diff --git a/htdocs/comm/mailing/class/html.formadvtargetemailing.class.php b/htdocs/comm/mailing/class/html.formadvtargetemailing.class.php
index 6a6e00b65ed..01957c93456 100644
--- a/htdocs/comm/mailing/class/html.formadvtargetemailing.class.php
+++ b/htdocs/comm/mailing/class/html.formadvtargetemailing.class.php
@@ -316,7 +316,7 @@ class FormAdvTargetEmailing extends Form
// We have to join on extrafield table
if (strpos($InfoFieldList[3], 'extra') !== false) {
$sql .= ' as main, '.$this->db->sanitize(MAIN_DB_PREFIX.$InfoFieldList[0]).'_extrafields as extra';
- $sql .= " WHERE extra.fk_object=main.".$this->db->sanitize(empty($InfoFieldList[2]) ? 'rowid' : $InfoFieldList[2]);
+ $sql .= " WHERE extra.fk_object = main.".$this->db->sanitize(empty($InfoFieldList[2]) ? 'rowid' : $InfoFieldList[2]);
$sql .= " AND ".forgeSQLFromUniversalSearchCriteria($InfoFieldList[3], $errorstr, 1);
} else {
$sql .= " WHERE ".forgeSQLFromUniversalSearchCriteria($InfoFieldList[3], $errorstr, 1);
diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php
index 651b397cac3..efbb85a5cdc 100644
--- a/htdocs/core/class/commonobject.class.php
+++ b/htdocs/core/class/commonobject.class.php
@@ -7625,6 +7625,14 @@ abstract class CommonObject
$InfoFieldList = array_merge($InfoFieldList, explode(':', $tmpafter));
}
//var_dump($InfoFieldList);
+
+ // Fix better compatibility with some old extrafield syntax filter "(field=123)"
+ $reg = array();
+ if (preg_match('/$\(([a-z0-9]+)([=<>]+)(\d+)\)$/i', $InfoFieldList[4], $reg)) {
+ $InfoFieldList[4] = '('.$reg[1].':'.$reg[2].':'.$reg[3].')';
+ }
+
+ //var_dump($InfoFieldList);
}
//$Usf = empty($paramoptions[1]) ? '' :$paramoptions[1];
@@ -7680,8 +7688,8 @@ abstract class CommonObject
// We have to join on extrafield table
$errstr = '';
if (strpos($InfoFieldList[4], 'extra') !== false) {
- $sql .= " as main, " . $this->db->prefix() . $InfoFieldList[0] . "_extrafields as extra";
- $sqlwhere .= " WHERE extra.fk_object = main." . $InfoFieldList[2];
+ $sql .= " as main, " . $this->db->sanitize($this->db->prefix() . $InfoFieldList[0]) . "_extrafields as extra";
+ $sqlwhere .= " WHERE extra.fk_object = main." . $this->db->sanitize($InfoFieldList[2]);
$sqlwhere .= " AND " . forgeSQLFromUniversalSearchCriteria($InfoFieldList[4], $errstr, 1);
} else {
$sqlwhere .= " WHERE " . forgeSQLFromUniversalSearchCriteria($InfoFieldList[4], $errstr, 1);
@@ -7690,7 +7698,7 @@ abstract class CommonObject
$sqlwhere .= ' WHERE 1=1';
}
- // Add Usf filter
+ // Add Usf filter on second line
/*
if ($Usf) {
$errorstr = '';
@@ -7849,6 +7857,13 @@ abstract class CommonObject
if ($tmpafter !== '') {
$InfoFieldList = array_merge($InfoFieldList, explode(':', $tmpafter));
}
+
+ // Fix better compatibility with some old extrafield syntax filter "(field=123)"
+ $reg = array();
+ if (preg_match('/$\(([a-z0-9]+)([=<>]+)(\d+)\)$/i', $InfoFieldList[4], $reg)) {
+ $InfoFieldList[4] = '('.$reg[1].':'.$reg[2].':'.$reg[3].')';
+ }
+
//var_dump($InfoFieldList);
}
@@ -7906,9 +7921,11 @@ abstract class CommonObject
}
// We have to join on extrafield table
+ $errstr = '';
if (strpos($InfoFieldList[4], 'extra') !== false) {
- $sql .= ' as main, ' . $this->db->prefix() . $InfoFieldList[0] . '_extrafields as extra';
- $sqlwhere .= " WHERE extra.fk_object = main." . $InfoFieldList[2] . " AND " . $InfoFieldList[4];
+ $sql .= ' as main, ' . $this->db->sanitize($this->db->prefix() . $InfoFieldList[0]) . '_extrafields as extra';
+ $sqlwhere .= " WHERE extra.fk_object = main." . $this->db->sanitize($InfoFieldList[2]);
+ $sqlwhere .= " AND " . $InfoFieldList[4];
} else {
$sqlwhere .= " WHERE " . $InfoFieldList[4];
}
diff --git a/htdocs/core/class/extrafields.class.php b/htdocs/core/class/extrafields.class.php
index 77fae4a7349..2956e1ca130 100644
--- a/htdocs/core/class/extrafields.class.php
+++ b/htdocs/core/class/extrafields.class.php
@@ -1340,7 +1340,7 @@ class ExtraFields
// If there is a filter, we extract it by taking all content inside parenthesis.
if (! empty($InfoFieldList[4])) {
- $pos = 0;
+ $pos = 0; // $pos will be position of ending filter
$parenthesisopen = 0;
while (substr($InfoFieldList[4], $pos, 1) !== '' && ($parenthesisopen || $pos == 0 || substr($InfoFieldList[4], $pos, 1) != ':')) {
if (substr($InfoFieldList[4], $pos, 1) == '(') {
@@ -1358,6 +1358,13 @@ class ExtraFields
if ($tmpafter !== '') {
$InfoFieldList = array_merge($InfoFieldList, explode(':', $tmpafter));
}
+
+ // Fix better compatibility with some old extrafield syntax filter "(field=123)"
+ $reg = array();
+ if (preg_match('/$\(([a-z0-9]+)([=<>]+)(\d+)\)$/i', $InfoFieldList[4], $reg)) {
+ $InfoFieldList[4] = '('.$reg[1].':'.$reg[2].':'.$reg[3].')';
+ }
+
//var_dump($InfoFieldList);
}
@@ -1414,14 +1421,15 @@ class ExtraFields
} else {
$InfoFieldList[4] = str_replace('$ID$', '0', $InfoFieldList[4]);
}
- //We have to join on extrafield table
+
+ // We have to join on extrafield table
$errstr = '';
if (strpos($InfoFieldList[4], 'extra.') !== false) {
- $sql .= ' as main, '.$this->db->prefix().$InfoFieldList[0].'_extrafields as extra';
- $sqlwhere .= " WHERE extra.fk_object = main.".$InfoFieldList[2]." AND ".$InfoFieldList[4];
+ $sql .= ' as main, '.$this->db->sanitize($this->db->prefix().$InfoFieldList[0]).'_extrafields as extra';
+ $sqlwhere .= " WHERE extra.fk_object = main.".$this->db->sanitize($InfoFieldList[2]);
$sqlwhere .= " AND " . forgeSQLFromUniversalSearchCriteria($InfoFieldList[4], $errstr, 1);
} else {
- $sqlwhere .= " AND " . forgeSQLFromUniversalSearchCriteria($InfoFieldList[4], $errstr, 1);
+ $sqlwhere .= " WHERE " . forgeSQLFromUniversalSearchCriteria($InfoFieldList[4], $errstr, 1);
}
} else {
$sqlwhere .= ' WHERE 1=1';
@@ -1575,6 +1583,13 @@ class ExtraFields
if ($tmpafter !== '') {
$InfoFieldList = array_merge($InfoFieldList, explode(':', $tmpafter));
}
+
+ // Fix better compatibility with some old extrafield syntax filter "(field=123)"
+ $reg = array();
+ if (preg_match('/$\(([a-z0-9]+)([=<>]+)(\d+)\)$/i', $InfoFieldList[4], $reg)) {
+ $InfoFieldList[4] = '('.$reg[1].':'.$reg[2].':'.$reg[3].')';
+ }
+
//var_dump($InfoFieldList);
}
@@ -1683,8 +1698,8 @@ class ExtraFields
// We have to join on extrafield table
$errstr = '';
if (strpos($InfoFieldList[4], 'extra.') !== false) {
- $sql .= ' as main, '.$this->db->prefix().$InfoFieldList[0].'_extrafields as extra';
- $sqlwhere .= " WHERE extra.fk_object = main.".$InfoFieldList[2];
+ $sql .= ' as main, '.$this->db->sanitize($this->db->prefix().$InfoFieldList[0]).'_extrafields as extra';
+ $sqlwhere .= " WHERE extra.fk_object = main.".$this->db->sanitize($InfoFieldList[2]);
$sqlwhere .= " AND " . forgeSQLFromUniversalSearchCriteria($InfoFieldList[4], $errstr, 1);
} else {
$sqlwhere .= " WHERE " . forgeSQLFromUniversalSearchCriteria($InfoFieldList[4], $errstr, 1);
diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index 11fedc5ef0b..494235e1c6b 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -13356,6 +13356,7 @@ function forgeSQLFromUniversalSearchCriteria($filter, &$errorstr = '', $noand =
if ($noerror) {
return '1 = 2';
} else {
+ dol_syslog("forgeSQLFromUniversalSearchCriteria Filter error - ".$errorstr, LOG_WARNING);
return 'Filter error - '.$tmperrorstr; // Bad syntax of the search string, we return an error message or force a SQL not found
}
}