Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

More sql sanitizing

Browse Source
This commit is contained in:
Laurent Destailleur
2021-09-02 13:58:42 +02:00
parent cac1a7ba5f
commit b04ea59a51
23 changed files with 26 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/bom/class/bom.class.php
View File

@@ -1299,7 +1299,7 @@ class BOMLine extends CommonObjectLine
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' AND ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {

2
htdocs/core/class/cproductnature.class.php
View File

@@ -219,7 +219,7 @@ class CProductNature // extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' WHERE ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' WHERE ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {

4
htdocs/core/class/ctyperesource.class.php
View File

@@ -239,12 +239,12 @@ class Ctyperesource
$sqlwhere = array();
if (count($filter) > 0) {
foreach ($filter as $key => $value) {
$sqlwhere [] = $key." LIKE '%".$this->db->escape($value)."%'";
$sqlwhere[] = $key." LIKE '%".$this->db->escape($value)."%'";
}
}
if (count($sqlwhere) > 0) {
$sql .= ' WHERE '.implode(' '.$filtermode.' ', $sqlwhere);
$sql .= ' WHERE '.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere);
}
if (!empty($sortfield)) {
$sql .= $this->db->order($sortfield, $sortorder);

2
htdocs/core/class/cunits.class.php
View File

@@ -262,7 +262,7 @@ class CUnits // extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' WHERE ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' WHERE ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {

2
htdocs/core/class/defaultvalues.class.php
View File

@@ -279,7 +279,7 @@ class DefaultValues extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' AND ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {

2
htdocs/ecm/class/ecmfiles.class.php
View File

@@ -542,7 +542,7 @@ class EcmFiles extends CommonObject
$sql .= " AND entity IN (" . getEntity('ecmfiles') . ")";
}*/
if (count($sqlwhere) > 0) {
$sql .= ' AND '.implode(' '.$filtermode.' ', $sqlwhere);
$sql .= ' AND '.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere);
}
if (!empty($sortfield)) {
$sql .= $this->db->order($sortfield, $sortorder);

2
htdocs/eventorganization/class/conferenceorbooth.class.php
View File

@@ -306,7 +306,7 @@ class ConferenceOrBooth extends ActionComm
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' AND ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {

2
htdocs/eventorganization/class/conferenceorboothattendee.class.php
View File

@@ -427,7 +427,7 @@ class ConferenceOrBoothAttendee extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' AND ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {

2
htdocs/fourn/class/fournisseur.commande.dispatch.class.php
View File

@@ -677,7 +677,7 @@ class CommandeFournisseurDispatch extends CommonObjectLine
}
}
if (count($sqlwhere) > 0) {
$sql .= ' WHERE '.implode(' '.$filtermode.' ', $sqlwhere);
$sql .= ' WHERE '.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere);
}
if (!empty($sortfield)) {

2
htdocs/knowledgemanagement/class/knowledgerecord.class.php
View File

@@ -400,7 +400,7 @@ class KnowledgeRecord extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' AND ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {

4
htdocs/mrp/class/mo.class.php
View File

@@ -448,7 +448,7 @@ class Mo extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' AND ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {
@@ -1557,7 +1557,7 @@ class MoLine extends CommonObjectLine
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' AND ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {

2
htdocs/partnership/class/partnership.class.php
View File

@@ -496,7 +496,7 @@ class Partnership extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' AND ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {

2
htdocs/product/class/productfournisseurprice.class.php
View File

@@ -339,7 +339,7 @@ class ProductFournisseurPrice extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' AND ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {

2
htdocs/product/stock/class/productstockentrepot.class.php
View File

@@ -277,7 +277,7 @@ class ProductStockEntrepot extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND '.implode(' '.$filtermode.' ', $sqlwhere);
$sql .= ' AND '.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere);
}
if (!empty($fk_product) && $fk_product > 0) {

2
htdocs/recruitment/class/recruitmentcandidature.class.php
View File

@@ -388,7 +388,7 @@ class RecruitmentCandidature extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' AND ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {

2
htdocs/recruitment/class/recruitmentjobposition.class.php
View File

@@ -397,7 +397,7 @@ class RecruitmentJobPosition extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' AND ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {

2
htdocs/ticket/class/cticketcategory.class.php
View File

@@ -408,7 +408,7 @@ class CTicketCategory extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' AND ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {

2
htdocs/user/class/user.class.php
View File

@@ -3526,7 +3526,7 @@ class User extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' AND ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
$sql .= $this->db->order($sortfield, $sortorder);
if ($limit) {

2
htdocs/website/class/website.class.php
View File

@@ -419,7 +419,7 @@ class Website extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND '.implode(' '.$filtermode.' ', $sqlwhere);
$sql .= ' AND '.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere);
}
if (!empty($sortfield)) {

4
htdocs/website/class/websitepage.class.php
View File

@@ -441,7 +441,7 @@ class WebsitePage extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= " AND (".implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= " AND (".implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {
@@ -543,7 +543,7 @@ class WebsitePage extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' AND ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
$resql = $this->db->query($sql);

2
htdocs/workstation/class/workstation.class.php
View File

@@ -440,7 +440,7 @@ class Workstation extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' AND ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {

2
htdocs/zapier/class/hook.class.php
View File

@@ -430,7 +430,7 @@ class Hook extends CommonObject
}
}
if (count($sqlwhere) > 0) {
$sql .= ' AND ('.implode(' '.$filtermode.' ', $sqlwhere).')';
$sql .= ' AND ('.implode(' '.$this->db->escape($filtermode).' ', $sqlwhere).')';
}
if (!empty($sortfield)) {

2
test/phpunit/CodingPhpTest.php
View File

@@ -354,7 +354,7 @@ class CodingPhpTest extends PHPUnit\Framework\TestCase
// Check string sql|set...'.$yyy->xxx with xxx that is not 'escape', 'idate', .... It means we forget a db->escape when forging sql request.
preg_match_all('/(\$sql|SET\s|WHERE\s|INSERT\s|VALUES\s|VALUES\().+\s*\'\s*\.\s*\$(.........)/', $filecontent, $matches, PREG_SET_ORDER);
foreach ($matches as $key => $val) {
if (! in_array($val[2], array('this->db-', 'db->sanit', 'conf->ent', 'key : \'\')', 'key])."\')', 'excludefi', 'regexstri', 'filtermod'))) {
if (! in_array($val[2], array('this->db-', 'db->sanit', 'conf->ent', 'key : \'\')', 'key])."\')', 'excludefi', 'regexstri', ''))) {
$ok=false;
var_dump($matches);
break;