Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Add more robust php unit to detect not escaped sql. Fix not escaped sql

Browse Source
This commit is contained in:
Laurent Destailleur
2017-09-15 15:41:07 +02:00
parent 77056d9adb
commit 5e34b121dd
63 changed files with 420 additions and 438 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
htdocs/core/class/link.class.php
View File

@@ -89,7 +89,7 @@ class Link extends CommonObject
$sql .= " VALUES ('".$conf->entity."', '".$this->db->idate($this->datea)."'";
$sql .= ", '" . $this->db->escape($this->url) . "'";
$sql .= ", '" . $this->db->escape($this->label) . "'";
$sql .= ", '" . $this->objecttype . "'";
$sql .= ", '" . $this->db->escape($this->objecttype) . "'";
$sql .= ", " . $this->objectid . ")";
dol_syslog(get_class($this)."::create", LOG_DEBUG);
@@ -100,7 +100,7 @@ class Link extends CommonObject
if ($this->id > 0) {
// Call trigger
$result=$this->call_trigger('LINK_CREATE',$user);
if ($result < 0) $error++;
if ($result < 0) $error++;
// End call triggers
} else {
$error++;
@@ -283,20 +283,20 @@ class Link extends CommonObject
public static function count($db, $objecttype, $objectid)
{
global $conf;
$sql = "SELECT COUNT(rowid) as nb FROM " . MAIN_DB_PREFIX . "links";
$sql .= " WHERE objecttype = '" . $objecttype . "' AND objectid = " . $objectid;
if ($conf->entity != 0) $sql .= " AND entity = " . $conf->entity;
$resql = $db->query($sql);
if ($resql)
{
$obj = $db->fetch_object($resql);
if ($obj) return $obj->nb;
}
}
return -1;
}
/**
* Loads a link from database
*
@@ -354,8 +354,8 @@ class Link extends CommonObject
// Call trigger
$result=$this->call_trigger('LINK_DELETE',$user);
if ($result < 0) return -1;
// End call triggers
if ($result < 0) return -1;
// End call triggers
$this->db->begin();