diff --git a/htdocs/core/ajax/box.php b/htdocs/core/ajax/box.php index 775f1465def..d1e2e1a4990 100644 --- a/htdocs/core/ajax/box.php +++ b/htdocs/core/ajax/box.php @@ -53,10 +53,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/infobox.class.php'; $boxid = GETPOSTINT('boxid'); $boxorder = GETPOST('boxorder'); -$zone = GETPOST('zone'); // Can be key for zone -if ($zone !== '') { - $zone = (int) $zone; -} +$zone = GETPOST('zone'); // Can be '0' or '1' or 'pagename'... $userid = GETPOSTINT('userid'); // Security check @@ -91,7 +88,7 @@ if ($boxorder && $zone != '' && $userid > 0) { // boxorder value is the target order: "A:idboxA1,idboxA2,A-B:idboxB1,idboxB2,B" dol_syslog("AjaxBox boxorder=".$boxorder." zone=".$zone." userid=".$userid, LOG_DEBUG); - $result = InfoBox::saveboxorder($db, (int) $zone, $boxorder, $userid); + $result = InfoBox::saveboxorder($db, $zone, $boxorder, $userid); if ($result > 0) { $langs->load("boxes"); if (!GETPOST('closing')) { diff --git a/htdocs/core/class/infobox.class.php b/htdocs/core/class/infobox.class.php index cfec6d48773..68340e873d2 100644 --- a/htdocs/core/class/infobox.class.php +++ b/htdocs/core/class/infobox.class.php @@ -217,11 +217,11 @@ class InfoBox /** * Save order of boxes for area and user * - * @param DoliDB $dbs Database handler - * @param int $zone Key of area (0 for Homepage, ...) - * @param string $boxorder List of boxes with correct order 'A:123,456,...-B:789,321...' - * @param int $userid Id of user - * @return int Return integer <0 if KO, 0=Nothing done, > 0 if OK + * @param DoliDB $dbs Database handler + * @param int|string $zone Key of area ('0' for Homepage, '1', 'pagename', ...) + * @param string $boxorder List of boxes with correct order 'A:123,456,...-B:789,321...' + * @param int $userid Id of user + * @return int Return integer <0 if KO, 0=Nothing done, > 0 if OK */ public static function saveboxorder($dbs, $zone, $boxorder, $userid = 0) { @@ -252,6 +252,10 @@ class InfoBox return -3; } + if (!is_numeric($zone)) { + $zone = '0'; // Force $zone to a numeric value string + } + // Delete all lines $sql = "DELETE FROM ".$dbs->prefix()."boxes"; $sql .= " WHERE entity = ".$conf->entity;