mirror of
https://github.com/Dolibarr/dolibarr.git
synced 2025-02-20 13:46:52 +01:00
Fix: SQL injection
This commit is contained in:
Laurent Destailleur
parent
522b5a91bc
commit
8dd9358214
|
|
@ -21,9 +21,10 @@ Fix: When disabled, all fields to add time into task line must be disabled.
|
|||
Fix: Missing include files.lib.php in some pages to use dol_delete_recursive.
|
||||
Fix: [ bug #1558 ] Product/service edit page title shows new Ref instead of old ref.
|
||||
Fix: [ bug #1553 ] Saving User displays setup removes menu.
|
||||
Fix: [ bug #1544 ] Can remove date from invoice
|
||||
Fix: list event view lost type event filter
|
||||
Fix: Add code save on create event
|
||||
Fix: [ bug #1544 ] Can remove date from invoice.
|
||||
Fix: list event view lost type event filter.
|
||||
Fix: Add code save on create event.
|
||||
Fix: SQL injection.
|
||||
|
||||
***** ChangeLog for 3.5.4 compared to 3.5.3 *****
|
||||
Fix: Hide title of event when agenda module disabled.
|
||||
|
|
|
|||
|
|
@ -1072,7 +1072,7 @@ class Adherent extends CommonObject
|
|||
if ($rowid) $sql.= " AND d.rowid=".$rowid;
|
||||
elseif ($ref || $fk_soc) {
|
||||
$sql.= " AND d.entity IN (".getEntity().")";
|
||||
if ($ref) $sql.= " AND d.rowid='".$ref."'";
|
||||
if ($ref) $sql.= " AND d.rowid='".$this->db->escape($ref)."'";
|
||||
elseif ($fk_soc) $sql.= " AND d.fk_soc='".$fk_soc."'";
|
||||
}
|
||||
elseif ($ref_ext)
|
||||
|
|
|
|||
|
|
@ -118,24 +118,24 @@ if ($type > 0)
|
|||
}
|
||||
if (isset($_GET["statut"]) || isset($_POST["statut"]))
|
||||
{
|
||||
$sql.=" AND d.statut in (".$statut.")"; // Peut valoir un nombre ou liste de nombre separes par virgules
|
||||
$sql.=" AND d.statut in (".$db->escape($statut).")"; // Peut valoir un nombre ou liste de nombre separes par virgules
|
||||
}
|
||||
if ($search_ref)
|
||||
{
|
||||
if (is_numeric($search_ref)) $sql.= " AND (d.rowid = ".$search_ref.")";
|
||||
if (is_numeric($search_ref)) $sql.= " AND (d.rowid = ".$db->escape($search_ref).")";
|
||||
else $sql.=" AND 1 = 2"; // Always wrong
|
||||
}
|
||||
if ($search_lastname)
|
||||
{
|
||||
$sql.= " AND (d.firstname LIKE '%".$search_lastname."%' OR d.lastname LIKE '%".$search_lastname."%')";
|
||||
$sql.= " AND (d.firstname LIKE '%".$db->escape($search_lastname)."%' OR d.lastname LIKE '%".$db->escape($search_lastname)."%')";
|
||||
}
|
||||
if ($search_login)
|
||||
{
|
||||
$sql.= " AND d.login LIKE '%".$search_login."%'";
|
||||
$sql.= " AND d.login LIKE '%".$db->escape($search_logi)."%'";
|
||||
}
|
||||
if ($search_email)
|
||||
{
|
||||
$sql.= " AND (d.email LIKE '%".$search_email."%')";
|
||||
$sql.= " AND (d.email LIKE '%".$db->escape($search_email)."%')";
|
||||
}
|
||||
if ($filter == 'uptodate')
|
||||
{
|
||||
|
|
|
|||
|
|
@ -39,6 +39,7 @@ if ( $_SESSION['uid'] > 0 )
|
|||
}
|
||||
|
||||
$usertxt=GETPOST('user','',1);
|
||||
$err=GETPOST("err");
|
||||
|
||||
|
||||
/*
|
||||
|
|
@ -64,7 +65,7 @@ top_htmlhead('','',0,0,'',$arrayofcss);
|
|||
|
||||
<div class="contenu">
|
||||
<div class="principal_login">
|
||||
<?php if (! empty($_GET["err"])) print $_GET["err"]."<br><br>\n"; ?>
|
||||
<?php if ($err) print dol_escape_htmltag($err)."<br><br>\n"; ?>
|
||||
<fieldset class="cadre_facturation"><legend class="titre1"><?php echo $langs->trans("Identification"); ?></legend>
|
||||
<form id="frmLogin" method="POST" action="index_verif.php">
|
||||
<input type="hidden" name="token" value="<?php echo $_SESSION['newtoken']; ?>" />
|
||||
|
|
|
|||
|
|
@ -1046,7 +1046,7 @@ class Propal extends CommonObject
|
|||
$sql.= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_input_reason as dr ON p.fk_input_reason = dr.rowid';
|
||||
$sql.= " WHERE p.fk_statut = c.id";
|
||||
$sql.= " AND p.entity = ".$conf->entity;
|
||||
if ($ref) $sql.= " AND p.ref='".$ref."'";
|
||||
if ($ref) $sql.= " AND p.ref='".$this->db->escape($ref)."'";
|
||||
else $sql.= " AND p.rowid=".$rowid;
|
||||
|
||||
dol_syslog(get_class($this)."::fetch sql=".$sql, LOG_DEBUG);
|
||||
|
|
|
|||
|
|
@ -34,7 +34,7 @@ $langs->load("sendings");
|
|||
|
||||
// Security check
|
||||
$socid=0;
|
||||
$comid = isset($_GET["id"])?$_GET["id"]:'';
|
||||
$comid = GETPOST("id",'int');
|
||||
if ($user->societe_id) $socid=$user->societe_id;
|
||||
$result=restrictedArea($user,'commande',$comid,'');
|
||||
|
||||
|
|
@ -47,8 +47,8 @@ $result=restrictedArea($user,'commande',$comid,'');
|
|||
llxHeader('',$langs->trans('Order'),'EN:Customers_Orders|FR:Commandes_Clients|ES:Pedidos de clientes');
|
||||
|
||||
$commande = new Commande($db);
|
||||
$commande->fetch($_GET["id"]);
|
||||
$commande->info($_GET["id"]);
|
||||
$commande->fetch($comid);
|
||||
$commande->info($comid);
|
||||
$soc = new Societe($db);
|
||||
$soc->fetch($commande->socid);
|
||||
|
||||
|
|
|
|||
|
|
@ -45,7 +45,7 @@ $langs->load('companies');
|
|||
if (! $user->rights->facture->creer)
|
||||
accessforbidden();
|
||||
|
||||
$id = (GETPOST('id')?GETPOST("id"):GETPOST("facid")); // For backward compatibility
|
||||
$id = (GETPOST('id')?GETPOST('id','int'):GETPOST("facid")); // For backward compatibility
|
||||
$ref = GETPOST('ref','alpha');
|
||||
$action = GETPOST('action','alpha');
|
||||
$confirm = GETPOST('confirm','alpha');
|
||||
|
|
@ -97,7 +97,7 @@ if (($action == 'create' || $action == 'add') && empty($mesgs))
|
|||
require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php';
|
||||
require_once DOL_DOCUMENT_ROOT.'/core/lib/invoice.lib.php';
|
||||
if (! empty($conf->projet->enabled)) require_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php';
|
||||
|
||||
|
||||
$langs->load('bills');
|
||||
$langs->load('products');
|
||||
$langs->load('main');
|
||||
|
|
@ -213,7 +213,7 @@ if (($action == 'create' || $action == 'add') && empty($mesgs))
|
|||
$result=$objectsrc->fetch($orders_id[$ii]);
|
||||
if ($result > 0)
|
||||
{
|
||||
if ($closeOrders)
|
||||
if ($closeOrders)
|
||||
{
|
||||
$objectsrc->classifyBilled();
|
||||
$objectsrc->setStatut(3);
|
||||
|
|
|
|||
|
|
@ -34,7 +34,7 @@ $langs->load("categories");
|
|||
$langs->load("bills");
|
||||
|
||||
$action=GETPOST('action');
|
||||
$id=GETPOST('id');
|
||||
$id=GETPOST('id','int');
|
||||
|
||||
// Security check
|
||||
if (isset($_GET["id"]) || isset($_GET["ref"]))
|
||||
|
|
|
|||
|
|
@ -907,7 +907,7 @@ class BonPrelevement extends CommonObject
|
|||
$sql = "INSERT INTO ".MAIN_DB_PREFIX."prelevement_bons (";
|
||||
$sql.= " ref, entity, datec";
|
||||
$sql.= ") VALUES (";
|
||||
$sql.= "'".$ref."'";
|
||||
$sql.= "'".$this->db->escape($ref)."'";
|
||||
$sql.= ", ".$conf->entity;
|
||||
$sql.= ", '".$this->db->idate($now)."'";
|
||||
$sql.= ")";
|
||||
|
|
|
|||
|
|
@ -78,19 +78,19 @@ $sql.= " AND f.entity = ".$conf->entity;
|
|||
if ($socid) $sql.= " AND s.rowid = ".$socid;
|
||||
if ($search_line)
|
||||
{
|
||||
$sql.= " AND pl.rowid = '".$search_line."'";
|
||||
$sql.= " AND pl.rowid = '".$db->escape($search_line)."'";
|
||||
}
|
||||
if ($search_bon)
|
||||
{
|
||||
$sql.= " AND p.ref LIKE '%".$search_bon."%'";
|
||||
$sql.= " AND p.ref LIKE '%".$db->escape($search_bon)."%'";
|
||||
}
|
||||
if ($search_code)
|
||||
{
|
||||
$sql.= " AND s.code_client LIKE '%".$search_code."%'";
|
||||
$sql.= " AND s.code_client LIKE '%".$db->escape($search_code)."%'";
|
||||
}
|
||||
if ($search_societe)
|
||||
{
|
||||
$sql .= " AND s.nom LIKE '%".$search_societe."%'";
|
||||
$sql .= " AND s.nom LIKE '%".$db->escape($search_societe)."%'";
|
||||
}
|
||||
$sql.=$db->order($sortfield,$sortorder);
|
||||
$sql.=$db->plimit($conf->liste_limit+1, $offset);
|
||||
|
|
@ -104,7 +104,7 @@ if ($result)
|
|||
$urladd = "&statut=".$statut;
|
||||
$urladd .= "&search_bon=".$search_bon;
|
||||
|
||||
print_barre_liste($langs->trans("WithdrawalsLines"), $page, "liste.php", $urladd, $sortfield, $sortorder, '', $num);
|
||||
print_barre_liste($langs->trans("WithdrawalsLines"), $page, $_SERVER["PHP_SELF"], $urladd, $sortfield, $sortorder, '', $num);
|
||||
|
||||
print"\n<!-- debut table -->\n";
|
||||
print '<table class="liste" width="100%">';
|
||||
|
|
|
|||
|
|
@ -76,7 +76,8 @@ $sql.= " AND pl.fk_prelevement_bons = p.rowid";
|
|||
$sql.= " AND pl.fk_soc = s.rowid";
|
||||
$sql.= " AND p.entity = ".$conf->entity;
|
||||
if ($socid) $sql.= " AND s.rowid = ".$socid;
|
||||
$sql .= " ORDER BY $sortfield $sortorder " . $db->plimit($conf->liste_limit+1, $offset);
|
||||
$sql.= " ".$db->order($sortfield, $sortorder);
|
||||
$sql.= " ".$db->plimit($conf->liste_limit+1, $offset);
|
||||
|
||||
$result = $db->query($sql);
|
||||
if ($result)
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@ $langs->load("companies");
|
|||
if (! empty($conf->facture->enabled)) $langs->load("bills");
|
||||
|
||||
// Security check
|
||||
$socid = $_GET["socid"];
|
||||
$socid = GETPOST("socid",'int');
|
||||
if ($user->societe_id > 0)
|
||||
{
|
||||
$action = '';
|
||||
|
|
|
|||
|
|
@ -31,22 +31,22 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/contact.lib.php';
|
|||
$langs->load("companies");
|
||||
|
||||
// Security check
|
||||
$contactid = isset($_GET["id"])?$_GET["id"]:'';
|
||||
$contactid = GETPOST("id",'int');
|
||||
if ($user->societe_id) $socid=$user->societe_id;
|
||||
$result = restrictedArea($user, 'contact', $contactid, 'socpeople&societe');
|
||||
|
||||
|
||||
|
||||
/*
|
||||
* View
|
||||
*/
|
||||
* View
|
||||
*/
|
||||
|
||||
llxHeader('',$langs->trans("ContactsAddresses"),'EN:Module_Third_Parties|FR:Module_Tiers|ES:Módulo_Empresas');
|
||||
|
||||
|
||||
$contact = new Contact($db);
|
||||
$contact->fetch($_GET["id"], $user);
|
||||
$contact->info($_GET["id"]);
|
||||
$contact->fetch($contactid, $user);
|
||||
$contact->info($contactid);
|
||||
|
||||
|
||||
$head = contact_prepare_head($contact);
|
||||
|
|
|
|||
|
|
@ -410,7 +410,7 @@ class Contrat extends CommonObject
|
|||
$sql.= " FROM ".MAIN_DB_PREFIX."contrat";
|
||||
if ($ref)
|
||||
{
|
||||
$sql.= " WHERE ref='".$ref."'";
|
||||
$sql.= " WHERE ref='".$this->db->escape($ref)."'";
|
||||
$sql.= " AND entity IN (".getEntity('contract').")";
|
||||
}
|
||||
else $sql.= " WHERE rowid=".$id;
|
||||
|
|
@ -1942,7 +1942,7 @@ class ContratLigne
|
|||
$sql.= " t.commentaire";
|
||||
$sql.= " FROM ".MAIN_DB_PREFIX."contratdet as t";
|
||||
if ($id) $sql.= " WHERE t.rowid = ".$id;
|
||||
if ($ref) $sql.= " WHERE t.rowid = '".$ref."'";
|
||||
if ($ref) $sql.= " WHERE t.rowid = '".$this->db->escape($ref)."'";
|
||||
|
||||
dol_syslog(get_class($this)."::fetch sql=".$sql, LOG_DEBUG);
|
||||
$resql=$this->db->query($sql);
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ require_once DOL_DOCUMENT_ROOT.'/contrat/class/contrat.class.php';
|
|||
$langs->load("contracts");
|
||||
|
||||
// Security check
|
||||
$contratid = isset($_GET["id"])?$_GET["id"]:'';
|
||||
$contratid = GETPOST("id",'int');
|
||||
if ($user->societe_id) $socid=$user->societe_id;
|
||||
$result = restrictedArea($user, 'contrat',$contratid,'');
|
||||
|
||||
|
|
@ -41,8 +41,8 @@ $result = restrictedArea($user, 'contrat',$contratid,'');
|
|||
llxHeader();
|
||||
|
||||
$contrat = new Contrat($db);
|
||||
$contrat->fetch($_GET["id"]);
|
||||
$contrat->info($_GET["id"]);
|
||||
$contrat->fetch($contratid);
|
||||
$contrat->info($contratid);
|
||||
|
||||
$head = contract_prepare_head($contrat);
|
||||
|
||||
|
|
|
|||
|
|
@ -2002,7 +2002,7 @@ abstract class CommonObject
|
|||
$sql.= " FROM ".MAIN_DB_PREFIX.$this->table_element;
|
||||
$sql.= " WHERE entity IN (".getEntity($this->element, 1).")";
|
||||
if (! empty($id)) $sql.= " AND rowid = ".$id;
|
||||
if (! empty($ref)) $sql.= " AND ref = '".$ref."'";
|
||||
if (! empty($ref)) $sql.= " AND ref = '".$this->db->escape($ref)."'";
|
||||
|
||||
$resql = $this->db->query($sql);
|
||||
if ($resql)
|
||||
|
|
|
|||
|
|
@ -132,7 +132,7 @@ class CommandeFournisseur extends CommonOrder
|
|||
$sql.= " LEFT JOIN ".MAIN_DB_PREFIX."c_paiement as p ON (c.fk_mode_reglement = p.id)";
|
||||
$sql.= " LEFT JOIN ".MAIN_DB_PREFIX."c_input_method as cm ON cm.rowid = c.fk_input_method";
|
||||
$sql.= " WHERE c.entity = ".$conf->entity;
|
||||
if ($ref) $sql.= " AND c.ref='".$ref."'";
|
||||
if ($ref) $sql.= " AND c.ref='".$this->db->escape($ref)."'";
|
||||
else $sql.= " AND c.rowid=".$id;
|
||||
|
||||
dol_syslog(get_class($this)."::fetch sql=".$sql,LOG_DEBUG);
|
||||
|
|
|
|||
|
|
@ -51,7 +51,7 @@ $offset = $conf->liste_limit * $page ;
|
|||
$pageprev = $page - 1;
|
||||
$pagenext = $page + 1;
|
||||
|
||||
$id = GETPOST('id');
|
||||
$id = GETPOST('id','int');
|
||||
|
||||
$search_ref = GETPOST('search_ref');
|
||||
$month_create = GETPOST('month_create');
|
||||
|
|
@ -249,7 +249,7 @@ if ($id > 0)
|
|||
}
|
||||
else {
|
||||
print '</div>';
|
||||
}
|
||||
}
|
||||
|
||||
print '<form method="get" action="'.$_SERVER["PHP_SELF"].'">'."\n";
|
||||
print '<table class="noborder" width="100%;">';
|
||||
|
|
@ -299,7 +299,7 @@ if($user->rights->holiday->lire_tous)
|
|||
$form->select_users($search_valideur,"search_valideur",1,"",0,$valideurarray,'');
|
||||
print '</td>';
|
||||
}
|
||||
else
|
||||
else
|
||||
{
|
||||
print '<td class="liste_titre"> </td>';
|
||||
}
|
||||
|
|
|
|||
|
|
@ -26,7 +26,7 @@ require_once(DOL_DOCUMENT_ROOT."/core/lib/admin.lib.php");
|
|||
require_once(DOL_DOCUMENT_ROOT."/core/lib/files.lib.php");
|
||||
|
||||
$action=GETPOST('action');
|
||||
$id=GETPOST('id');
|
||||
$id=GETPOST('id','alpha');
|
||||
$numsondage=substr($id, 0, 16);
|
||||
|
||||
if (! $sortorder) $sortorder="ASC";
|
||||
|
|
@ -47,9 +47,9 @@ if ($action == 'delete_confirm')
|
|||
$db->begin();
|
||||
|
||||
$object=new Opensurveysondage($db);
|
||||
|
||||
|
||||
$result=$object->delete($user,'',$numsondageadmin);
|
||||
|
||||
|
||||
$db->commit();
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -27,7 +27,7 @@ require '../main.inc.php';
|
|||
require_once DOL_DOCUMENT_ROOT.'/product/class/product.class.php';
|
||||
require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
|
||||
|
||||
$type=isset($_GET["type"])?$_GET["type"]:(isset($_POST["type"])?$_POST["type"]:'');
|
||||
$type=GETPOST("type",'int');
|
||||
if ($type =='' && !$user->rights->produit->lire) $type='1'; // Force global page on service page only
|
||||
if ($type =='' && !$user->rights->service->lire) $type='0'; // Force global page on product page only
|
||||
|
||||
|
|
@ -261,7 +261,7 @@ else
|
|||
|
||||
|
||||
// TODO Move this into a page that should be available into menu "accountancy - report - turnover - per quarter"
|
||||
// Also method used for counting must provide the 2 possible methods like done by all other reports into menu "accountancy - report - turnover":
|
||||
// Also method used for counting must provide the 2 possible methods like done by all other reports into menu "accountancy - report - turnover":
|
||||
// "commitment engagment" method and "cash accounting" method
|
||||
if ($conf->global->MAIN_FEATURES_LEVEL)
|
||||
{
|
||||
|
|
@ -283,8 +283,8 @@ $db->close();
|
|||
function activitytrim($product_type)
|
||||
{
|
||||
global $conf,$langs,$db;
|
||||
|
||||
// We display the last 3 years
|
||||
|
||||
// We display the last 3 years
|
||||
$yearofbegindate=date('Y',dol_time_plus_duree(time(), -3, "y"));
|
||||
|
||||
// breakdown by quarter
|
||||
|
|
@ -311,7 +311,7 @@ function activitytrim($product_type)
|
|||
$trim4=0;
|
||||
$lgn = 0;
|
||||
$num = $db->num_rows($result);
|
||||
|
||||
|
||||
if ($num > 0 )
|
||||
{
|
||||
print '<br>';
|
||||
|
|
@ -353,7 +353,7 @@ function activitytrim($product_type)
|
|||
$trim3=0;
|
||||
$trim4=0;
|
||||
}
|
||||
|
||||
|
||||
if ($objp->mois == "01" || $objp->mois == "02" || $objp->mois == "03")
|
||||
$trim1 += $objp->Mnttot;
|
||||
|
||||
|
|
|
|||
|
|
@ -70,7 +70,7 @@ if ($id > 0 || ! empty($ref))
|
|||
{
|
||||
$product = new Product($db);
|
||||
$result = $product->fetch($id, $ref);
|
||||
|
||||
|
||||
$parameters=array('id'=>$id);
|
||||
$reshook=$hookmanager->executeHooks('doActions',$parameters,$product,$action); // Note that $action and $object may have been modified by some hooks
|
||||
$error=$hookmanager->error; $errors=$hookmanager->errors;
|
||||
|
|
@ -83,7 +83,7 @@ if ($id > 0 || ! empty($ref))
|
|||
$titre=$langs->trans("CardProduct".$product->type);
|
||||
$picto=($product->type==1?'service':'product');
|
||||
dol_fiche_head($head, 'referers', $titre, 0, $picto);
|
||||
|
||||
|
||||
$reshook=$hookmanager->executeHooks('formObjectOptions',$parameters,$product,$action); // Note that $action and $object may have been modified by hook
|
||||
|
||||
print '<table class="border" width="100%">';
|
||||
|
|
@ -135,7 +135,7 @@ if ($id > 0 || ! empty($ref))
|
|||
if (!$user->rights->societe->client->voir && !$socid) $sql.= " AND s.rowid = sc.fk_soc AND sc.fk_user = " .$user->id;
|
||||
if ($socid) $sql.= " AND s.rowid = ".$socid;
|
||||
$sql.= " GROUP BY c.rowid, c.date_contrat, c.statut, s.nom, s.rowid, s.code_client";
|
||||
$sql.= " ORDER BY $sortfield $sortorder";
|
||||
$sql.= $db->order($sortfield, $sortorder);
|
||||
$sql.= $db->plimit($conf->liste_limit +1, $offset);
|
||||
|
||||
$result = $db->query($sql);
|
||||
|
|
|
|||
|
|
@ -31,12 +31,12 @@ $langs->load("stocks");
|
|||
// Security check
|
||||
$result=restrictedArea($user,'stock');
|
||||
|
||||
$sref=isset($_GET["sref"])?$_GET["sref"]:$_POST["sref"];
|
||||
$snom=isset($_GET["snom"])?$_GET["snom"]:$_POST["snom"];
|
||||
$sall=isset($_GET["sall"])?$_GET["sall"]:$_POST["sall"];
|
||||
$sref=GETPOST("sref");;
|
||||
$snom=GETPOST("snom");
|
||||
$sall=GETPOST("sall");
|
||||
|
||||
$sortfield = isset($_GET["sortfield"])?$_GET["sortfield"]:$_POST["sortfield"];
|
||||
$sortorder = isset($_GET["sortorder"])?$_GET["sortorder"]:$_POST["sortorder"];
|
||||
$sortfield = GETPOST("sortfield");
|
||||
$sortorder = GETPOST("sortorder");
|
||||
if (! $sortfield) $sortfield="e.label";
|
||||
if (! $sortorder) $sortorder="ASC";
|
||||
$page = $_GET["page"];
|
||||
|
|
@ -50,13 +50,13 @@ $sql.= " FROM ".MAIN_DB_PREFIX."entrepot as e";
|
|||
$sql.= " WHERE e.entity = ".$conf->entity;
|
||||
if ($sref)
|
||||
{
|
||||
$sql.= " AND e.label like '%".$sref."%'";
|
||||
$sql.= " AND e.label like '%".$db->escape($sref)."%'";
|
||||
}
|
||||
if ($sall)
|
||||
{
|
||||
$sql.= " AND (e.description like '%".$sall."%' OR e.lieu like '%".$sall."%' OR e.address like '%".$sall."%' OR e.town like '%".$sall."%')";
|
||||
$sql.= " AND (e.description like '%".$db->escape($sall)."%' OR e.lieu like '%".$db->escape($sall)."%' OR e.address like '%".$db->escape($sall)."%' OR e.town like '%".$db->escape($sall)."%')";
|
||||
}
|
||||
$sql.= " ORDER BY $sortfield $sortorder";
|
||||
$sql.= $db->order($sortfield,$sortorder);
|
||||
$sql.= $db->plimit($limit+1, $offset);
|
||||
|
||||
$result = $db->query($sql);
|
||||
|
|
|
|||
|
|
@ -44,9 +44,9 @@ $result=restrictedArea($user,'produit|service');
|
|||
//checks if a product has been ordered
|
||||
|
||||
$action = GETPOST('action','alpha');
|
||||
$id_product = GETPOST('productid', 'productid');
|
||||
$id_sw = GETPOST('id_sw', 'id_sw');
|
||||
$id_tw = GETPOST('id_tw', 'id_tw');
|
||||
$id_product = GETPOST('productid', 'int');
|
||||
$id_sw = GETPOST('id_sw', 'int');
|
||||
$id_tw = GETPOST('id_tw', 'int');
|
||||
$qty = GETPOST('qty');
|
||||
$idline = GETPOST('idline');
|
||||
|
||||
|
|
|
|||
|
|
@ -72,13 +72,8 @@ $sproduct = GETPOST('sproduct', 'int');
|
|||
$sortorder = GETPOST('sortorder', 'alpha');
|
||||
$sortfield = GETPOST('sortfield', 'alpha');
|
||||
|
||||
if (!$sortorder) {
|
||||
$sortorder = 'DESC';
|
||||
}
|
||||
|
||||
if (!$sortfield) {
|
||||
$sortfield = 'cf.date_creation';
|
||||
}
|
||||
if (!$sortorder) $sortorder = 'DESC';
|
||||
if (!$sortfield) $sortfield = 'cf.date_creation';
|
||||
|
||||
$offset = $conf->liste_limit * $page ;
|
||||
|
||||
|
|
@ -146,7 +141,7 @@ if (GETPOST('statut', 'int')) {
|
|||
}
|
||||
$sql .= ' GROUP BY cf.rowid, cf.ref, cf.date_creation, cf.fk_statut';
|
||||
$sql .= ', cf.total_ttc, cf.fk_user_author, u.login, s.rowid, s.nom';
|
||||
$sql .= ' ORDER BY ' . $sortfield . ' ' . $sortorder . ' ';
|
||||
$sql .= $db->order($sortfield, $sortorder);
|
||||
$sql .= $db->plimit($conf->liste_limit+1, $offset);
|
||||
$resql = $db->query($sql);
|
||||
if ($resql)
|
||||
|
|
@ -317,7 +312,7 @@ if ($resql)
|
|||
'</form>';
|
||||
|
||||
$db->free($resql);
|
||||
|
||||
|
||||
dol_fiche_end();
|
||||
}
|
||||
else
|
||||
|
|
|
|||
|
|
@ -297,7 +297,7 @@ class Project extends CommonObject
|
|||
}
|
||||
else if (! empty($ref))
|
||||
{
|
||||
$sql.= " WHERE ref='".$ref."'";
|
||||
$sql.= " WHERE ref='".$this->db->escape($ref)."'";
|
||||
$sql.= " AND entity IN (".getEntity('project').")";
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -207,7 +207,7 @@ class Task extends CommonObject
|
|||
$sql.= " FROM ".MAIN_DB_PREFIX."projet_task as t";
|
||||
$sql.= " WHERE ";
|
||||
if (!empty($ref)) {
|
||||
$sql.="t.ref = '".$ref."'";
|
||||
$sql.="t.ref = '".$this->db->escape($ref)."'";
|
||||
}else {
|
||||
$sql.="t.rowid = ".$id;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -93,7 +93,7 @@ if ($action == 'swapstatut' && $user->rights->projet->creer)
|
|||
{
|
||||
if ($object->fetch($id))
|
||||
{
|
||||
$result=$object->swapContactStatus(GETPOST('ligne'));
|
||||
$result=$object->swapContactStatus(GETPOST('ligne','int'));
|
||||
}
|
||||
else
|
||||
{
|
||||
|
|
@ -105,7 +105,7 @@ if ($action == 'swapstatut' && $user->rights->projet->creer)
|
|||
if (($action == 'deleteline' || $action == 'deletecontact') && $user->rights->projet->creer)
|
||||
{
|
||||
$object->fetch($id);
|
||||
$result = $object->delete_contact($_GET["lineid"]);
|
||||
$result = $object->delete_contact(GETPOST("lineid"));
|
||||
|
||||
if ($result >= 0)
|
||||
{
|
||||
|
|
|
|||
|
|
@ -41,9 +41,9 @@ $socid=0;
|
|||
if ($user->societe_id > 0) $socid = $user->societe_id;
|
||||
if (!$user->rights->projet->lire) accessforbidden();
|
||||
|
||||
$sortfield = isset($_GET["sortfield"])?$_GET["sortfield"]:$_POST["sortfield"];
|
||||
$sortorder = isset($_GET["sortorder"])?$_GET["sortorder"]:$_POST["sortorder"];
|
||||
$page = isset($_GET["page"])? $_GET["page"]:$_POST["page"];
|
||||
$sortfield = GETPOST("sortfield");
|
||||
$sortorder = GETPOST("sortorder");
|
||||
$page = GETPOST("page");
|
||||
$page = is_numeric($page) ? $page : 0;
|
||||
$page = $page == -1 ? 0 : $page;
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user