Mirrors/dolibarr
1
0
Fork 0
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-02-20 13:46:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

FIX 17.0 API endpoints "PUT": prevent overwriting all extrafields if only some are supplied in the request cf. PR #29237

Browse Source 
+ security for Tickets API: disable updating rowid
This commit is contained in:
atm-florian 2025-01-16 10:37:29 +01:00
parent c2c3879032
commit ba4e97f07b
29 changed files with 177 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
htdocs/adherents/class/api_members.class.php
View File

@ -348,6 +348,12 @@ class Members extends DolibarrApi
}
}
} else {
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$member->array_options[$index] = $this->_checkValForAPI($field, $val, $member);
}
continue;
}
$member->$field = $value;
}
}

6
htdocs/adherents/class/api_memberstypes.class.php
View File

@ -193,6 +193,12 @@ class MembersTypes extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$membertype->array_options[$index] = $this->_checkValForAPI($field, $val, $membertype);
}
continue;
}
// Process the status separately because it must be updated using
// the validate(), resiliate() and exclude() methods of the class AdherentType.
$membertype->$field = $value;

6
htdocs/adherents/class/api_subscriptions.class.php
View File

@ -186,6 +186,12 @@ class Subscriptions extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$subscription->array_options[$index] = $this->_checkValForAPI($field, $val, $subscription);
}
continue;
}
$subscription->$field = $value;
}

6
htdocs/bom/class/api_boms.class.php
View File

@ -237,6 +237,12 @@ class Boms extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->bom->array_options[$index] = $this->_checkValForAPI($field, $val, $this->bom);
}
continue;
}
$this->bom->$field = $value;
}

6
htdocs/categories/class/api_categories.class.php
View File

@ -237,6 +237,12 @@ class Categories extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->category->array_options[$index] = $this->_checkValForAPI($field, $val, $this->category);
}
continue;
}
$this->category->$field = $value;
}

6
htdocs/comm/action/class/api_agendaevents.class.php
View File

@ -270,6 +270,12 @@ class AgendaEvents extends DolibarrApi
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->actioncomm->array_options[$index] = $this->_checkValForAPI($field, $val, $this->actioncomm);
}
continue;
}
$this->actioncomm->$field = $this->_checkValForAPI($field, $value, $this->actioncomm);
}

6
htdocs/comm/propal/class/api_proposals.class.php
View File

@ -696,6 +696,12 @@ class Proposals extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->propal->array_options[$index] = $this->_checkValForAPI($field, $val, $this->propal);
}
continue;
}
$this->propal->$field = $value;
}

6
htdocs/commande/class/api_orders.class.php
View File

@ -652,6 +652,12 @@ class Orders extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->commande->array_options[$index] = $this->_checkValForAPI($field, $val, $this->commande);
}
continue;
}
$this->commande->$field = $value;
}

6
htdocs/compta/bank/class/api_bankaccounts.class.php
View File

@ -332,6 +332,12 @@ class BankAccounts extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$account->array_options[$index] = $this->_checkValForAPI($field, $val, $account);
}
continue;
}
$account->$field = $this->_checkValForAPI($field, $value, $account);
}

6
htdocs/compta/facture/class/api_invoices.class.php
View File

@ -627,6 +627,12 @@ class Invoices extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->invoice->array_options[$index] = $this->_checkValForAPI($field, $val, $this->invoice);
}
continue;
}
$this->invoice->$field = $value;
}

6
htdocs/contrat/class/api_contracts.class.php
View File

@ -510,6 +510,12 @@ class Contracts extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->contract->array_options[$index] = $this->_checkValForAPI($field, $val, $this->contract);
}
continue;
}
$this->contract->$field = $value;
}

6
htdocs/don/class/api_donations.class.php
View File

@ -231,6 +231,12 @@ class Donations extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->don->array_options[$index] = $this->_checkValForAPI($field, $val, $this->don);
}
continue;
}
$this->don->$field = $value;
}

6
htdocs/expedition/class/api_shipments.class.php
View File

@ -447,6 +447,12 @@ class Shipments extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->shipment->array_options[$index] = $this->_checkValForAPI($field, $val, $this->shipment);
}
continue;
}
$this->shipment->$field = $value;
}

6
htdocs/expensereport/class/api_expensereports.class.php
View File

@ -420,6 +420,12 @@ class ExpenseReports extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->expensereport->array_options[$index] = $this->_checkValForAPI($field, $val, $this->expensereport);
}
continue;
}
$this->expensereport->$field = $value;
}

6
htdocs/fourn/class/api_supplier_invoices.class.php
View File

@ -263,6 +263,12 @@ class SupplierInvoices extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->invoice->array_options[$index] = $this->_checkValForAPI($field, $val, $this->invoice);
}
continue;
}
$this->invoice->$field = $value;
}

6
htdocs/fourn/class/api_supplier_orders.class.php
View File

@ -277,6 +277,12 @@ class SupplierOrders extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->order->array_options[$index] = $this->_checkValForAPI($field, $val, $this->order);
}
continue;
}
$this->order->$field = $value;
}

6
htdocs/knowledgemanagement/class/api_knowledgemanagement.class.php
View File

@ -298,6 +298,12 @@ class KnowledgeManagement extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->knowledgerecord->array_options[$index] = $this->_checkValForAPI($field, $val, $this->knowledgerecord);
}
continue;
}
$this->knowledgerecord->$field = $this->_checkValForAPI($field, $value, $this->knowledgerecord);
}

6
htdocs/modulebuilder/template/class/api_mymodule.class.php
View File

@ -255,6 +255,12 @@ class MyModuleApi extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->myobject->array_options[$index] = $this->_checkValForAPI($field, $val, $this->myobject);
}
continue;
}
$this->myobject->$field = $this->_checkValForAPI($field, $value, $this->myobject);
}

6
htdocs/mrp/class/api_mos.class.php
View File

@ -238,6 +238,12 @@ class Mos extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->mo->array_options[$index] = $this->_checkValForAPI($field, $val, $this->mo);
}
continue;
}
$this->mo->$field = $value;
}

6
htdocs/partnership/class/api_partnership.class.php
View File

@ -255,6 +255,12 @@ class PartnershipApi extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->partnership->array_options[$index] = $this->_checkValForAPI($field, $val, $this->partnership);
}
continue;
}
$this->partnership->$field = $this->_checkValForAPI($field, $value, $this->partnership);
}

6
htdocs/product/class/api_products.class.php
View File

@ -361,6 +361,12 @@ class Products extends DolibarrApi
if ($field == 'stock_reel') {
throw new RestException(400, 'Stock reel cannot be updated here. Use the /stockmovements endpoint instead');
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->product->array_options[$index] = $this->_checkValForAPI($field, $val, $this->product);
}
continue;
}
$this->product->$field = $value;
}

6
htdocs/product/stock/class/api_warehouses.class.php
View File

@ -206,6 +206,12 @@ class Warehouses extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->warehouse->array_options[$index] = $this->_checkValForAPI($field, $val, $this->warehouse);
}
continue;
}
$this->warehouse->$field = $value;
}

6
htdocs/projet/class/api_projects.class.php
View File

@ -462,6 +462,12 @@ class Projects extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->project->array_options[$index] = $this->_checkValForAPI($field, $val, $this->project);
}
continue;
}
$this->project->$field = $value;
}

6
htdocs/projet/class/api_tasks.class.php
View File

@ -460,6 +460,12 @@ class Tasks extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->task->array_options[$index] = $this->_checkValForAPI($field, $val, $this->task);
}
continue;
}
$this->task->$field = $value;
}

6
htdocs/reception/class/api_receptions.class.php
View File

@ -447,6 +447,12 @@ class Receptions extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->reception->array_options[$index] = $this->_checkValForAPI($field, $val, $this->reception);
}
continue;
}
$this->reception->$field = $value;
}

6
htdocs/societe/class/api_contacts.class.php
View File

@ -330,6 +330,12 @@ class Contacts extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->contact->array_options[$index] = $this->_checkValForAPI($field, $val, $this->contact);
}
continue;
}
$this->contact->$field = $value;
}

6
htdocs/societe/class/api_thirdparties.class.php
View File

@ -301,6 +301,12 @@ class Thirdparties extends DolibarrApi
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->company->array_options[$index] = $this->_checkValForAPI($field, $val, $this->company);
}
continue;
}
$this->company->$field = $value;
}

9
htdocs/ticket/class/api_tickets.class.php
View File

@ -381,6 +381,15 @@ class Tickets extends DolibarrApi
}
foreach ($request_data as $field => $value) {
if ($field == 'id') {
continue;
}
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->ticket->array_options[$index] = $this->_checkValForAPI($field, $val, $this->ticket);
}
continue;
}
$this->ticket->$field = $value;
}

6
htdocs/user/class/api_users.class.php
View File

@ -406,6 +406,12 @@ class Users extends DolibarrApi
throw new RestException(500, 'Error when updating status of user: '.$this->useraccount->error);
}
} else {
if ($field == 'array_options' && is_array($value)) {
foreach ($value as $index => $val) {
$this->useraccount->array_options[$index] = $this->_checkValForAPI($field, $val, $this->useraccount);
}
continue;
}
$this->useraccount->$field = $value;
}
}