diff --git a/htdocs/comm/mailing/class/html.formadvtargetemailing.class.php b/htdocs/comm/mailing/class/html.formadvtargetemailing.class.php index 6a6e00b65ed..01957c93456 100644 --- a/htdocs/comm/mailing/class/html.formadvtargetemailing.class.php +++ b/htdocs/comm/mailing/class/html.formadvtargetemailing.class.php @@ -316,7 +316,7 @@ class FormAdvTargetEmailing extends Form // We have to join on extrafield table if (strpos($InfoFieldList[3], 'extra') !== false) { $sql .= ' as main, '.$this->db->sanitize(MAIN_DB_PREFIX.$InfoFieldList[0]).'_extrafields as extra'; - $sql .= " WHERE extra.fk_object=main.".$this->db->sanitize(empty($InfoFieldList[2]) ? 'rowid' : $InfoFieldList[2]); + $sql .= " WHERE extra.fk_object = main.".$this->db->sanitize(empty($InfoFieldList[2]) ? 'rowid' : $InfoFieldList[2]); $sql .= " AND ".forgeSQLFromUniversalSearchCriteria($InfoFieldList[3], $errorstr, 1); } else { $sql .= " WHERE ".forgeSQLFromUniversalSearchCriteria($InfoFieldList[3], $errorstr, 1); diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php index 651b397cac3..efbb85a5cdc 100644 --- a/htdocs/core/class/commonobject.class.php +++ b/htdocs/core/class/commonobject.class.php @@ -7625,6 +7625,14 @@ abstract class CommonObject $InfoFieldList = array_merge($InfoFieldList, explode(':', $tmpafter)); } //var_dump($InfoFieldList); + + // Fix better compatibility with some old extrafield syntax filter "(field=123)" + $reg = array(); + if (preg_match('/$\(([a-z0-9]+)([=<>]+)(\d+)\)$/i', $InfoFieldList[4], $reg)) { + $InfoFieldList[4] = '('.$reg[1].':'.$reg[2].':'.$reg[3].')'; + } + + //var_dump($InfoFieldList); } //$Usf = empty($paramoptions[1]) ? '' :$paramoptions[1]; @@ -7680,8 +7688,8 @@ abstract class CommonObject // We have to join on extrafield table $errstr = ''; if (strpos($InfoFieldList[4], 'extra') !== false) { - $sql .= " as main, " . $this->db->prefix() . $InfoFieldList[0] . "_extrafields as extra"; - $sqlwhere .= " WHERE extra.fk_object = main." . $InfoFieldList[2]; + $sql .= " as main, " . $this->db->sanitize($this->db->prefix() . $InfoFieldList[0]) . "_extrafields as extra"; + $sqlwhere .= " WHERE extra.fk_object = main." . $this->db->sanitize($InfoFieldList[2]); $sqlwhere .= " AND " . forgeSQLFromUniversalSearchCriteria($InfoFieldList[4], $errstr, 1); } else { $sqlwhere .= " WHERE " . forgeSQLFromUniversalSearchCriteria($InfoFieldList[4], $errstr, 1); @@ -7690,7 +7698,7 @@ abstract class CommonObject $sqlwhere .= ' WHERE 1=1'; } - // Add Usf filter + // Add Usf filter on second line /* if ($Usf) { $errorstr = ''; @@ -7849,6 +7857,13 @@ abstract class CommonObject if ($tmpafter !== '') { $InfoFieldList = array_merge($InfoFieldList, explode(':', $tmpafter)); } + + // Fix better compatibility with some old extrafield syntax filter "(field=123)" + $reg = array(); + if (preg_match('/$\(([a-z0-9]+)([=<>]+)(\d+)\)$/i', $InfoFieldList[4], $reg)) { + $InfoFieldList[4] = '('.$reg[1].':'.$reg[2].':'.$reg[3].')'; + } + //var_dump($InfoFieldList); } @@ -7906,9 +7921,11 @@ abstract class CommonObject } // We have to join on extrafield table + $errstr = ''; if (strpos($InfoFieldList[4], 'extra') !== false) { - $sql .= ' as main, ' . $this->db->prefix() . $InfoFieldList[0] . '_extrafields as extra'; - $sqlwhere .= " WHERE extra.fk_object = main." . $InfoFieldList[2] . " AND " . $InfoFieldList[4]; + $sql .= ' as main, ' . $this->db->sanitize($this->db->prefix() . $InfoFieldList[0]) . '_extrafields as extra'; + $sqlwhere .= " WHERE extra.fk_object = main." . $this->db->sanitize($InfoFieldList[2]); + $sqlwhere .= " AND " . $InfoFieldList[4]; } else { $sqlwhere .= " WHERE " . $InfoFieldList[4]; } diff --git a/htdocs/core/class/extrafields.class.php b/htdocs/core/class/extrafields.class.php index 77fae4a7349..2956e1ca130 100644 --- a/htdocs/core/class/extrafields.class.php +++ b/htdocs/core/class/extrafields.class.php @@ -1340,7 +1340,7 @@ class ExtraFields // If there is a filter, we extract it by taking all content inside parenthesis. if (! empty($InfoFieldList[4])) { - $pos = 0; + $pos = 0; // $pos will be position of ending filter $parenthesisopen = 0; while (substr($InfoFieldList[4], $pos, 1) !== '' && ($parenthesisopen || $pos == 0 || substr($InfoFieldList[4], $pos, 1) != ':')) { if (substr($InfoFieldList[4], $pos, 1) == '(') { @@ -1358,6 +1358,13 @@ class ExtraFields if ($tmpafter !== '') { $InfoFieldList = array_merge($InfoFieldList, explode(':', $tmpafter)); } + + // Fix better compatibility with some old extrafield syntax filter "(field=123)" + $reg = array(); + if (preg_match('/$\(([a-z0-9]+)([=<>]+)(\d+)\)$/i', $InfoFieldList[4], $reg)) { + $InfoFieldList[4] = '('.$reg[1].':'.$reg[2].':'.$reg[3].')'; + } + //var_dump($InfoFieldList); } @@ -1414,14 +1421,15 @@ class ExtraFields } else { $InfoFieldList[4] = str_replace('$ID$', '0', $InfoFieldList[4]); } - //We have to join on extrafield table + + // We have to join on extrafield table $errstr = ''; if (strpos($InfoFieldList[4], 'extra.') !== false) { - $sql .= ' as main, '.$this->db->prefix().$InfoFieldList[0].'_extrafields as extra'; - $sqlwhere .= " WHERE extra.fk_object = main.".$InfoFieldList[2]." AND ".$InfoFieldList[4]; + $sql .= ' as main, '.$this->db->sanitize($this->db->prefix().$InfoFieldList[0]).'_extrafields as extra'; + $sqlwhere .= " WHERE extra.fk_object = main.".$this->db->sanitize($InfoFieldList[2]); $sqlwhere .= " AND " . forgeSQLFromUniversalSearchCriteria($InfoFieldList[4], $errstr, 1); } else { - $sqlwhere .= " AND " . forgeSQLFromUniversalSearchCriteria($InfoFieldList[4], $errstr, 1); + $sqlwhere .= " WHERE " . forgeSQLFromUniversalSearchCriteria($InfoFieldList[4], $errstr, 1); } } else { $sqlwhere .= ' WHERE 1=1'; @@ -1575,6 +1583,13 @@ class ExtraFields if ($tmpafter !== '') { $InfoFieldList = array_merge($InfoFieldList, explode(':', $tmpafter)); } + + // Fix better compatibility with some old extrafield syntax filter "(field=123)" + $reg = array(); + if (preg_match('/$\(([a-z0-9]+)([=<>]+)(\d+)\)$/i', $InfoFieldList[4], $reg)) { + $InfoFieldList[4] = '('.$reg[1].':'.$reg[2].':'.$reg[3].')'; + } + //var_dump($InfoFieldList); } @@ -1683,8 +1698,8 @@ class ExtraFields // We have to join on extrafield table $errstr = ''; if (strpos($InfoFieldList[4], 'extra.') !== false) { - $sql .= ' as main, '.$this->db->prefix().$InfoFieldList[0].'_extrafields as extra'; - $sqlwhere .= " WHERE extra.fk_object = main.".$InfoFieldList[2]; + $sql .= ' as main, '.$this->db->sanitize($this->db->prefix().$InfoFieldList[0]).'_extrafields as extra'; + $sqlwhere .= " WHERE extra.fk_object = main.".$this->db->sanitize($InfoFieldList[2]); $sqlwhere .= " AND " . forgeSQLFromUniversalSearchCriteria($InfoFieldList[4], $errstr, 1); } else { $sqlwhere .= " WHERE " . forgeSQLFromUniversalSearchCriteria($InfoFieldList[4], $errstr, 1); diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 11fedc5ef0b..494235e1c6b 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -13356,6 +13356,7 @@ function forgeSQLFromUniversalSearchCriteria($filter, &$errorstr = '', $noand = if ($noerror) { return '1 = 2'; } else { + dol_syslog("forgeSQLFromUniversalSearchCriteria Filter error - ".$errorstr, LOG_WARNING); return 'Filter error - '.$tmperrorstr; // Bad syntax of the search string, we return an error message or force a SQL not found } }