Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Fix escaping

Browse Source
This commit is contained in:
Laurent Destailleur
2020-09-20 02:57:15 +02:00
parent f57b4fd2fd
commit 0e4d3c19dd
21 changed files with 58 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/modulebuilder/template/admin/setup.php
View File

@@ -374,7 +374,7 @@ foreach ($myTmpObjects as $myTmpObjectKey => $myTmpObjectArray) {
$def = array();
$sql = "SELECT nom";
$sql .= " FROM ".MAIN_DB_PREFIX."document_model";
$sql .= " WHERE type = '".$type."'";
$sql .= " WHERE type = '".$db->escape($type)."'";
$sql .= " AND entity = ".$conf->entity;
$resql = $db->query($sql);
if ($resql)