4c19f4d039..9c3544b512e 100644
--- a/htdocs/compta/index.php
+++ b/htdocs/compta/index.php
@@ -1208,8 +1208,6 @@ if ((!empty($conf->fournisseur->enabled) && empty($conf->global->MAIN_USE_NEW_SU
print '';
print $langs->trans("BillsSuppliersUnpaid", $num).' ';
print '';
- // TODO: "impayees.php" looks very outdatetd and should be set to deprecated or directly remove in the next version
- //
print ''.$num.' ';
print ' ';
print ' ';
diff --git a/htdocs/compta/paiement/class/paiement.class.php b/htdocs/compta/paiement/class/paiement.class.php
index 42b05f39263..9dcc57a47f2 100644
--- a/htdocs/compta/paiement/class/paiement.class.php
+++ b/htdocs/compta/paiement/class/paiement.class.php
@@ -171,9 +171,9 @@ class Paiement extends CommonObject
if ($id > 0) {
$sql .= ' AND p.rowid = '.((int) $id);
} elseif ($ref) {
- $sql .= " AND p.ref = '".$ref."'";
+ $sql .= " AND p.ref = '".$this->db->escape($ref)."'";
} elseif ($fk_bank) {
- $sql .= ' AND p.fk_bank = '.$fk_bank;
+ $sql .= ' AND p.fk_bank = '.((int) $fk_bank);
}
$resql = $this->db->query($sql);
@@ -1127,9 +1127,10 @@ class Paiement extends CommonObject
* @param string $option Sur quoi pointe le lien
* @param string $mode 'withlistofinvoices'=Include list of invoices into tooltip
* @param int $notooltip 1=Disable tooltip
+ * @param string $morecss Add more CSS
* @return string Chaine avec URL
*/
- public function getNomUrl($withpicto = 0, $option = '', $mode = 'withlistofinvoices', $notooltip = 0)
+ public function getNomUrl($withpicto = 0, $option = '', $mode = 'withlistofinvoices', $notooltip = 0, $morecss = '')
{
global $conf, $langs;
@@ -1166,7 +1167,7 @@ class Paiement extends CommonObject
$linkclose = '';
if (empty($notooltip)) {
if (!empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER)) {
- $label = $langs->trans("ShowMyObject");
+ $label = $langs->trans("Payment");
$linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"';
}
$linkclose .= ' title="'.dol_escape_htmltag($label, 1).'"';
diff --git a/htdocs/compta/paiement/list.php b/htdocs/compta/paiement/list.php
index 269acd29600..75c63620b0b 100644
--- a/htdocs/compta/paiement/list.php
+++ b/htdocs/compta/paiement/list.php
@@ -200,13 +200,13 @@ if (GETPOST("orphelins", "alpha")) {
$sql .= " AND sc.fk_user = ".$user->id;
}
if ($socid > 0) {
- $sql .= " AND f.fk_soc = ".$socid;
+ $sql .= " AND f.fk_soc = ".((int) $socid);
}
if ($userid) {
if ($userid == -1) {
$sql .= " AND f.fk_user_author IS NULL";
} else {
- $sql .= " AND f.fk_user_author = ".$userid;
+ $sql .= " AND f.fk_user_author = ".((int) $userid);
}
}
@@ -216,7 +216,7 @@ if (GETPOST("orphelins", "alpha")) {
$sql .= natural_search('p.ref', $search_ref);
}
if ($search_account > 0) {
- $sql .= " AND b.fk_account=".$search_account;
+ $sql .= " AND b.fk_account=".((int) $search_account);
}
if ($search_paymenttype != '') {
$sql .= " AND c.code='".$db->escape($search_paymenttype)."'";
diff --git a/htdocs/compta/paymentbybanktransfer/index.php b/htdocs/compta/paymentbybanktransfer/index.php
index 92bc7ec6ff8..a705353112c 100644
--- a/htdocs/compta/paymentbybanktransfer/index.php
+++ b/htdocs/compta/paymentbybanktransfer/index.php
@@ -115,7 +115,7 @@ if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
}
if ($socid) {
- $sql .= " AND f.fk_soc = ".$socid;
+ $sql .= " AND f.fk_soc = ".((int) $socid);
}
$resql = $db->query($sql);
diff --git a/htdocs/compta/prelevement/card.php b/htdocs/compta/prelevement/card.php
index 24ea982f01b..d04e7131edc 100644
--- a/htdocs/compta/prelevement/card.php
+++ b/htdocs/compta/prelevement/card.php
@@ -351,12 +351,12 @@ if ($id > 0 || $ref) {
$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_lignes as pl";
$sql .= ", ".MAIN_DB_PREFIX."prelevement_bons as pb";
$sql .= ", ".MAIN_DB_PREFIX."societe as s";
- $sql .= " WHERE pl.fk_prelevement_bons = ".$id;
+ $sql .= " WHERE pl.fk_prelevement_bons = ".((int) $id);
$sql .= " AND pl.fk_prelevement_bons = pb.rowid";
$sql .= " AND pb.entity = ".$conf->entity;
$sql .= " AND pl.fk_soc = s.rowid";
if ($socid) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
$sql .= $db->order($sortfield, $sortorder);
diff --git a/htdocs/compta/prelevement/create.php b/htdocs/compta/prelevement/create.php
index deb5fe2fcd5..e12c50b75f5 100644
--- a/htdocs/compta/prelevement/create.php
+++ b/htdocs/compta/prelevement/create.php
@@ -319,7 +319,7 @@ if ($type == 'bank-transfer') {
$sql .= " AND pfd.fk_facture = f.rowid";
}
if ($socid > 0) {
- $sql .= " AND f.fk_soc = ".$socid;
+ $sql .= " AND f.fk_soc = ".((int) $socid);
}
$nbtotalofrecords = '';
diff --git a/htdocs/compta/prelevement/demandes.php b/htdocs/compta/prelevement/demandes.php
index 9d0fa17d246..266097f7a2d 100644
--- a/htdocs/compta/prelevement/demandes.php
+++ b/htdocs/compta/prelevement/demandes.php
@@ -141,14 +141,14 @@ if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
}
if ($socid) {
- $sql .= " AND f.fk_soc = ".$socid;
+ $sql .= " AND f.fk_soc = ".((int) $socid);
}
if (!$status) {
$sql .= " AND pfd.traite = 0";
}
$sql .= " AND pfd.ext_payment_id IS NULL";
if ($status) {
- $sql .= " AND pfd.traite = ".$status;
+ $sql .= " AND pfd.traite = ".((int) $status);
}
$sql .= " AND f.total_ttc > 0";
if (empty($conf->global->WITHDRAWAL_ALLOW_ANY_INVOICE_STATUS)) {
diff --git a/htdocs/compta/prelevement/factures.php b/htdocs/compta/prelevement/factures.php
index 301a5c7808c..23511a4a00a 100644
--- a/htdocs/compta/prelevement/factures.php
+++ b/htdocs/compta/prelevement/factures.php
@@ -195,10 +195,10 @@ if ($object->type != 'bank-transfer') {
$sql .= " AND f.entity IN (".getEntity('supplier_invoice').")";
}
if ($object->id > 0) {
- $sql .= " AND p.rowid=".$object->id;
+ $sql .= " AND p.rowid = ".((int) $object->id);
}
if ($socid) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
$sql .= $db->order($sortfield, $sortorder);
diff --git a/htdocs/compta/prelevement/fiche-rejet.php b/htdocs/compta/prelevement/fiche-rejet.php
index 62c3c4849f8..9a4f209e134 100644
--- a/htdocs/compta/prelevement/fiche-rejet.php
+++ b/htdocs/compta/prelevement/fiche-rejet.php
@@ -177,7 +177,7 @@ $sql .= " AND pl.fk_soc = s.rowid";
$sql .= " AND pl.statut = 3 ";
$sql .= " AND pr.fk_prelevement_lignes = pl.rowid";
if ($socid) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
$sql .= " ORDER BY pl.amount DESC";
diff --git a/htdocs/compta/prelevement/index.php b/htdocs/compta/prelevement/index.php
index 2da8e1f0812..6e537159721 100644
--- a/htdocs/compta/prelevement/index.php
+++ b/htdocs/compta/prelevement/index.php
@@ -115,7 +115,7 @@ if (!$user->rights->societe->client->voir && !$socid) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
}
if ($socid) {
- $sql .= " AND f.fk_soc = ".$socid;
+ $sql .= " AND f.fk_soc = ".((int) $socid);
}
$resql = $db->query($sql);
diff --git a/htdocs/compta/prelevement/line.php b/htdocs/compta/prelevement/line.php
index 68ca3795fe3..73c985355b1 100644
--- a/htdocs/compta/prelevement/line.php
+++ b/htdocs/compta/prelevement/line.php
@@ -262,9 +262,9 @@ if ($id) {
$sql .= " AND f.fk_soc = s.rowid";
$sql .= " AND pf.fk_facture = f.rowid";
$sql .= " AND f.entity IN (".getEntity('invoice').")";
- $sql .= " AND pl.rowid=".$id;
+ $sql .= " AND pl.rowid = ".((int) $id);
if ($socid) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
$sql .= " ORDER BY $sortfield $sortorder ";
$sql .= $db->plimit($conf->liste_limit + 1, $offset);
diff --git a/htdocs/compta/resultat/index.php b/htdocs/compta/resultat/index.php
index e5b86ba762e..272d6808b32 100644
--- a/htdocs/compta/resultat/index.php
+++ b/htdocs/compta/resultat/index.php
@@ -347,7 +347,7 @@ if (!empty($conf->facture->enabled) && ($modecompta == 'CREANCES-DETTES' || $mod
$sql .= " AND f.entity = ".$conf->entity;
if ($socid) {
- $sql .= " AND f.fk_soc = ".$socid;
+ $sql .= " AND f.fk_soc = ".((int) $socid);
}
$sql .= " GROUP BY dm";
diff --git a/htdocs/compta/resultat/result.php b/htdocs/compta/resultat/result.php
index 91932100565..8ef75bf5846 100644
--- a/htdocs/compta/resultat/result.php
+++ b/htdocs/compta/resultat/result.php
@@ -281,7 +281,7 @@ if ($modecompta == 'CREANCES-DETTES') {
if (! empty($date_start) && ! empty($date_end))
$sql.= " AND t.doc_date >= '".$db->idate($date_start)."' AND t.doc_date <= '".$db->idate($date_end)."'";
if (! empty($month)) {
- $sql .= " AND MONTH(t.doc_date) = " . $month;
+ $sql .= " AND MONTH(t.doc_date) = " . ((int) $month);
}
$resql = $db->query($sql);
if ($resql)
diff --git a/htdocs/compta/sociales/card.php b/htdocs/compta/sociales/card.php
index 067c021fe75..83a6a8f3b3a 100644
--- a/htdocs/compta/sociales/card.php
+++ b/htdocs/compta/sociales/card.php
@@ -445,12 +445,24 @@ if ($id > 0) {
// Employee
if ($action != 'editfk_user') {
- $morehtmlref .= ' ' . $form->editfieldkey("Employee", 'fk_user', $object->label, $object, $user->rights->tax->charges->creer, 'string', '', 0, 1);
-
- if (!empty($object->fk_user)) {
+ if ($object->getSommePaiement() > 0 && !empty($object->fk_user)) {
$userstatic = new User($db);
- $userstatic->fetch($object->fk_user);
- $morehtmlref .= $userstatic->getNomUrl(1);
+ $result = $userstatic->fetch($object->fk_user);
+ if ($result > 0) {
+ $morehtmlref .= ' ' .$langs->trans('Employee').' : '.$userstatic->getNomUrl(1);
+ }
+ } else {
+ $morehtmlref .= ' ' . $form->editfieldkey("Employee", 'fk_user', $object->label, $object, $user->rights->salaries->write, 'string', '', 0, 1);
+ if (!empty($object->fk_user)) {
+ $userstatic = new User($db);
+ $result = $userstatic->fetch($object->fk_user);
+ if ($result > 0) {
+ $morehtmlref .= $userstatic->getNomUrl(1);
+ } else {
+ dol_print_error($db);
+ exit();
+ }
+ }
}
} else {
$morehtmlref .= ' '.$langs->trans('Employee').' : ';
diff --git a/htdocs/compta/sociales/list.php b/htdocs/compta/sociales/list.php
index dff6a887f0f..48c6936a225 100644
--- a/htdocs/compta/sociales/list.php
+++ b/htdocs/compta/sociales/list.php
@@ -209,10 +209,6 @@ if ($year > 0) {
$sql .= "OR (cs.periode IS NULL AND date_format(cs.date_ech, '%Y') = '".$db->escape($year)."')";
$sql .= ")";
}
-if ($filtre) {
- $filtre = str_replace(":", "=", $filtre);
- $sql .= " AND ".$filtre;
-}
if ($search_typeid) {
$sql .= " AND cs.fk_type=".$db->escape($search_typeid);
}
diff --git a/htdocs/compta/stats/cabyprodserv.php b/htdocs/compta/stats/cabyprodserv.php
index 25d9d4b9460..4ecbe6d56d0 100644
--- a/htdocs/compta/stats/cabyprodserv.php
+++ b/htdocs/compta/stats/cabyprodserv.php
@@ -323,9 +323,9 @@ if ($modecompta == 'CREANCES-DETTES') {
$sql .= " AND (p.rowid IN ";
$sql .= " (SELECT fk_product FROM ".MAIN_DB_PREFIX."categorie_product cp WHERE ";
if ($subcat) {
- $sql .= "cp.fk_categorie IN (".$listofcatsql.")";
+ $sql .= "cp.fk_categorie IN (".$db->sanitize($listofcatsql).")";
} else {
- $sql .= "cp.fk_categorie = ".$selected_cat;
+ $sql .= "cp.fk_categorie = ".((int) $selected_cat);
}
$sql .= "))";
}
diff --git a/htdocs/compta/stats/supplier_turnover.php b/htdocs/compta/stats/supplier_turnover.php
index 141db21b73e..bf91d8b4d6a 100644
--- a/htdocs/compta/stats/supplier_turnover.php
+++ b/htdocs/compta/stats/supplier_turnover.php
@@ -16,7 +16,7 @@
*/
/**
- * \file htdocs/compta/stats/supplier_ca.php
+ * \file htdocs/compta/stats/supplier_turnover.php
* \brief Page reporting purchase turnover
*/
diff --git a/htdocs/compta/stats/supplier_turnover_by_thirdparty.php b/htdocs/compta/stats/supplier_turnover_by_thirdparty.php
index 0530d58ee87..4b64b2e5942 100644
--- a/htdocs/compta/stats/supplier_turnover_by_thirdparty.php
+++ b/htdocs/compta/stats/supplier_turnover_by_thirdparty.php
@@ -16,7 +16,7 @@
*/
/**
- * \file htdocs/compta/stats/supplier_ca_by_thirdparty.php
+ * \file htdocs/compta/stats/supplier_turnover_by_thirdparty.php
* \brief Page reporting purchase turnover by thirdparty
*/
diff --git a/htdocs/compta/tva/card.php b/htdocs/compta/tva/card.php
index 71e511397b6..c4daeb801c6 100755
--- a/htdocs/compta/tva/card.php
+++ b/htdocs/compta/tva/card.php
@@ -405,7 +405,7 @@ if ($action == 'create') {
print ' ';
print "
\n";
- dol_fiche_head();
+ print dol_get_fiche_head();
print '
';
- dol_fiche_end();
+ print dol_get_fiche_end();
print '