Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

NEW Accept the __NOW__ and __USER_ID__key into filters

Browse Source
This commit is contained in:
Laurent Destailleur
2024-03-25 23:51:09 +01:00
parent 15f1699de7
commit 4efa503400
2 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
test/phpunit/FunctionsLibTest.php
View File

@@ -216,6 +216,11 @@ class FunctionsLibTest extends CommonClassTest
{
global $conf, $langs, $db;
// Test on NOW
$filter = "(client:!=:8) AND (datefin:>=:'__NOW__')";
$sql = forgeSQLFromUniversalSearchCriteria($filter);
$this->assertStringContainsStringIgnoringCase(" AND ((client <> 8) AND (datefin >= '", $sql);
// An attempt for SQL injection
$filter = 'if(now()=sysdate()%2Csleep(6)%2C0)';
$sql = forgeSQLFromUniversalSearchCriteria($filter);