';
$moreforfilter .= '';
@@ -584,6 +584,7 @@ if ($mode == 'common' || $mode == 'commonkanban') {
// Show list of modules
$oldfamily = '';
+ $foundoneexternalmodulewithupdate = 0;
$linenum = 0;
foreach ($orders as $key => $value) {
$linenum++;
@@ -915,6 +916,7 @@ if ($mode == 'common' || $mode == 'commonkanban') {
if ($objMod->needUpdate) {
$versionTitle = $langs->trans('ModuleUpdateAvailable').' : '.$objMod->lastVersion;
print ''.$versiontrans.'';
+ $foundoneexternalmodulewithupdate++;
} else {
print $versiontrans;
}
@@ -934,6 +936,14 @@ if ($mode == 'common' || $mode == 'commonkanban') {
}
}
+ if ($action == 'checklastversion') {
+ if ($foundoneexternalmodulewithupdate) {
+ setEventMessages($langs->trans("ModuleUpdateAvailable"), null, 'mesgs');
+ } else {
+ setEventMessages($langs->trans("NoExternalModuleWithUpdate"), null, 'mesgs');
+ }
+ }
+
if ($oldfamily) {
if ($mode == 'commonkanban') {
print '
';
diff --git a/htdocs/admin/security.php b/htdocs/admin/security.php
index 9ce22b7c08e..e3521f1d0af 100644
--- a/htdocs/admin/security.php
+++ b/htdocs/admin/security.php
@@ -71,7 +71,7 @@ if ($action == 'activate_encrypt') {
if (dol_hash($obj->pass)) {
$sql = "UPDATE ".MAIN_DB_PREFIX."user";
$sql .= " SET pass_crypted = '".dol_hash($obj->pass)."', pass = NULL";
- $sql .= " WHERE rowid=".$obj->rowid;
+ $sql .= " WHERE rowid=".((int) $obj->rowid);
//print $sql;
$resql2 = $db->query($sql);
diff --git a/htdocs/admin/translation.php b/htdocs/admin/translation.php
index 315673f1582..f5ab2af51e3 100644
--- a/htdocs/admin/translation.php
+++ b/htdocs/admin/translation.php
@@ -289,7 +289,7 @@ if ($mode == 'overwrite') {
print "\n";
print '| '.$langcode.' | '.$key.' | ';
print dol_escape_htmltag($val);
print ' | ';
if (!empty($newlangfileonly->tab_translate[$key])) {
diff --git a/htdocs/api/class/api_login.class.php b/htdocs/api/class/api_login.class.php
index df5b9945a76..7afdb74b89d 100644
--- a/htdocs/api/class/api_login.class.php
+++ b/htdocs/api/class/api_login.class.php
@@ -31,8 +31,13 @@ class Login
*/
public function __construct()
{
- global $db;
+ global $conf, $db;
$this->db = $db;
+
+ //$conf->global->MAIN_MODULE_API_LOGIN_DISABLED = 1;
+ if (!empty($conf->global->MAIN_MODULE_API_LOGIN_DISABLED)) {
+ throw new RestException(403, "Error login APIs are disabled. You must get the token from backoffice to be able to use APIs");
+ }
}
/**
diff --git a/htdocs/api/class/api_setup.class.php b/htdocs/api/class/api_setup.class.php
index ca716712189..ceaf5f8f7d8 100644
--- a/htdocs/api/class/api_setup.class.php
+++ b/htdocs/api/class/api_setup.class.php
@@ -1631,8 +1631,8 @@ class Setup extends DolibarrApi
global $langs, $conf;
if (!DolibarrApiAccess::$user->admin
- && (empty($conf->global->API_LOGIN_ALLOWED_FOR_INTEGRITY_CHECK) || DolibarrApiAccess::$user->login != $conf->global->API_LOGIN_ALLOWED_FOR_INTEGRITY_CHECK)) {
- throw new RestException(403, 'Error API open to admin users only or to the users with logins defined into constant API_LOGIN_ALLOWED_FOR_INTEGRITY_CHECK');
+ && (empty($conf->global->API_LOGINS_ALLOWED_FOR_INTEGRITY_CHECK) || DolibarrApiAccess::$user->login != $conf->global->API_LOGINS_ALLOWED_FOR_INTEGRITY_CHECK)) {
+ throw new RestException(403, 'Error API open to admin users only or to the users with logins defined into constant API_LOGINS_ALLOWED_FOR_INTEGRITY_CHECK');
}
require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
@@ -1937,8 +1937,8 @@ class Setup extends DolibarrApi
global $conf;
if (!DolibarrApiAccess::$user->admin
- && (empty($conf->global->API_LOGIN_ALLOWED_FOR_GET_MODULES) || DolibarrApiAccess::$user->login != $conf->global->API_LOGIN_ALLOWED_FOR_GET_MODULES)) {
- throw new RestException(403, 'Error API open to admin users only or to the users with logins defined into constant API_LOGIN_ALLOWED_FOR_GET_MODULES');
+ && (empty($conf->global->API_LOGINS_ALLOWED_FOR_GET_MODULES) || DolibarrApiAccess::$user->login != $conf->global->API_LOGINS_ALLOWED_FOR_GET_MODULES)) {
+ throw new RestException(403, 'Error API open to admin users only or to the users with logins defined into constant API_LOGINS_ALLOWED_FOR_GET_MODULES');
}
sort($conf->modules);
diff --git a/htdocs/api/index.php b/htdocs/api/index.php
index 89b5a696462..c494730f795 100644
--- a/htdocs/api/index.php
+++ b/htdocs/api/index.php
@@ -218,6 +218,11 @@ if (!empty($reg[1]) && $reg[1] == 'explorer' && ($reg[2] == '/swagger.json' || $
continue;
}
+ //$conf->global->MAIN_MODULE_API_LOGIN_DISABLED = 1;
+ if ($file_searched == 'api_login.class.php' && !empty($conf->global->MAIN_MODULE_API_LOGIN_DISABLED)) {
+ continue;
+ }
+
$regapi = array();
if (is_readable($dir_part.$file_searched) && preg_match("/^api_(.*)\.class\.php$/i", $file_searched, $regapi)) {
$classname = ucwords($regapi[1]);
@@ -291,6 +296,29 @@ if (!empty($reg[1]) && ($reg[1] != 'explorer' || ($reg[2] != '/swagger.json' &&
$classname = ucwords($moduleobject);
+ // Test rules on endpoints. For example:
+ // $conf->global->API_ENDPOINT_RULES = 'endpoint1:1,endpoint2:1,...'
+ if (!empty($conf->global->API_ENDPOINT_RULES)) {
+ $listofendpoints = explode(',', $conf->global->API_ENDPOINT_RULES);
+ $endpointisallowed = false;
+
+ foreach ($listofendpoints as $endpointrule) {
+ $tmparray = explode(':', $endpointrule);
+ if ($classfile == $tmparray[0] && $tmparray[1] == 1) {
+ $endpointisallowed = true;
+ break;
+ }
+ }
+
+ if (! $endpointisallowed) {
+ dol_syslog('The API with endpoint /'.$classfile.' is forbidden by config API_ENDPOINT_RULES', LOG_WARNING);
+ print 'The API with endpoint /'.$classfile.' is forbidden by config API_ENDPOINT_RULES';
+ header('HTTP/1.1 501 API is forbidden by API_ENDPOINT_RULES');
+ //session_destroy();
+ exit(0);
+ }
+ }
+
dol_syslog('Search api file /'.$moduledirforclass.'/class/api_'.$classfile.'.class.php => dir_part_file='.$dir_part_file.' classname='.$classname);
$res = false;
@@ -314,7 +342,7 @@ if (!empty($reg[1]) && ($reg[1] != 'explorer' || ($reg[2] != '/swagger.json' &&
//var_dump($api->r->apiVersionMap);
//exit;
-// We do not want that restler output data if we use native compression (default behaviour) but we want to have it returned into a string.
+// We do not want that restler outputs data if we use native compression (default behaviour) but we want to have it returned into a string.
Luracast\Restler\Defaults::$returnResponse = (empty($conf->global->API_DISABLE_COMPRESSION) && !empty($_SERVER['HTTP_ACCEPT_ENCODING']));
// Call API (we suppose we found it).
diff --git a/htdocs/asset/class/asset_type.class.php b/htdocs/asset/class/asset_type.class.php
index 99205d2b3f3..36c654c28ba 100644
--- a/htdocs/asset/class/asset_type.class.php
+++ b/htdocs/asset/class/asset_type.class.php
@@ -188,7 +188,7 @@ class AssetType extends CommonObject
$sql .= "accountancy_code_depreciation_asset = '".$this->db->escape($this->accountancy_code_depreciation_asset)."',";
$sql .= "accountancy_code_depreciation_expense = '".$this->db->escape($this->accountancy_code_depreciation_expense)."',";
$sql .= "note = '".$this->db->escape($this->note)."'";
- $sql .= " WHERE rowid =".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
$result = $this->db->query($sql);
if ($result) {
diff --git a/htdocs/blockedlog/class/authority.class.php b/htdocs/blockedlog/class/authority.class.php
index 9fc10fdc59e..2071eb03c47 100644
--- a/htdocs/blockedlog/class/authority.class.php
+++ b/htdocs/blockedlog/class/authority.class.php
@@ -148,7 +148,7 @@ class BlockedLogAuthority
global $langs;
- dol_syslog(get_class($this)."::fetch id=".$id, LOG_DEBUG);
+ dol_syslog(get_class($this)."::fetch id=".((int) $id), LOG_DEBUG);
if (empty($id) && empty($signature)) {
$this->error = 'BadParameter';
diff --git a/htdocs/bookmarks/class/bookmark.class.php b/htdocs/bookmarks/class/bookmark.class.php
index 4fe8c3cee83..9a5b3a53c20 100644
--- a/htdocs/bookmarks/class/bookmark.class.php
+++ b/htdocs/bookmarks/class/bookmark.class.php
@@ -219,7 +219,7 @@ class Bookmark extends CommonObject
$sql .= " ,title = '".$this->db->escape($this->title)."'";
$sql .= " ,favicon = '".$this->db->escape($this->favicon)."'";
$sql .= " ,position = ".(int) $this->position;
- $sql .= " WHERE rowid = ".$this->id;
+ $sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog("Bookmark::update", LOG_DEBUG);
if ($this->db->query($sql)) {
diff --git a/htdocs/categories/class/categorie.class.php b/htdocs/categories/class/categorie.class.php
index 1f467b507d1..51079636d4f 100644
--- a/htdocs/categories/class/categorie.class.php
+++ b/htdocs/categories/class/categorie.class.php
@@ -1470,7 +1470,7 @@ class Categorie extends CommonObject
// Load bank categories
$sql = "SELECT c.label, c.rowid";
$sql .= " FROM ".MAIN_DB_PREFIX."bank_class as a, ".MAIN_DB_PREFIX."bank_categ as c";
- $sql .= " WHERE a.lineid=".$id." AND a.fk_categ = c.rowid";
+ $sql .= " WHERE a.lineid=".((int) $id)." AND a.fk_categ = c.rowid";
$sql .= " AND c.entity IN (".getEntity('category').")";
$sql .= " ORDER BY c.label";
diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php
index 74ff6c6aa62..322a688bd45 100644
--- a/htdocs/comm/action/card.php
+++ b/htdocs/comm/action/card.php
@@ -1395,7 +1395,7 @@ if ($id > 0) {
// Confirmation suppression action
if ($action == 'delete') {
- print $form->formconfirm("card.php?id=".$id, $langs->trans("DeleteAction"), $langs->trans("ConfirmDeleteAction"), "confirm_delete", '', '', 1);
+ print $form->formconfirm("card.php?id=".urlencode($id), $langs->trans("DeleteAction"), $langs->trans("ConfirmDeleteAction"), "confirm_delete", '', '', 1);
}
if ($action == 'edit') {
diff --git a/htdocs/comm/action/class/actioncomm.class.php b/htdocs/comm/action/class/actioncomm.class.php
index f7ceea4743d..d8bcd0efb1b 100644
--- a/htdocs/comm/action/class/actioncomm.class.php
+++ b/htdocs/comm/action/class/actioncomm.class.php
@@ -2436,7 +2436,7 @@ class ActionComm extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."actioncomm ";
$sql .= " SET percent = ".(int) $percent;
- $sql .= " WHERE id=".$id;
+ $sql .= " WHERE id = ".((int) $id);
if ($this->db->query($sql)) {
$this->db->commit();
diff --git a/htdocs/comm/action/index.php b/htdocs/comm/action/index.php
index 33e4fabe2aa..be0884a5556 100644
--- a/htdocs/comm/action/index.php
+++ b/htdocs/comm/action/index.php
@@ -720,7 +720,7 @@ if ($action == 'show_day') {
$sql .= ')';
}
if ($type) {
- $sql .= " AND ca.id = ".$type;
+ $sql .= " AND ca.id = ".((int) $type);
}
if ($status == '0') {
$sql .= " AND a.percent = 0";
diff --git a/htdocs/comm/action/pertype.php b/htdocs/comm/action/pertype.php
index 8d436f0e0f6..19f8a8ce31c 100644
--- a/htdocs/comm/action/pertype.php
+++ b/htdocs/comm/action/pertype.php
@@ -592,7 +592,7 @@ if ($action == 'show_day') {
$sql .= ')';
}
if ($type) {
- $sql .= " AND ca.id = ".$type;
+ $sql .= " AND ca.id = ".((int) $type);
}
if ($status == '0') {
$sql .= " AND a.percent = 0";
diff --git a/htdocs/comm/action/peruser.php b/htdocs/comm/action/peruser.php
index 3ad2d31b353..62af33b34ee 100644
--- a/htdocs/comm/action/peruser.php
+++ b/htdocs/comm/action/peruser.php
@@ -613,7 +613,7 @@ if ($action == 'show_day') {
$sql .= ')';
}
if ($type) {
- $sql .= " AND ca.id = ".$type;
+ $sql .= " AND ca.id = ".((int) $type);
}
if ($status == '0') {
$sql .= " AND a.percent = 0";
diff --git a/htdocs/comm/index.php b/htdocs/comm/index.php
index 60a6bd5974b..0a39e596ba3 100644
--- a/htdocs/comm/index.php
+++ b/htdocs/comm/index.php
@@ -37,6 +37,8 @@ require_once DOL_DOCUMENT_ROOT.'/contrat/class/contrat.class.php';
require_once DOL_DOCUMENT_ROOT.'/fourn/class/fournisseur.commande.class.php';
require_once DOL_DOCUMENT_ROOT.'/societe/class/client.class.php';
require_once DOL_DOCUMENT_ROOT.'/supplier_proposal/class/supplier_proposal.class.php';
+require_once DOL_DOCUMENT_ROOT.'/core/lib/propal.lib.php';
+require_once DOL_DOCUMENT_ROOT.'/core/lib/order.lib.php';
// Initialize technical object to manage hooks. Note that conf->hooks_modules contains array
$hookmanager = new HookManager($db);
@@ -66,6 +68,8 @@ if ($user->socid > 0) {
}
restrictedArea($user, 'societe', $id, '&societe', '', 'fk_soc', 'rowid', 0);
+$maxofloop = (empty($conf->global->MAIN_MAXLIST_OVERLOAD) ? 500 : $conf->global->MAIN_MAXLIST_OVERLOAD);
+
/*
* Actions
@@ -100,6 +104,11 @@ print load_fiche_titre($langs->trans("CommercialArea"), '', 'commercial');
print '';
+print getCustomerProposalPieChart($socid);
+print ' ';
+print getCustomerOrderPieChart($socid);
+print ' ';
+
/*
* Draft customer proposals
*/
@@ -129,14 +138,14 @@ if (!empty($conf->propal->enabled) && $user->rights->propal->lire) {
if ($resql) {
$total = 0;
$num = $db->num_rows($resql);
- $nbofloop = min($num, (empty($conf->global->MAIN_MAXLIST_OVERLOAD) ? 500 : $conf->global->MAIN_MAXLIST_OVERLOAD));
+ $nbofloop = min($num, $maxofloop);
startSimpleTable("ProposalsDraft", "comm/propal/list.php", "search_status=".Propal::STATUS_DRAFT, 2, $num);
if ($num > 0) {
$i = 0;
$othernb = 0;
- while ($i < $num && $i < $conf->liste_limit) {
+ while ($i < $nbofloop) {
$obj = $db->fetch_object($resql);
if ($i >= $max) {
@@ -181,7 +190,7 @@ if (!empty($conf->propal->enabled) && $user->rights->propal->lire) {
if ($othernb) {
print ' ';
print '| ';
- print ''.$langs->trans("More").'... ('.$othernb.')';
+ print ''.$langs->trans("More").'...'.($othernb < $maxofloop ? ' ('.$othernb.')' : '').'';
print ' | ';
print " \n";
}
@@ -219,21 +228,21 @@ if (!empty($conf->supplier_proposal->enabled) && $user->rights->supplier_proposa
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
}
if ($socid) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
$resql = $db->query($sql);
if ($resql) {
$total = 0;
$num = $db->num_rows($resql);
- $nbofloop = min($num, (empty($conf->global->MAIN_MAXLIST_OVERLOAD) ? 500 : $conf->global->MAIN_MAXLIST_OVERLOAD));
+ $nbofloop = min($num, $maxofloop);
startSimpleTable("SupplierProposalsDraft", "supplier_proposal/list.php", "search_status=".SupplierProposal::STATUS_DRAFT, 2, $num);
if ($num > 0) {
$i = 0;
$othernb = 0;
- while ($i < $num && $i < $conf->liste_limit) {
+ while ($i < $nbofloop) {
$obj = $db->fetch_object($resql);
if ($i >= $max) {
@@ -277,7 +286,7 @@ if (!empty($conf->supplier_proposal->enabled) && $user->rights->supplier_proposa
if ($othernb) {
print ' ';
print '| ';
- print ''.$langs->trans("More").'... ('.$othernb.')';
+ print ''.$langs->trans("More").'...'.($othernb < $maxofloop ? ' ('.$othernb.')' : '').'';
print ' | ';
print " \n";
}
@@ -315,21 +324,21 @@ if (!empty($conf->commande->enabled) && $user->rights->commande->lire) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
}
if ($socid) {
- $sql .= " AND c.fk_soc = ".$socid;
+ $sql .= " AND c.fk_soc = ".((int) $socid);
}
$resql = $db->query($sql);
if ($resql) {
$total = 0;
$num = $db->num_rows($resql);
- $nbofloop = min($num, (empty($conf->global->MAIN_MAXLIST_OVERLOAD) ? 500 : $conf->global->MAIN_MAXLIST_OVERLOAD));
+ $nbofloop = min($num, $maxofloop);
startSimpleTable("DraftOrders", "commande/list.php", "search_status=".Commande::STATUS_DRAFT, 2, $num);
if ($num > 0) {
$i = 0;
$othernb = 0;
- while ($i < $num && $i < $conf->liste_limit) {
+ while ($i < $nbofloop) {
$obj = $db->fetch_object($resql);
if ($i >= $max) {
@@ -374,7 +383,7 @@ if (!empty($conf->commande->enabled) && $user->rights->commande->lire) {
if ($othernb) {
print ' ';
print '| ';
- print ''.$langs->trans("More").'... ('.$othernb.')';
+ print ''.$langs->trans("More").'...'.($othernb < $maxofloop ? ' ('.$othernb.')' : '').'';
print ' | ';
print " \n";
}
@@ -419,14 +428,14 @@ if ((!empty($conf->fournisseur->enabled) && empty($conf->global->MAIN_USE_NEW_SU
if ($resql) {
$total = 0;
$num = $db->num_rows($resql);
- $nbofloop = min($num, (empty($conf->global->MAIN_MAXLIST_OVERLOAD) ? 500 : $conf->global->MAIN_MAXLIST_OVERLOAD));
+ $nbofloop = min($num, $maxofloop);
startSimpleTable("DraftSuppliersOrders", "fourn/commande/list.php", "search_status=".CommandeFournisseur::STATUS_DRAFT, 2, $num);
if ($num > 0) {
$i = 0;
$othernb = 0;
- while ($i < $num && $i < $conf->liste_limit) {
+ while ($i < $nbofloop) {
$obj = $db->fetch_object($resql);
if ($i >= $max) {
@@ -471,7 +480,7 @@ if ((!empty($conf->fournisseur->enabled) && empty($conf->global->MAIN_USE_NEW_SU
if ($othernb) {
print ' ';
print '| ';
- print ''.$langs->trans("More").'... ('.$othernb.')';
+ print ''.$langs->trans("More").'...'.($othernb < $maxofloop ? ' ('.$othernb.')' : '').'';
print ' | ';
print " \n";
}
@@ -605,7 +614,7 @@ if (((!empty($conf->fournisseur->enabled) && empty($conf->global->MAIN_USE_NEW_S
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
}
if ($socid) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
$sql .= " ORDER BY s.datec DESC";
$sql .= $db->plimit($max, 0);
@@ -711,7 +720,7 @@ if (!empty($conf->contrat->enabled) && $user->rights->contrat->lire && 0) { // T
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
}
if ($socid) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
$sql .= " ORDER BY c.tms DESC";
$sql .= $db->plimit($max + 1, 0);
@@ -786,7 +795,7 @@ if (!empty($conf->propal->enabled) && $user->rights->propal->lire) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
}
if ($socid) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
$sql .= " ORDER BY p.rowid DESC";
@@ -902,7 +911,7 @@ if (!empty($conf->commande->enabled) && $user->rights->commande->lire) {
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
}
if ($socid) {
- $sql .= " AND s.rowid = ".$socid;
+ $sql .= " AND s.rowid = ".((int) $socid);
}
$sql .= " ORDER BY c.rowid DESC";
diff --git a/htdocs/comm/mailing/advtargetemailing.php b/htdocs/comm/mailing/advtargetemailing.php
index 2487e772373..bd052f4161e 100644
--- a/htdocs/comm/mailing/advtargetemailing.php
+++ b/htdocs/comm/mailing/advtargetemailing.php
@@ -379,7 +379,7 @@ if ($action == 'deletefilter') {
if ($action == 'delete') {
// Ici, rowid indique le destinataire et id le mailing
- $sql = "DELETE FROM ".MAIN_DB_PREFIX."mailing_cibles WHERE rowid=".$rowid;
+ $sql = "DELETE FROM ".MAIN_DB_PREFIX."mailing_cibles WHERE rowid = ".((int) $rowid);
$resql = $db->query($sql);
if ($resql) {
if (!empty($id)) {
diff --git a/htdocs/comm/mailing/card.php b/htdocs/comm/mailing/card.php
index 4958811ef4d..c3ef480d2ae 100644
--- a/htdocs/comm/mailing/card.php
+++ b/htdocs/comm/mailing/card.php
@@ -308,7 +308,7 @@ if (empty($reshook)) {
dol_syslog("comm/mailing/card.php: ok for #".$i.($mail->error ? ' - '.$mail->error : ''), LOG_DEBUG);
$sql = "UPDATE ".MAIN_DB_PREFIX."mailing_cibles";
- $sql .= " SET statut=1, date_envoi='".$db->idate($now)."' WHERE rowid=".$obj->rowid;
+ $sql .= " SET statut=1, date_envoi = '".$db->idate($now)."' WHERE rowid=".((int) $obj->rowid);
$resql2 = $db->query($sql);
if (!$resql2) {
dol_print_error($db);
@@ -378,7 +378,7 @@ if (empty($reshook)) {
}
}
- $sql = "UPDATE ".MAIN_DB_PREFIX."mailing SET statut=".$statut." WHERE rowid=".$object->id;
+ $sql = "UPDATE ".MAIN_DB_PREFIX."mailing SET statut=".((int) $statut)." WHERE rowid = ".((int) $object->id);
dol_syslog("comm/mailing/card.php: update global status", LOG_DEBUG);
$resql2 = $db->query($sql);
if (!$resql2) {
diff --git a/htdocs/comm/mailing/cibles.php b/htdocs/comm/mailing/cibles.php
index d9557845492..afd6273d6c0 100644
--- a/htdocs/comm/mailing/cibles.php
+++ b/htdocs/comm/mailing/cibles.php
@@ -104,8 +104,6 @@ if ($action == 'add') {
}
if ($result > 0) {
setEventMessages($langs->trans("XTargetsAdded", $result), null, 'mesgs');
- //header("Location: ".$_SERVER['PHP_SELF']."?id=".$id);
- //exit;
$action = '';
}
if ($result == 0) {
@@ -167,7 +165,7 @@ if (GETPOST('exportcsv', 'int')) {
if ($action == 'delete') {
// Ici, rowid indique le destinataire et id le mailing
- $sql = "DELETE FROM ".MAIN_DB_PREFIX."mailing_cibles WHERE rowid=".$rowid;
+ $sql = "DELETE FROM ".MAIN_DB_PREFIX."mailing_cibles WHERE rowid = ".((int) $rowid);
$resql = $db->query($sql);
if ($resql) {
if (!empty($id)) {
diff --git a/htdocs/comm/propal/card.php b/htdocs/comm/propal/card.php
index ebca0177868..44e2ad8a4cd 100644
--- a/htdocs/comm/propal/card.php
+++ b/htdocs/comm/propal/card.php
@@ -1248,7 +1248,7 @@ if (empty($reshook)) {
if (empty($user->rights->margins->creer)) {
foreach ($object->lines as &$line) {
- if ($line->id == GETPOST('lineid')) {
+ if ($line->id == GETPOST('lineid', 'int')) {
$fournprice = $line->fk_fournprice;
$buyingprice = $line->pa_ht;
break;
@@ -2433,7 +2433,7 @@ if ($action == 'create') {
// Show object lines
$result = $object->getLinesArray();
- print ' | ';
} else {
- print ''.$objp->fk_type.' '.$objp->num_chq.' | ';
+ print ''.$objp->fk_type.' '.dol_escape_htmltag($objp->num_chq).' | ';
}
print "
";
@@ -462,7 +462,7 @@ if ($result) {
print "";
if ($user->rights->banque->modifier || $user->rights->banque->consolidate) {
print '