lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix #yogosha5881

Browse Source
This commit is contained in:
Laurent Destailleur 2021-04-25 15:55:36 +02:00
parent e780bae77f
commit fd2d317b4a
43 changed files with 62 additions and 61 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/accountancy/journal/bankjournal.php
View File

@ -130,7 +130,7 @@ $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."bank_url as bu3 ON bu3.fk_bank = b.rowid A
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."bank_url as bu4 ON bu4.fk_bank = b.rowid AND bu4.type='payment_supplier'";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe as soc on bu1.url_id=soc.rowid";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."user as u on bu2.url_id=u.rowid";
$sql .= " WHERE ba.fk_accountancy_journal=".$id_journal;
$sql .= " WHERE ba.fk_accountancy_journal=".((int) $id_journal);
$sql .= ' AND b.amount != 0 AND ba.entity IN ('.getEntity('bank_account', 0).')'; // We don't share object for accountancy
if ($date_start && $date_end) {
$sql .= " AND b.dateo >= '".$db->idate($date_start)."' AND b.dateo <= '".$db->idate($date_end)."'";

2
htdocs/comm/action/card.php
View File

@ -1395,7 +1395,7 @@ if ($id > 0) {
// Confirmation suppression action
if ($action == 'delete') {
print $form->formconfirm("card.php?id=".$id, $langs->trans("DeleteAction"), $langs->trans("ConfirmDeleteAction"), "confirm_delete", '', '', 1);
print $form->formconfirm("card.php?id=".urlencode($id), $langs->trans("DeleteAction"), $langs->trans("ConfirmDeleteAction"), "confirm_delete", '', '', 1);
}
if ($action == 'edit') {

4
htdocs/comm/mailing/card.php
View File

@ -308,7 +308,7 @@ if (empty($reshook)) {
dol_syslog("comm/mailing/card.php: ok for #".$i.($mail->error ? ' - '.$mail->error : ''), LOG_DEBUG);
$sql = "UPDATE ".MAIN_DB_PREFIX."mailing_cibles";
$sql .= " SET statut=1, date_envoi='".$db->idate($now)."' WHERE rowid=".$obj->rowid;
$sql .= " SET statut=1, date_envoi = '".$db->idate($now)."' WHERE rowid=".((int) $obj->rowid);
$resql2 = $db->query($sql);
if (!$resql2) {
dol_print_error($db);
@ -378,7 +378,7 @@ if (empty($reshook)) {
}
}
$sql = "UPDATE ".MAIN_DB_PREFIX."mailing SET statut=".$statut." WHERE rowid=".$object->id;
$sql = "UPDATE ".MAIN_DB_PREFIX."mailing SET statut=".((int) $statut)." WHERE rowid = ".((int) $object->id);
dol_syslog("comm/mailing/card.php: update global status", LOG_DEBUG);
$resql2 = $db->query($sql);
if (!$resql2) {

2
htdocs/comm/mailing/cibles.php
View File

@ -104,8 +104,6 @@ if ($action == 'add') {
}
if ($result > 0) {
setEventMessages($langs->trans("XTargetsAdded", $result), null, 'mesgs');
//header("Location: ".$_SERVER['PHP_SELF']."?id=".$id);
//exit;
$action = '';
}
if ($result == 0) {

4
htdocs/comm/propal/card.php
View File

@ -1248,7 +1248,7 @@ if (empty($reshook)) {
if (empty($user->rights->margins->creer)) {
foreach ($object->lines as &$line) {
if ($line->id == GETPOST('lineid')) {
if ($line->id == GETPOST('lineid', 'int')) {
$fournprice = $line->fk_fournprice;
$buyingprice = $line->pa_ht;
break;
@ -2433,7 +2433,7 @@ if ($action == 'create') {
// Show object lines
$result = $object->getLinesArray();
print ' <form name="addproduct" id="addproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.(($action != 'editline') ? '#addline' : '#line_'.GETPOST('lineid')).'" method="POST">
print ' <form name="addproduct" id="addproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.(($action != 'editline') ? '#addline' : '#line_'.GETPOST('lineid', 'int')).'" method="POST">
<input type="hidden" name="token" value="' . newToken().'">
<input type="hidden" name="action" value="' . (($action != 'editline') ? 'addline' : 'updateline').'">
<input type="hidden" name="mode" value="">

4
htdocs/commande/card.php
View File

@ -1052,7 +1052,7 @@ if (empty($reshook)) {
if (!$error) {
if (empty($user->rights->margins->creer)) {
foreach ($object->lines as &$line) {
if ($line->id == GETPOST('lineid')) {
if ($line->id == GETPOST('lineid', 'int')) {
$fournprice = $line->fk_fournprice;
$buyingprice = $line->pa_ht;
break;
@ -2416,7 +2416,7 @@ if ($action == 'create' && $usercancreate) {
*/
$result = $object->getLinesArray();
print '<form name="addproduct" id="addproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.(($action != 'editline') ? '#addline' : '#line_'.GETPOST('lineid')).'" method="POST">
print '<form name="addproduct" id="addproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.(($action != 'editline') ? '#addline' : '#line_'.GETPOST('lineid', 'int')).'" method="POST">
<input type="hidden" name="token" value="' . newToken().'">
<input type="hidden" name="action" value="' . (($action != 'editline') ? 'addline' : 'updateline').'">
<input type="hidden" name="mode" value="">

8
htdocs/commande/class/commande.class.php
View File

@ -4206,11 +4206,15 @@ class OrderLine extends CommonOrderLine
$error = 0;
if (empty($this->id) && !empty($this->rowid)) { // For backward compatibility
$this->id = $this->rowid;
}
// check if order line is not in a shipment line before deleting
$sqlCheckShipmentLine = "SELECT";
$sqlCheckShipmentLine .= " ed.rowid";
$sqlCheckShipmentLine .= " FROM ".MAIN_DB_PREFIX."expeditiondet ed";
$sqlCheckShipmentLine .= " WHERE ed.fk_origin_line = ".$this->rowid;
$sqlCheckShipmentLine .= " WHERE ed.fk_origin_line = ".((int) $this->id);
$resqlCheckShipmentLine = $this->db->query($sqlCheckShipmentLine);
if (!$resqlCheckShipmentLine) {
@ -4235,7 +4239,7 @@ class OrderLine extends CommonOrderLine
$this->db->begin();
$sql = 'DELETE FROM '.MAIN_DB_PREFIX."commandedet WHERE rowid=".$this->rowid;
$sql = 'DELETE FROM '.MAIN_DB_PREFIX."commandedet WHERE rowid = ".((int) $this->id);
dol_syslog("OrderLine::delete", LOG_DEBUG);
$resql = $this->db->query($sql);

2
htdocs/compta/bank/account_statement_document.php
View File

@ -129,7 +129,7 @@ if (!empty($numref)) {
$object->fetch_thirdparty();
$upload_dir = $conf->bank->dir_output."/".$id."/statement/".dol_sanitizeFileName($numref);
}
$backtopage = $_SERVER['PHP_SELF']."?account=".$id."&num=".$numref;
$backtopage = $_SERVER['PHP_SELF']."?account=".urlencode($id)."&num=".urlencode($numref);
include DOL_DOCUMENT_ROOT.'/core/actions_linkedfiles.inc.php';

2
htdocs/compta/bank/line.php
View File

@ -291,7 +291,7 @@ if ($result) {
// Confirmations
if ($action == 'delete_categ') {
print $form->formconfirm($_SERVER['PHP_SELF']."?rowid=".$rowid."&cat1=".GETPOST("fk_categ")."&orig_account=".$orig_account, $langs->trans("RemoveFromRubrique"), $langs->trans("RemoveFromRubriqueConfirm"), "confirm_delete_categ", '', 'yes', 1);
print $form->formconfirm($_SERVER['PHP_SELF']."?rowid=".urlencode($rowid)."&cat1=".urlencode(GETPOST("fk_categ", 'int'))."&orig_account=".urlencode($orig_account), $langs->trans("RemoveFromRubrique"), $langs->trans("RemoveFromRubriqueConfirm"), "confirm_delete_categ", '', 'yes', 1);
}
print '<form name="update" method="POST" action="'.$_SERVER['PHP_SELF'].'?rowid='.$rowid.'">';

2
htdocs/compta/bank/various_payment/list.php
View File

@ -226,7 +226,7 @@ $sql .= " WHERE v.entity IN (".getEntity('payment_various').")";
// Search criteria
if ($search_ref) {
$sql .= " AND v.rowid=".$db->escape($search_ref);
$sql .= " AND v.rowid = ".((int) $search_ref);
}
if ($search_label) {
$sql .= natural_search(array('v.label'), $search_label);

2
htdocs/compta/deplacement/card.php
View File

@ -366,7 +366,7 @@ if ($action == 'create') {
* Confirm delete trip
*/
if ($action == 'delete') {
print $form->formconfirm($_SERVER["PHP_SELF"]."?id=".$id, $langs->trans("DeleteTrip"), $langs->trans("ConfirmDeleteTrip"), "confirm_delete");
print $form->formconfirm($_SERVER["PHP_SELF"]."?id=".urlencode($id), $langs->trans("DeleteTrip"), $langs->trans("ConfirmDeleteTrip"), "confirm_delete");
}
$soc = new Societe($db);

6
htdocs/compta/facture/card-rec.php
View File

@ -770,7 +770,7 @@ if (empty($reshook)) {
}
/*$line = new FactureLigne($db);
$line->fetch(GETPOST('lineid'));
$line->fetch(GETPOST('lineid', 'int'));
$percent = $line->get_prev_progress($object->id);
if (GETPOST('progress') < $percent)
@ -823,7 +823,7 @@ if (empty($reshook)) {
// Update line
if (!$error) {
$result = $object->updateline(
GETPOST('lineid'),
GETPOST('lineid', 'int'),
$description,
$pu_ht,
$qty,
@ -1597,7 +1597,7 @@ if ($action == 'create') {
// Lines
print ' <form name="addproduct" id="addproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.(($action != 'editline') ? '#add' : '#line_'.GETPOST('lineid')).'" method="POST">
print ' <form name="addproduct" id="addproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.(($action != 'editline') ? '#add' : '#line_'.GETPOST('lineid', 'int')).'" method="POST">
<input type="hidden" name="token" value="' . newToken().'">
<input type="hidden" name="action" value="' . (($action != 'editline') ? 'addline' : 'updateline').'">
<input type="hidden" name="mode" value="">

10
htdocs/compta/facture/card.php
View File

@ -238,13 +238,13 @@ if (empty($reshook)) {
$object->fetch($id);
$object->fetch_thirdparty();
$result = $object->deleteline(GETPOST('lineid'));
$result = $object->deleteline(GETPOST('lineid', 'int'));
if ($result > 0) {
// Define output language
$outputlangs = $langs;
$newlang = '';
if ($conf->global->MAIN_MULTILANGS && empty($newlang) && !empty($_REQUEST['lang_id'])) {
$newlang = $_REQUEST['lang_id'];
if ($conf->global->MAIN_MULTILANGS && empty($newlang) && GETPOST('lang_id')) {
$newlang = GETPOST('lang_id');
}
if ($conf->global->MAIN_MULTILANGS && empty($newlang)) {
$newlang = $object->thirdparty->default_lang;
@ -2416,7 +2416,7 @@ if (empty($reshook)) {
if (!$error) {
if (empty($usercancreatemargin)) {
foreach ($object->lines as &$line) {
if ($line->id == GETPOST('lineid')) {
if ($line->id == GETPOST('lineid', 'int')) {
$fournprice = $line->fk_fournprice;
$buyingprice = $line->pa_ht;
break;
@ -5168,7 +5168,7 @@ if ($action == 'create') {
}
}
print ' <form name="addproduct" id="addproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.(($action != 'editline') ? '#addline' : '#line_'.GETPOST('lineid')).'" method="POST">
print ' <form name="addproduct" id="addproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.(($action != 'editline') ? '#addline' : '#line_'.GETPOST('lineid', 'int')).'" method="POST">
<input type="hidden" name="token" value="' . newToken().'">
<input type="hidden" name="action" value="' . (($action != 'editline') ? 'addline' : 'updateline').'">
<input type="hidden" name="mode" value="">

2
htdocs/compta/facture/class/facture-rec.class.php
View File

@ -765,7 +765,7 @@ class FactureRec extends CommonInvoice
{
$rowid = $this->id;
dol_syslog(get_class($this)."::delete rowid=".$rowid, LOG_DEBUG);
dol_syslog(get_class($this)."::delete rowid=".((int) $rowid), LOG_DEBUG);
$error = 0;
$this->db->begin();

2
htdocs/compta/facture/class/facture.class.php
View File

@ -3657,7 +3657,7 @@ class Facture extends CommonInvoice
{
global $user;
dol_syslog(get_class($this)."::deleteline rowid=".$rowid, LOG_DEBUG);
dol_syslog(get_class($this)."::deleteline rowid=".((int) $rowid), LOG_DEBUG);
if ($this->statut != self::STATUS_DRAFT) {
$this->error = 'ErrorDeleteLineNotAllowedByObjectStatus';

2
htdocs/compta/prelevement/card.php
View File

@ -380,7 +380,7 @@ if ($id > 0 || $ref) {
$num = $db->num_rows($result);
$i = 0;
$urladd = "&amp;id=".$id;
$urladd = "&id=".urlencode($id);
print '<form method="get" action="'.$_SERVER ['PHP_SELF'].'" name="search_form">'."\n";
print '<input type="hidden" name="id" value="'.$id.'"/>';

2
htdocs/compta/prelevement/factures.php
View File

@ -220,7 +220,7 @@ if ($resql) {
$num = $db->num_rows($resql);
$i = 0;
$param = "&id=".$id;
$param = "&id=".urlencode($id);
// Lines of title fields
print '<form method="POST" id="searchFormList" action="'.$_SERVER["PHP_SELF"].'">';

2
htdocs/compta/prelevement/line.php
View File

@ -275,7 +275,7 @@ if ($id) {
$num = $db->num_rows($result);
$i = 0;
$urladd = "&amp;id=".$id;
$urladd = "&id=".urlencode($id);
print_barre_liste($langs->trans("Bills"), $page, "factures.php", $urladd, $sortfield, $sortorder, '', $num, 0, '');

4
htdocs/contrat/card.php
View File

@ -711,7 +711,7 @@ if (empty($reshook)) {
$db->rollback();
}
} elseif ($action == 'confirm_deleteline' && $confirm == 'yes' && $user->rights->contrat->creer) {
$result = $object->deleteline(GETPOST('lineid'), $user);
$result = $object->deleteline(GETPOST('lineid', 'int'), $user);
if ($result >= 0) {
header("Location: ".$_SERVER['PHP_SELF']."?id=".$object->id);
@ -1963,7 +1963,7 @@ if ($action == 'create') {
$dateSelector = 1;
print "\n";
print ' <form name="addproduct" id="addproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.(($action != 'editline') ? '#add' : '#line_'.GETPOST('lineid')).'" method="POST">
print ' <form name="addproduct" id="addproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.(($action != 'editline') ? '#add' : '#line_'.GETPOST('lineid', 'int')).'" method="POST">
<input type="hidden" name="token" value="'.newToken().'">
<input type="hidden" name="action" value="'.(($action != 'editline') ? 'addline' : 'updateline').'">
<input type="hidden" name="mode" value="">

2
htdocs/contrat/class/contrat.class.php
View File

@ -1832,7 +1832,7 @@ class Contrat extends CommonObject
$this->db->begin();
$sql = "DELETE FROM ".MAIN_DB_PREFIX.$this->table_element_line;
$sql .= " WHERE rowid=".$idline;
$sql .= " WHERE rowid = ".((int) $idline);
dol_syslog(get_class($this)."::deleteline", LOG_DEBUG);
$resql = $this->db->query($sql);

2
htdocs/core/class/commonobject.class.php
View File

@ -8893,7 +8893,7 @@ abstract class CommonObject
$this->db->begin();
$sql = "DELETE FROM ".MAIN_DB_PREFIX.$this->table_element_line;
$sql .= " WHERE rowid=".$idline;
$sql .= " WHERE rowid = ".((int) $idline);
dol_syslog(get_class($this)."::deleteLineCommon", LOG_DEBUG);
$resql = $this->db->query($sql);

2
htdocs/core/lib/company.lib.php
View File

@ -571,7 +571,7 @@ function getState($id, $withcode = '', $dbtouse = 0, $withregion = 0, $outputlan
$sql = "SELECT d.rowid as id, d.code_departement as code, d.nom as name, d.active, c.label as country, c.code as country_code, r.code_region as region_code, r.nom as region_name FROM";
$sql .= " ".MAIN_DB_PREFIX."c_departements as d, ".MAIN_DB_PREFIX."c_regions as r,".MAIN_DB_PREFIX."c_country as c";
$sql .= " WHERE d.fk_region=r.code_region and r.fk_pays=c.rowid and d.rowid=".$id;
$sql .= " WHERE d.fk_region=r.code_region and r.fk_pays=c.rowid and d.rowid=".((int) $id);
$sql .= " AND d.active = 1 AND r.active = 1 AND c.active = 1";
$sql .= " ORDER BY c.code, d.code_departement";

4
htdocs/core/tpl/resource_view.tpl.php
View File

@ -33,7 +33,7 @@ if ((array) $linked_resources && count($linked_resources) > 0) {
//$element_id = $linked_resource['rowid'];
if ($mode == 'edit' && $linked_resource['rowid'] == GETPOST('lineid')) {
if ($mode == 'edit' && $linked_resource['rowid'] == GETPOST('lineid', 'int')) {
print '<div class="tagtr oddeven">';
print '<input type="hidden" name="lineid" value="'.$linked_resource['rowid'].'" />';
print '<input type="hidden" name="element" value="'.$element.'" />';
@ -47,7 +47,7 @@ if ((array) $linked_resources && count($linked_resources) > 0) {
print '</div>';
} else {
$class = '';
if ($linked_resource['rowid'] == GETPOST('lineid')) {
if ($linked_resource['rowid'] == GETPOST('lineid', 'int')) {
$class = 'highlight';
}

2
htdocs/don/card.php
View File

@ -120,7 +120,7 @@ if ($action == 'confirm_reopen' && $confirm == 'yes' && $permissiontoadd) {
if ($action == 'update') {
if (!empty($cancel)) {
header("Location: ".$_SERVER['PHP_SELF']."?id=".$id);
header("Location: ".$_SERVER['PHP_SELF']."?id=".urlencode($id));
exit;
}

4
htdocs/expedition/class/expeditionbatch.class.php
View File

@ -151,10 +151,8 @@ class ExpeditionLineBatch extends CommonObject
*/
public static function deletefromexp($db, $id_expedition)
{
$id_expedition = (int) $id_expedition;
$sql = "DELETE FROM ".MAIN_DB_PREFIX.self::$_table_element;
$sql .= " WHERE fk_expeditiondet in (SELECT rowid FROM ".MAIN_DB_PREFIX."expeditiondet WHERE fk_expedition=".$id_expedition.")";
$sql .= " WHERE fk_expeditiondet in (SELECT rowid FROM ".MAIN_DB_PREFIX."expeditiondet WHERE fk_expedition=".((int) $id_expedition).")";
dol_syslog(__METHOD__, LOG_DEBUG);
if ($db->query($sql)) {

2
htdocs/expedition/shipment.php
View File

@ -258,7 +258,7 @@ if ($id > 0 || !empty($ref)) {
// Confirm validation
if ($action == 'cloture') {
$formconfirm = $form->formconfirm($_SERVER['PHP_SELF']."?id=".$id, $langs->trans("CloseShipment"), $langs->trans("ConfirmCloseShipment"), "confirm_cloture");
$formconfirm = $form->formconfirm($_SERVER['PHP_SELF']."?id=".urlencode($id), $langs->trans("CloseShipment"), $langs->trans("ConfirmCloseShipment"), "confirm_cloture");
}
// Call Hook formConfirm

2
htdocs/fourn/class/fournisseur.facture.class.php
View File

@ -678,7 +678,7 @@ class FactureFournisseur extends CommonInvoice
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_paiement as p ON t.fk_mode_reglement = p.id";
$sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_incoterms as i ON t.fk_incoterms = i.rowid';
if ($id) {
$sql .= " WHERE t.rowid=".$id;
$sql .= " WHERE t.rowid=".((int) $id);
}
if ($ref) {
$sql .= " WHERE t.ref='".$this->db->escape($ref)."' AND t.entity IN (".getEntity('supplier_invoice').")";

4
htdocs/fourn/commande/card.php
View File

@ -1326,7 +1326,7 @@ if (empty($reshook)) {
$_GET['socid'] = $_POST['socid'];
} else {
$db->commit();
header("Location: ".$_SERVER['PHP_SELF']."?id=".$id);
header("Location: ".$_SERVER['PHP_SELF']."?id=".urlencode($id));
exit;
}
}
@ -2275,7 +2275,7 @@ if ($action == 'create') {
//$result = $object->getLinesArray();
print ' <form name="addproduct" id="addproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.(($action != 'editline') ? '#addline' : '#line_'.GETPOST('lineid')).'" method="POST">
print ' <form name="addproduct" id="addproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.(($action != 'editline') ? '#addline' : '#line_'.GETPOST('lineid', 'int')).'" method="POST">
<input type="hidden" name="token" value="'.newToken().'">
<input type="hidden" name="action" value="' . (($action != 'editline') ? 'addline' : 'updateline').'">
<input type="hidden" name="mode" value="">

2
htdocs/fourn/commande/dispatch.php
View File

@ -1166,7 +1166,7 @@ if ($id > 0 || !empty($ref)) {
$objp = $db->fetch_object($resql);
if ($action == 'editline' && $lineid == $objp->dispatchlineid) {
print '<form name="editdispatchedlines" id="editdispatchedlines" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'#line_'.GETPOST('lineid').'" method="POST">
print '<form name="editdispatchedlines" id="editdispatchedlines" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'#line_'.GETPOST('lineid', 'int').'" method="POST">
<input type="hidden" name="token" value="'.newToken().'">
<input type="hidden" name="action" value="updateline">
<input type="hidden" name="mode" value="">

2
htdocs/fourn/facture/card.php
View File

@ -3293,7 +3293,7 @@ if ($action == 'create') {
/*
* Lines
*/
print '<form name="addproduct" id="addproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.(($action != 'editline') ? '#addline' : '#line_'.GETPOST('lineid')).'" method="POST">';
print '<form name="addproduct" id="addproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.(($action != 'editline') ? '#addline' : '#line_'.GETPOST('lineid', 'int')).'" method="POST">';
print '<input type="hidden" name="token" value="'.newToken().'">';
print '<input type="hidden" name="action" value="'.(($action != 'editline') ? 'addline' : 'updateline').'">';
print '<input type="hidden" name="mode" value="">';

1
htdocs/ftp/admin/ftpclient.php
View File

@ -237,6 +237,7 @@ if (!function_exists('ftp_connect')) {
while ($i < $num) {
$obj = $db->fetch_object($resql);
$reg = array();
preg_match('/([0-9]+)$/i', $obj->name, $reg);
$idrss = $reg[0];
//print "x".join(',',$reg)."=".$obj->name."=".$idrss;

2
htdocs/install/lib/repair.lib.php
View File

@ -140,7 +140,7 @@ function clean_data_ecm_directories()
$label = $obj->label;
$newlabel = dol_sanitizeFileName($label);
if ($label != $newlabel) {
$sqlupdate = "UPDATE ".MAIN_DB_PREFIX."ecm_directories set label='".$db->escape($newlabel)."' WHERE rowid=".$id;
$sqlupdate = "UPDATE ".MAIN_DB_PREFIX."ecm_directories set label = '".$db->escape($newlabel)."' WHERE rowid = ".((int) $id);
print '<tr><td>'.$sqlupdate."</td></tr>\n";
$resqlupdate = $db->query($sqlupdate);
if (!$resqlupdate) {

2
htdocs/intracommreport/card.php
View File

@ -203,7 +203,7 @@ if ($id > 0 && $action != 'edit') {
);
}
print $form->formconfirm(
"card.php?rowid=".$id,
"card.php?rowid=".urlencode($id),
$langs->trans("DeleteReport"),
$langs->trans("ConfirmDeleteReport"),
"confirm_delete",

2
htdocs/margin/productMargins.php
View File

@ -198,7 +198,7 @@ $sql .= ' AND f.entity IN ('.getEntity('invoice').')';
$sql .= " AND f.fk_statut NOT IN (".$db->sanitize(implode(', ', $invoice_status_except_list)).")";
$sql .= " AND d.fk_facture = f.rowid";
if ($id > 0) {
$sql .= " AND d.fk_product =".$id;
$sql .= " AND d.fk_product =".((int) $id);
}
if (!empty($TSelectedCats)) {
$sql .= ' AND cp.fk_categorie IN ('.$db->sanitize(implode(',', $TSelectedCats)).')';

4
htdocs/product/class/product.class.php
View File

@ -4535,8 +4535,8 @@ class Product extends CommonObject
$sql .= " FROM ".MAIN_DB_PREFIX."product as p,";
$sql .= " ".MAIN_DB_PREFIX."product_association as pa";
$sql .= " WHERE p.rowid = pa.fk_product_fils";
$sql .= " AND pa.fk_product_pere = ".$id;
$sql .= " AND pa.fk_product_fils != ".$id; // This should not happens, it is to avoid infinite loop if it happens
$sql .= " AND pa.fk_product_pere = ".((int) $id);
$sql .= " AND pa.fk_product_fils <> ".((int) $id); // This should not happens, it is to avoid infinite loop if it happens
dol_syslog(get_class($this).'::getChildsArbo id='.$id.' level='.$level, LOG_DEBUG);

2
htdocs/product/price.php
View File

@ -568,7 +568,7 @@ if (empty($reshook)) {
if ($action == 'delete_customer_price' && ($user->rights->produit->supprimer || $user->rights->service->supprimer)) {
// Delete price by customer
$prodcustprice->id = GETPOST('lineid');
$prodcustprice->id = GETPOST('lineid', 'int');
$result = $prodcustprice->delete($user);
if ($result < 0) {

2
htdocs/product/stock/card.php
View File

@ -137,7 +137,7 @@ if (empty($reshook)) {
header("Location: ".$backtopage);
exit;
} else {
header("Location: card.php?id=".$id);
header("Location: card.php?id=".urlencode($id));
exit;
}
} else {

2
htdocs/reception/class/reception.class.php
View File

@ -1317,7 +1317,7 @@ class Reception extends CommonObject
$sql = "SELECT em.rowid, em.code, em.libelle, em.description, em.tracking, em.active";
$sql .= " FROM ".MAIN_DB_PREFIX."c_shipment_mode as em";
if ($id != '') {
$sql .= " WHERE em.rowid=".$id;
$sql .= " WHERE em.rowid = ".((int) $id);
}
$resql = $this->db->query($sql);

2
htdocs/societe/list.php
View File

@ -292,7 +292,7 @@ if ($action == "change") { // Change customer for TakePOS
$db->query($sql);
}
$sql = "UPDATE ".MAIN_DB_PREFIX."facture set fk_soc=".$idcustomer." where ref='(PROV-POS".$_SESSION["takeposterminal"]."-".$place.")'";
$sql = "UPDATE ".MAIN_DB_PREFIX."facture set fk_soc=".((int) $idcustomer)." where ref='(PROV-POS".$_SESSION["takeposterminal"]."-".$place.")'";
$resql = $db->query($sql);
?>
<script>

2
htdocs/supplier_proposal/card.php
View File

@ -1743,7 +1743,7 @@ if ($action == 'create') {
// Show object lines
$result = $object->getLinesArray();
print ' <form name="addproduct" id="addproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.(($action != 'editline') ? '#add' : '#line_'.GETPOST('lineid')).'" method="POST">
print ' <form name="addproduct" id="addproduct" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.(($action != 'editline') ? '#add' : '#line_'.GETPOST('lineid', 'int')).'" method="POST">
<input type="hidden" name="token" value="' . newToken().'">
<input type="hidden" name="action" value="' . (($action != 'editline') ? 'addline' : 'updateline').'">
<input type="hidden" name="mode" value="">

2
htdocs/ticket/class/ticket.class.php
View File

@ -1452,7 +1452,7 @@ class Ticket extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."ticket";
if ($id_assign_user > 0) {
$sql .= " SET fk_user_assign=".$id_assign_user.", fk_statut = ".Ticket::STATUS_ASSIGNED;
$sql .= " SET fk_user_assign=".((int) $id_assign_user).", fk_statut = ".Ticket::STATUS_ASSIGNED;
} else {
$sql .= " SET fk_user_assign=null, fk_statut = ".Ticket::STATUS_READ;
}

6
htdocs/user/notify/card.php
View File

@ -97,7 +97,7 @@ if ($action == 'add') {
$db->begin();
$sql = "DELETE FROM ".MAIN_DB_PREFIX."notify_def";
$sql .= " WHERE fk_user=".$id." AND fk_action=".$actionid;
$sql .= " WHERE fk_user=".((int) $id)." AND fk_action=".((int) $actionid);
if ($db->query($sql)) {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."notify_def (datec,fk_user, fk_action)";
$sql .= " VALUES ('".$db->idate($now)."',".$id.",".$actionid.")";
@ -204,11 +204,11 @@ if ($result > 0) {
// Add notification form
// print load_fiche_titre($langs->trans("AddNewNotification"), '', '');
print '<form action="'.$_SERVER["PHP_SELF"].'?id='.$id.'" method="post">';
print '<form action="'.$_SERVER["PHP_SELF"].'?id='.urlencode($id).'" method="POST">';
print '<input type="hidden" name="token" value="'.newToken().'">';
print '<input type="hidden" name="action" value="add">';
$param = "&id=".$id;
$param = "&id=".urlencode($id);
// Line with titles
/* print '<table width="100%" class="noborder">';

2
htdocs/variants/combinations.php
View File

@ -727,7 +727,7 @@ if (!empty($id) || !empty($ref)) {
$prodstatic->fetch($prodcomb->fk_product_child);
print $form->formconfirm(
"combinations.php?id=".$id."&valueid=".$valueid,
"combinations.php?id=".urlencode($id)."&valueid=".urlencode($valueid),
$langs->trans('Delete'),
$langs->trans('ProductCombinationDeleteDialog', $prodstatic->ref),
"confirm_deletecombination",