diff --git a/htdocs/api/class/api.class.php b/htdocs/api/class/api.class.php index 319b8b4269d..2a6b5f33a27 100644 --- a/htdocs/api/class/api.class.php +++ b/htdocs/api/class/api.class.php @@ -302,49 +302,13 @@ class DolibarrApi { // phpcs:enable - //$regexstring='\(([^:\'\(\)]+:[^:\'\(\)]+:[^:\(\)]+)\)'; - //$tmp=preg_replace_all('/'.$regexstring.'/', '', $sqlfilters); - $tmp = trim($sqlfilters); - - $i = 0; $nb = strlen($tmp); - - if ($nb > 0 && $tmp[0] != '(') { - $error = "Bad sqlfilters (first and last characters must be open and closing parenthesis) = ".$sqlfilters; - dol_syslog($error, LOG_WARNING); - return false; - } - - $counter = 0; - while ($i < $nb) { - if ($tmp[$i] == '(') { - $counter++; - } - if ($tmp[$i] == ')') { - $counter--; - - // TODO: After a closing ), only a " or " or " and " or end of string is allowed. - } - if ($counter < 0) { - $error = "Bad sqlfilters (too many closing parenthesis) = ".$sqlfilters; - dol_syslog($error, LOG_WARNING); - return false; - } - $i++; - } - - if ($counter > 0) { - $error = "Bad sqlfilters (too many opening parenthesis) = ".$sqlfilters; - dol_syslog($error, LOG_WARNING); - return false; - } - - return true; + return dolCheckFilters($sqlfilters, $error); } // phpcs:disable PEAR.NamingConventions.ValidFunctionName.ScopeNotCamelCaps // phpcs:disable PEAR.NamingConventions.ValidFunctionName.PublicUnderscore /** - * Function to forge a SQL criteria + * Function to forge a SQL criteria from a Generic filter string * * @param array $matches Array of found string by regex search. * Each entry is 1 and only 1 criteria. @@ -353,51 +317,6 @@ class DolibarrApi */ protected static function _forge_criteria_callback($matches) { - // phpcs:enable - global $db; - - //dol_syslog("Convert matches ".$matches[1]); - if (empty($matches[1])) { - return ''; - } - $tmp = explode(':', $matches[1], 3); - - if (count($tmp) < 3) { - return ''; - } - - // Sanitize operand - $operand = preg_replace('/[^a-z0-9\._]/i', '', trim($tmp[0])); - - // Sanitize operator - $operator = strtoupper(preg_replace('/[^a-z<>=]/i', '', trim($tmp[1]))); - // Only some operators are allowed. - if (! in_array($operator, array('LIKE', 'ULIKE', '<', '>', '<=', '>=', '=', '<>', 'IS', 'ISNOT', 'IN'))) { - return ''; - } - if ($operator == 'ISNOT') { - $operator = 'IS NOT'; - } - - // Sanitize value - $tmpescaped = trim($tmp[2]); - $regbis = array(); - if ($operator == 'IN') { - $tmpescaped = "(".$db->sanitize($tmpescaped, 1).")"; - } elseif (in_array($operator, array('<', '>', '<=', '>=', '=', '<>'))) { - if (preg_match('/^\'(.*)\'$/', $tmpescaped, $regbis)) { // If 'YYYY-MM-DD HH:MM:SS+X' - $tmpescaped = "'".$db->escape($regbis[1])."'"; - } else { - $tmpescaped = ((float) $tmpescaped); - } - } else { - if (preg_match('/^\'(.*)\'$/', $tmpescaped, $regbis)) { - $tmpescaped = "'".$db->escape($regbis[1])."'"; - } else { - $tmpescaped = "'".$db->escape($tmpescaped)."'"; - } - } - - return $db->escape($operand).' '.$db->escape($operator)." ".$tmpescaped; + return dolForgeCriteriaCallback($matches); } } diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php index 0525ad6f3c8..ef184548add 100644 --- a/htdocs/core/class/html.form.class.php +++ b/htdocs/core/class/html.form.class.php @@ -9666,7 +9666,12 @@ class Form $ret .= '
'.$texttoshow.'
'; $ret .= ''; - $ret .= ''; + $ret .= "\n"; + if (GETPOST('show_search_component_params_hidden', 'int')) { + $ret .= ''; + } + $ret .= ''; + // For compatibility with forms that show themself the search criteria in addition of this component, we output the fields foreach ($arrayofcriterias as $criterias) { foreach ($criterias as $criteriafamilykey => $criteriafamilyval) { diff --git a/htdocs/core/customreports.php b/htdocs/core/customreports.php index 1cede60f892..00258ba7d09 100644 --- a/htdocs/core/customreports.php +++ b/htdocs/core/customreports.php @@ -349,7 +349,7 @@ foreach ($arrayoftype as $key => $val) { } print $form->selectarray('objecttype', $newarrayoftype, $objecttype, 0, 0, 0, '', 1, 0, 0, '', 'minwidth200', 1); if (empty($conf->use_javascript_ajax)) { - print ''; + print ''; } else { print '