From 4fde184afbf566b48c2855cfd605437ff3f52782 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 20 Apr 2021 11:40:43 +0200 Subject: [PATCH 01/27] Add the setup page of module accounting to not search where is setup --- htdocs/admin/accountant.php | 2 +- htdocs/admin/accounting.php | 66 +++++++++++++++++++++ htdocs/core/modules/modAccounting.class.php | 2 +- 3 files changed, 68 insertions(+), 2 deletions(-) create mode 100644 htdocs/admin/accounting.php diff --git a/htdocs/admin/accountant.php b/htdocs/admin/accountant.php index 3ed43f1664f..56c9605c460 100644 --- a/htdocs/admin/accountant.php +++ b/htdocs/admin/accountant.php @@ -17,7 +17,7 @@ /** * \file htdocs/admin/accountant.php - * \ingroup accountant + * \ingroup core * \brief Setup page to configure accountant / auditor */ diff --git a/htdocs/admin/accounting.php b/htdocs/admin/accounting.php new file mode 100644 index 00000000000..b32ce06ad22 --- /dev/null +++ b/htdocs/admin/accounting.php @@ -0,0 +1,66 @@ + + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ + +/** + * \file htdocs/admin/accounting.php + * \ingroup accounting + * \brief Setup page to configure accountanting module + */ + +require '../main.inc.php'; +require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php'; +require_once DOL_DOCUMENT_ROOT.'/core/lib/company.lib.php'; +require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php'; +require_once DOL_DOCUMENT_ROOT.'/core/class/html.formother.class.php'; +require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php'; + +$action = GETPOST('action', 'aZ09'); +$contextpage = GETPOST('contextpage', 'aZ') ?GETPOST('contextpage', 'aZ') : 'adminaccoutant'; // To manage different context of search + +// Load translation files required by the page +$langs->loadLangs(array('admin', 'companies')); + +if (!$user->admin) { + accessforbidden(); +} + +$error = 0; + + +/* + * Actions + */ + +// Nothing + + +/* + * View + */ + +$help_url = ''; +llxHeader('', $langs->trans("ConfigAccountingExpert"), $help_url); + +print load_fiche_titre($langs->trans("ConfigAccountingExpert"), '', 'title_setup'); + +print "
\n"; +print ''.$langs->trans("AccountancySetupDoneFromAccountancyMenu", $langs->transnoentitiesnoconv("Accounting").' - '.$langs->transnoentitiesnoconv("Setup"))."
\n"; +print "
\n"; + +llxFooter(); + +$db->close(); diff --git a/htdocs/core/modules/modAccounting.class.php b/htdocs/core/modules/modAccounting.class.php index b4645b51a87..7b289c74253 100644 --- a/htdocs/core/modules/modAccounting.class.php +++ b/htdocs/core/modules/modAccounting.class.php @@ -60,7 +60,7 @@ class modAccounting extends DolibarrModules $this->dirs = array('/accounting/temp'); // Config pages - $this->config_page_url = array(); + $this->config_page_url = array('accounting.php'); // Dependencies $this->depends = array("modFacture", "modBanque", "modTax"); // List of modules id that must be enabled if this module is enabled From f1f63cd4e2f22ab338abcca862193d276e12306a Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 20 Apr 2021 11:56:26 +0200 Subject: [PATCH 02/27] Enhance detection of update available --- htdocs/admin/accounting.php | 4 +++- htdocs/admin/modules.php | 14 ++++++++++++-- htdocs/core/modules/DolibarrModules.class.php | 4 ++-- htdocs/langs/en_US/admin.lang | 7 ++++--- 4 files changed, 21 insertions(+), 8 deletions(-) diff --git a/htdocs/admin/accounting.php b/htdocs/admin/accounting.php index b32ce06ad22..e775f5bd8e3 100644 --- a/htdocs/admin/accounting.php +++ b/htdocs/admin/accounting.php @@ -55,7 +55,9 @@ $error = 0; $help_url = ''; llxHeader('', $langs->trans("ConfigAccountingExpert"), $help_url); -print load_fiche_titre($langs->trans("ConfigAccountingExpert"), '', 'title_setup'); +$linkback = ''.$langs->trans("BackToModuleList").''; + +print load_fiche_titre($langs->trans("ConfigAccountingExpert"), $linkback, 'title_setup'); print "
\n"; print ''.$langs->trans("AccountancySetupDoneFromAccountancyMenu", $langs->transnoentitiesnoconv("Accounting").' - '.$langs->transnoentitiesnoconv("Setup"))."
\n"; diff --git a/htdocs/admin/modules.php b/htdocs/admin/modules.php index 84bf924139c..142d5accb0f 100644 --- a/htdocs/admin/modules.php +++ b/htdocs/admin/modules.php @@ -521,8 +521,8 @@ if ($mode == 'common' || $mode == 'commonkanban') { $moreforfilter = '
'; $moreforfilter .= ''; @@ -584,6 +584,7 @@ if ($mode == 'common' || $mode == 'commonkanban') { // Show list of modules $oldfamily = ''; + $foundoneexternalmodulewithupdate = 0; $linenum = 0; foreach ($orders as $key => $value) { $linenum++; @@ -915,6 +916,7 @@ if ($mode == 'common' || $mode == 'commonkanban') { if ($objMod->needUpdate) { $versionTitle = $langs->trans('ModuleUpdateAvailable').' : '.$objMod->lastVersion; print ''.$versiontrans.''; + $foundoneexternalmodulewithupdate++; } else { print $versiontrans; } @@ -934,6 +936,14 @@ if ($mode == 'common' || $mode == 'commonkanban') { } } + if ($action == 'checklastversion') { + if ($foundoneexternalmodulewithupdate) { + setEventMessages($langs->trans("ModuleUpdateAvailable"), null, 'mesgs'); + } else { + setEventMessages($langs->trans("NoExternalModuleWithUpdate"), null, 'mesgs'); + } + } + if ($oldfamily) { if ($mode == 'commonkanban') { print '
'; diff --git a/htdocs/core/modules/DolibarrModules.class.php b/htdocs/core/modules/DolibarrModules.class.php index 056be705f9e..30ee2bb72be 100644 --- a/htdocs/core/modules/DolibarrModules.class.php +++ b/htdocs/core/modules/DolibarrModules.class.php @@ -2310,9 +2310,9 @@ class DolibarrModules // Can not be abstract, because we need to instantiate it } /** - * check for module update + * Check for module update * TODO : store results for $this->url_last_version and $this->needUpdate - * Add a cron task to monitor for updates + * Add a cron task to monitor for updates * * @return int <0 if Error, 0 == no update needed, >0 if need update */ diff --git a/htdocs/langs/en_US/admin.lang b/htdocs/langs/en_US/admin.lang index 1d6e5f0d502..6a11c26c50c 100644 --- a/htdocs/langs/en_US/admin.lang +++ b/htdocs/langs/en_US/admin.lang @@ -2122,7 +2122,8 @@ IfCLINotRequiredYouShouldDisablePHPFunctions=Except if you need to run system co NoWritableFilesFoundIntoRootDir=No writable files or directories of the common programs were found into your root directory (Good) RecommendedValueIs=Recommended: %s ARestrictedPath=A restricted path -CheckForModuleUpdate=Check for modules updates -CheckForModuleUpdateHelp=Check for modules updates.
This action will connect to modules editors to check if a new version is available. -ModuleUpdateAvailable=An update is available for this module +CheckForModuleUpdate=Check for external modules updates +CheckForModuleUpdateHelp=This action will connect to editors of external modules to check if a new version is available. +ModuleUpdateAvailable=An update is available +NoExternalModuleWithUpdate=No updates found for external modules SwaggerDescriptionFile=Swagger API description file (for use with redoc for example) From 455d5233e66b13a2e83ed5cd310edff47c4df699 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 20 Apr 2021 11:58:51 +0200 Subject: [PATCH 03/27] Fix trans --- htdocs/langs/ja_JP/margins.lang | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/langs/ja_JP/margins.lang b/htdocs/langs/ja_JP/margins.lang index df1542aa7a7..8303105bb25 100644 --- a/htdocs/langs/ja_JP/margins.lang +++ b/htdocs/langs/ja_JP/margins.lang @@ -22,7 +22,7 @@ ProductService=製品やサービス AllProducts=すべての製品とサービス ChooseProduct/Service=製品またはサービスを選択すること ForceBuyingPriceIfNull=定義されていない場合、購入/原価を販売価格に強制する -ForceBuyingPriceIfNullDetails=新規行を追加するときに購入/原価が提供されておらず、このオプションが「オン」の場合、新規行のマージンは0になる（購入/原価=販売価格）。このオプションが「オフ」（推奨）の場合、マージンはデフォルトで提案されている値と等しくなる（デフォルト値が見つからない場合は100％になる可能性がある）。 +ForceBuyingPriceIfNullDetails=新規行を追加するときに購入/原価が提供されておらず、このオプションが「オン」の場合、新規行のマージンは0になる（購入/原価=販売価格）。このオプションが「オフ」（推奨）の場合、マージンはデフォルトで提案されている値と等しくなる（デフォルト値が見つからない場合は100%%になる可能性がある）。 MARGIN_METHODE_FOR_DISCOUNT=グローバル割引の利益方式 UseDiscountAsProduct=製品として UseDiscountAsService=サービスとして From 14f009f5500d07a8f88ebc37cd50b90e44688564 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 20 Apr 2021 12:19:46 +0200 Subject: [PATCH 04/27] Fix CURLOPT_CONNECT_TO --- htdocs/core/lib/geturl.lib.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/htdocs/core/lib/geturl.lib.php b/htdocs/core/lib/geturl.lib.php index 0d729e6c762..66300a1948b 100644 --- a/htdocs/core/lib/geturl.lib.php +++ b/htdocs/core/lib/geturl.lib.php @@ -179,7 +179,6 @@ function getURLContent($url, $postorget = 'GET', $param = '', $followlocation = $iptocheck = '0'; // } - //var_dump($_SERVER); if ($iptocheck) { if ($localurl == 0) { // Only external url allowed (dangerous, may allow to get malware) if (!filter_var($iptocheck, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) { @@ -219,7 +218,10 @@ function getURLContent($url, $postorget = 'GET', $param = '', $followlocation = // Set CURLOPT_CONNECT_TO so curl will not try another resolution that may give a different result. Possible only on PHP v7+ if (defined('CURLOPT_CONNECT_TO')) { - curl_setopt($ch, CURLOPT_CONNECT_TO, $iptocheck); + $connect_to = array(sprintf("%s:%d:%s:%d", $newUrlArray['host'], $newUrlArray['port'], $iptocheck, $newUrlArray['port'])); + //var_dump($newUrlArray); + //var_dump($connect_to); + curl_setopt($ch, CURLOPT_CONNECT_TO, $connect_to); } } From db5fb42c11e75c887d807f3ecbba8c61e4abce6f Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 20 Apr 2021 12:27:00 +0200 Subject: [PATCH 05/27] css --- htdocs/admin/translation.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/htdocs/admin/translation.php b/htdocs/admin/translation.php index 315673f1582..f5ab2af51e3 100644 --- a/htdocs/admin/translation.php +++ b/htdocs/admin/translation.php @@ -289,7 +289,7 @@ if ($mode == 'overwrite') { print "\n"; print ''; - print $formadmin->select_language(GETPOST('langcode'), 'langcode', 0, null, 1, 0, $disablededit ? 1 : 0, 'maxwidthonsmartphone', 1); + print $formadmin->select_language(GETPOST('langcode'), 'langcode', 0, null, 1, 0, $disablededit ? 1 : 0, 'maxwidth250', 1); print ''."\n"; print ''; print ''; @@ -338,7 +338,7 @@ if ($mode == 'overwrite') { print ''.$obj->transkey.''."\n"; // Value - print ''; + print ''; /*print ''; print ''; print ''; @@ -482,7 +482,7 @@ if ($mode == 'searchkey') { print ''; //print $formadmin->select_language($langcode,'langcode',0,null,$langs->trans("All"),0,0,'',1); - print $formadmin->select_language($langcode, 'langcode', 0, null, 0, 0, 0, 'maxwidthonsmartphone', 1); + print $formadmin->select_language($langcode, 'langcode', 0, null, 0, 0, 0, 'maxwidth250', 1); print ''."\n"; print ''; print ''; @@ -529,7 +529,7 @@ if ($mode == 'searchkey') { if ($i > ($offset + $limit)) { break; } - print ''.$langcode.''.$key.''; + print ''.$langcode.''.$key.''; print dol_escape_htmltag($val); print ''; if (!empty($newlangfileonly->tab_translate[$key])) { From 1bd2bd3237a9ce17e1673367421c8511cc2d5c2c Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 20 Apr 2021 12:46:41 +0200 Subject: [PATCH 06/27] Fix php8 warning --- htdocs/core/lib/geturl.lib.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/core/lib/geturl.lib.php b/htdocs/core/lib/geturl.lib.php index 66300a1948b..ff63ca251c3 100644 --- a/htdocs/core/lib/geturl.lib.php +++ b/htdocs/core/lib/geturl.lib.php @@ -187,7 +187,7 @@ function getURLContent($url, $postorget = 'GET', $param = '', $followlocation = $info['content'] = 'Error bad hostname IP (private or reserved range). Must be an external URL.'; break; } - if ($iptocheck == $_SERVER["SERVER_ADDR"]) { + if (!empty($_SERVER["SERVER_ADDR"]) && $iptocheck == $_SERVER["SERVER_ADDR"]) { $info['http_code'] = 400; $info['content'] = 'Error bad hostname IP (IP is a local IP). Must be an external URL.'; break; From 4180a9ef62b6840450852fe85800023b01aeb260 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 20 Apr 2021 13:30:18 +0200 Subject: [PATCH 07/27] FIX pb when saving some export profiles --- htdocs/install/mysql/migration/13.0.0-14.0.0.sql | 2 ++ htdocs/install/mysql/tables/llx_export_model.sql | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/htdocs/install/mysql/migration/13.0.0-14.0.0.sql b/htdocs/install/mysql/migration/13.0.0-14.0.0.sql index 3f17d23b51f..faf194e6920 100644 --- a/htdocs/install/mysql/migration/13.0.0-14.0.0.sql +++ b/htdocs/install/mysql/migration/13.0.0-14.0.0.sql @@ -48,6 +48,8 @@ UPDATE llx_c_country SET eec = 1 WHERE code IN ('AT','BE','BG','CY','CZ','DE','D -- For v14 +ALTER TABLE llx_export_model MODIFY COLUMN type varchar(64); + create table llx_accounting_groups_account ( rowid integer AUTO_INCREMENT PRIMARY KEY, diff --git a/htdocs/install/mysql/tables/llx_export_model.sql b/htdocs/install/mysql/tables/llx_export_model.sql index 53952430c14..7e68eab4ad5 100644 --- a/htdocs/install/mysql/tables/llx_export_model.sql +++ b/htdocs/install/mysql/tables/llx_export_model.sql @@ -24,7 +24,7 @@ create table llx_export_model rowid integer AUTO_INCREMENT PRIMARY KEY, fk_user integer DEFAULT 0 NOT NULL, label varchar(50) NOT NULL, - type varchar(20) NOT NULL, + type varchar(64) NOT NULL, field text NOT NULL, filter text From d0cc64479d6986e62e29013dde7c42acae472eeb Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sat, 24 Apr 2021 20:18:11 +0200 Subject: [PATCH 08/27] Fix protect sql --- htdocs/accountancy/admin/accountmodel.php | 2 +- htdocs/accountancy/bookkeeping/card.php | 2 +- .../class/accountancycategory.class.php | 10 +++++----- .../class/accountingaccount.class.php | 4 ++-- htdocs/accountancy/class/bookkeeping.class.php | 4 ++-- htdocs/accountancy/customer/index.php | 4 ++-- htdocs/accountancy/expensereport/index.php | 4 ++-- htdocs/accountancy/journal/bankjournal.php | 16 ++++++++-------- htdocs/accountancy/supplier/index.php | 4 ++-- htdocs/adherents/class/adherent.class.php | 4 ++-- htdocs/adherents/class/adherent_type.class.php | 2 +- htdocs/adherents/class/subscription.class.php | 2 +- htdocs/adherents/list.php | 2 +- htdocs/adherents/subscription.php | 2 +- htdocs/adherents/subscription/list.php | 2 +- htdocs/adherents/type.php | 2 +- htdocs/admin/boxes.php | 4 ++-- htdocs/admin/dict.php | 2 +- htdocs/admin/external_rss.php | 2 +- htdocs/admin/security.php | 2 +- htdocs/asset/class/asset_type.class.php | 2 +- htdocs/blockedlog/class/authority.class.php | 2 +- htdocs/bookmarks/class/bookmark.class.php | 2 +- htdocs/categories/class/categorie.class.php | 2 +- htdocs/comm/action/class/actioncomm.class.php | 2 +- htdocs/comm/action/index.php | 2 +- htdocs/comm/action/pertype.php | 2 +- htdocs/comm/action/peruser.php | 2 +- htdocs/comm/index.php | 10 +++++----- htdocs/comm/mailing/advtargetemailing.php | 2 +- htdocs/comm/mailing/cibles.php | 2 +- htdocs/comm/propal/class/propal.class.php | 2 +- htdocs/comm/prospect/index.php | 2 +- htdocs/commande/class/commande.class.php | 4 ++-- htdocs/commande/customer.php | 2 +- htdocs/compta/bank/class/account.class.php | 7 ++++--- htdocs/compta/bank/line.php | 2 +- htdocs/compta/cashcontrol/report.php | 2 +- htdocs/compta/clients.php | 2 +- htdocs/compta/facture/class/facture.class.php | 2 +- .../prelevement/class/bonprelevement.class.php | 2 +- .../prelevement/class/ligneprelevement.class.php | 2 +- htdocs/compta/prelevement/list.php | 2 +- htdocs/compta/prelevement/rejets.php | 2 +- .../sociales/class/chargesociales.class.php | 2 +- htdocs/compta/sociales/list.php | 2 +- htdocs/contact/list.php | 2 +- htdocs/contrat/index.php | 10 +++++----- htdocs/contrat/services_list.php | 2 +- htdocs/core/class/commoninvoice.class.php | 4 ++-- htdocs/core/class/commonobject.class.php | 4 ++-- htdocs/core/lib/company.lib.php | 6 +++--- .../movement/doc/pdf_standard.modules.php | 2 +- htdocs/core/website.inc.php | 2 +- htdocs/don/class/don.class.php | 2 +- htdocs/expedition/class/expedition.class.php | 8 ++++---- htdocs/fichinter/card-rec.php | 2 +- htdocs/fichinter/class/fichinter.class.php | 2 +- htdocs/fichinter/list.php | 2 +- .../fourn/class/fournisseur.commande.class.php | 2 +- htdocs/loan/list.php | 2 +- htdocs/mrp/mo_movements.php | 2 +- htdocs/product/class/product.class.php | 4 ++-- htdocs/product/stock/stockatdate.php | 2 +- htdocs/projet/list.php | 2 +- htdocs/reception/class/reception.class.php | 4 ++-- htdocs/societe/index.php | 2 +- .../class/supplier_proposal.class.php | 2 +- htdocs/supplier_proposal/index.php | 2 +- htdocs/user/class/usergroup.class.php | 2 +- 70 files changed, 109 insertions(+), 108 deletions(-) diff --git a/htdocs/accountancy/admin/accountmodel.php b/htdocs/accountancy/admin/accountmodel.php index 7c05a9a0da4..f0fd9702009 100644 --- a/htdocs/accountancy/admin/accountmodel.php +++ b/htdocs/accountancy/admin/accountmodel.php @@ -442,7 +442,7 @@ if ($id) { } else { $sql .= " WHERE "; } - $sql .= " c.rowid = ".$search_country_id; + $sql .= " c.rowid = ".((int) $search_country_id); } // If sort order is "country", we use country_code instead diff --git a/htdocs/accountancy/bookkeeping/card.php b/htdocs/accountancy/bookkeeping/card.php index e3cac139c08..f91b1821df4 100644 --- a/htdocs/accountancy/bookkeeping/card.php +++ b/htdocs/accountancy/bookkeeping/card.php @@ -563,7 +563,7 @@ if ($action == 'create') { { $sqlmid = 'SELECT rowid as ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."facture as fac"; - $sqlmid .= " WHERE fac.rowid=" . $object->fk_doc; + $sqlmid .= " WHERE fac.rowid=" . ((int) $object->fk_doc); dol_syslog("accountancy/bookkeeping/card.php::sqlmid=" . $sqlmid, LOG_DEBUG); $resultmid = $db->query($sqlmid); if ($resultmid) { diff --git a/htdocs/accountancy/class/accountancycategory.class.php b/htdocs/accountancy/class/accountancycategory.class.php index 9550933f2d8..d8e1598d1ac 100644 --- a/htdocs/accountancy/class/accountancycategory.class.php +++ b/htdocs/accountancy/class/accountancycategory.class.php @@ -473,7 +473,7 @@ class AccountancyCategory // extends CommonObject $sql .= " SELECT DISTINCT aa.account_number"; $sql .= " FROM ".MAIN_DB_PREFIX."accounting_account as aa"; $sql .= " INNER JOIN ".MAIN_DB_PREFIX."accounting_system as asy ON aa.fk_pcg_version = asy.pcg_version"; - $sql .= " AND asy.rowid = ".$conf->global->CHARTOFACCOUNTS; + $sql .= " AND asy.rowid = ".((int) $conf->global->CHARTOFACCOUNTS); $sql .= " AND aa.active = 1"; $sql .= " AND aa.entity = ".$conf->entity.")"; $sql .= " GROUP BY t.numero_compte, t.label_operation, t.doc_ref"; @@ -562,7 +562,7 @@ class AccountancyCategory // extends CommonObject $sql = "SELECT aa.rowid, aa.account_number"; $sql .= " FROM ".MAIN_DB_PREFIX."accounting_account as aa"; $sql .= " INNER JOIN ".MAIN_DB_PREFIX."accounting_system as asy ON aa.fk_pcg_version = asy.pcg_version"; - $sql .= " AND asy.rowid = ".$conf->global->CHARTOFACCOUNTS; + $sql .= " AND asy.rowid = ".((int) $conf->global->CHARTOFACCOUNTS); $sql .= " AND aa.active = 1"; $sql .= " AND aa.entity = ".$conf->entity; $sql .= " ORDER BY LENGTH(aa.account_number) DESC;"; // LENGTH is ok with mysql and postgresql @@ -589,8 +589,8 @@ class AccountancyCategory // extends CommonObject $accountincptsadded[$account_number_formated] = 1; // We found an account number that is in list $cpts of account to add $sql = "UPDATE ".MAIN_DB_PREFIX."accounting_account"; - $sql .= " SET fk_accounting_category=".$id_cat; - $sql .= " WHERE rowid=".$obj->rowid; + $sql .= " SET fk_accounting_category=".((int) $id_cat); + $sql .= " WHERE rowid=".((int) $obj->rowid); dol_syslog(__METHOD__, LOG_DEBUG); $resqlupdate = $this->db->query($sql); if (!$resqlupdate) { @@ -629,7 +629,7 @@ class AccountancyCategory // extends CommonObject $sql = "UPDATE ".MAIN_DB_PREFIX."accounting_account as aa"; $sql .= " SET fk_accounting_category= 0"; - $sql .= " WHERE aa.rowid= ".$cpt_id; + $sql .= " WHERE aa.rowid = ".((int) $cpt_id); $this->db->begin(); dol_syslog(__METHOD__." sql=".$sql, LOG_DEBUG); diff --git a/htdocs/accountancy/class/accountingaccount.class.php b/htdocs/accountancy/class/accountingaccount.class.php index a7d89c45294..28601380ac1 100644 --- a/htdocs/accountancy/class/accountingaccount.class.php +++ b/htdocs/accountancy/class/accountingaccount.class.php @@ -347,10 +347,10 @@ class AccountingAccount extends CommonObject $sql .= " , label = ".($this->label ? "'".$this->db->escape($this->label)."'" : "''"); $sql .= " , labelshort = ".($this->labelshort ? "'".$this->db->escape($this->labelshort)."'" : "''"); $sql .= " , fk_accounting_category = ".(empty($this->account_category) ? 0 : (int) $this->account_category); - $sql .= " , fk_user_modif = ".$user->id; + $sql .= " , fk_user_modif = ".((int) $user->id); $sql .= " , active = ".(int) $this->active; $sql .= " , reconcilable = ".(int) $this->reconcilable; - $sql .= " WHERE rowid = ".$this->id; + $sql .= " WHERE rowid = ".((int) $this->id); dol_syslog(get_class($this)."::update sql=".$sql, LOG_DEBUG); $result = $this->db->query($sql); diff --git a/htdocs/accountancy/class/bookkeeping.class.php b/htdocs/accountancy/class/bookkeeping.class.php index 6220904dbe8..00ed8879076 100644 --- a/htdocs/accountancy/class/bookkeeping.class.php +++ b/htdocs/accountancy/class/bookkeeping.class.php @@ -1860,7 +1860,7 @@ class BookKeeping extends CommonObject $sql .= " LEFT JOIN " . MAIN_DB_PREFIX . "accounting_account as aa ON aa.account_number = ab.numero_compte"; $sql .= " AND aa.active = 1"; $sql .= " INNER JOIN " . MAIN_DB_PREFIX . "accounting_system as asy ON aa.fk_pcg_version = asy.pcg_version"; - $sql .= " AND asy.rowid = " . $pcgver; + $sql .= " AND asy.rowid = " . ((int) $pcgver); $sql .= " AND ab.entity IN (" . getEntity('accountancy') . ")"; $sql .= " ORDER BY account_number ASC"; */ @@ -1893,7 +1893,7 @@ class BookKeeping extends CommonObject $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa ON aa.account_number = ab.numero_compte"; $sql .= " AND aa.active = 1"; $sql .= " INNER JOIN ".MAIN_DB_PREFIX."accounting_system as asy ON aa.fk_pcg_version = asy.pcg_version"; - $sql .= " AND asy.rowid = ".$pcgver; + $sql .= " AND asy.rowid = ".((int) $pcgver); $sql .= " AND ab.entity IN (".getEntity('accountancy').")"; $sql .= " ORDER BY account_number ASC"; diff --git a/htdocs/accountancy/customer/index.php b/htdocs/accountancy/customer/index.php index 0b32e2802c4..43daa2efa88 100644 --- a/htdocs/accountancy/customer/index.php +++ b/htdocs/accountancy/customer/index.php @@ -110,13 +110,13 @@ if ($action == 'validatehistory') { $sql1 = "UPDATE " . MAIN_DB_PREFIX . "facturedet"; $sql1 .= " SET fk_code_ventilation = accnt.rowid"; $sql1 .= " FROM " . MAIN_DB_PREFIX . "product as p, " . MAIN_DB_PREFIX . "accounting_account as accnt , " . MAIN_DB_PREFIX . "accounting_system as syst"; - $sql1 .= " WHERE " . MAIN_DB_PREFIX . "facturedet.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . $conf->global->CHARTOFACCOUNTS.' AND accnt.entity = '.$conf->entity; + $sql1 .= " WHERE " . MAIN_DB_PREFIX . "facturedet.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . ((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.$conf->entity; $sql1 .= " AND accnt.active = 1 AND p.accountancy_code_sell=accnt.account_number"; $sql1 .= " AND " . MAIN_DB_PREFIX . "facturedet.fk_code_ventilation = 0"; } else { $sql1 = "UPDATE " . MAIN_DB_PREFIX . "facturedet as fd, " . MAIN_DB_PREFIX . "product as p, " . MAIN_DB_PREFIX . "accounting_account as accnt , " . MAIN_DB_PREFIX . "accounting_system as syst"; $sql1 .= " SET fk_code_ventilation = accnt.rowid"; - $sql1 .= " WHERE fd.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . $conf->global->CHARTOFACCOUNTS.' AND accnt.entity = '.$conf->entity; + $sql1 .= " WHERE fd.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . ((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.$conf->entity; $sql1 .= " AND accnt.active = 1 AND p.accountancy_code_sell=accnt.account_number"; $sql1 .= " AND fd.fk_code_ventilation = 0"; }*/ diff --git a/htdocs/accountancy/expensereport/index.php b/htdocs/accountancy/expensereport/index.php index 38f7f596932..b4e85fd517a 100644 --- a/htdocs/accountancy/expensereport/index.php +++ b/htdocs/accountancy/expensereport/index.php @@ -103,13 +103,13 @@ if ($action == 'validatehistory') { $sql1 = "UPDATE ".MAIN_DB_PREFIX."expensereport_det"; $sql1 .= " SET fk_code_ventilation = accnt.rowid"; $sql1 .= " FROM ".MAIN_DB_PREFIX."c_type_fees as t, ".MAIN_DB_PREFIX."accounting_account as accnt , ".MAIN_DB_PREFIX."accounting_system as syst"; - $sql1 .= " WHERE ".MAIN_DB_PREFIX."expensereport_det.fk_c_type_fees = t.id AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=".$conf->global->CHARTOFACCOUNTS.' AND accnt.entity = '.$conf->entity; + $sql1 .= " WHERE ".MAIN_DB_PREFIX."expensereport_det.fk_c_type_fees = t.id AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid = ".((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.$conf->entity; $sql1 .= " AND accnt.active = 1 AND t.accountancy_code = accnt.account_number"; $sql1 .= " AND ".MAIN_DB_PREFIX."expensereport_det.fk_code_ventilation = 0"; } else { $sql1 = "UPDATE ".MAIN_DB_PREFIX."expensereport_det as erd, ".MAIN_DB_PREFIX."c_type_fees as t, ".MAIN_DB_PREFIX."accounting_account as accnt , ".MAIN_DB_PREFIX."accounting_system as syst"; $sql1 .= " SET erd.fk_code_ventilation = accnt.rowid"; - $sql1 .= " WHERE erd.fk_c_type_fees = t.id AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=".$conf->global->CHARTOFACCOUNTS.' AND accnt.entity = '.$conf->entity; + $sql1 .= " WHERE erd.fk_c_type_fees = t.id AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid = ".((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.$conf->entity; $sql1 .= " AND accnt.active = 1 AND t.accountancy_code=accnt.account_number"; $sql1 .= " AND erd.fk_code_ventilation = 0"; } diff --git a/htdocs/accountancy/journal/bankjournal.php b/htdocs/accountancy/journal/bankjournal.php index 27b37c74932..741b2c9f038 100644 --- a/htdocs/accountancy/journal/bankjournal.php +++ b/htdocs/accountancy/journal/bankjournal.php @@ -1323,42 +1323,42 @@ function getSourceDocRef($val, $typerecord) } elseif ($typerecord == 'payment_supplier') { $sqlmid = 'SELECT payfac.fk_facturefourn as id, f.ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."paiementfourn_facturefourn as payfac, ".MAIN_DB_PREFIX."facture_fourn as f"; - $sqlmid .= " WHERE payfac.fk_facturefourn = f.rowid AND payfac.fk_paiementfourn=".$val["paymentsupplierid"]; + $sqlmid .= " WHERE payfac.fk_facturefourn = f.rowid AND payfac.fk_paiementfourn=".((int) $val["paymentsupplierid"]); $ref = $langs->transnoentitiesnoconv("SupplierInvoice"); } elseif ($typerecord == 'payment_expensereport') { $sqlmid = 'SELECT e.rowid as id, e.ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."payment_expensereport as pe, ".MAIN_DB_PREFIX."expensereport as e"; - $sqlmid .= " WHERE pe.rowid=".$val["paymentexpensereport"]." AND pe.fk_expensereport = e.rowid"; + $sqlmid .= " WHERE pe.rowid=".((int) $val["paymentexpensereport"])." AND pe.fk_expensereport = e.rowid"; $ref = $langs->transnoentitiesnoconv("ExpenseReport"); } elseif ($typerecord == 'payment_salary') { $sqlmid = 'SELECT s.rowid as ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."payment_salary as s"; - $sqlmid .= " WHERE s.rowid=".$val["paymentsalid"]; + $sqlmid .= " WHERE s.rowid=".((int) $val["paymentsalid"]); $ref = $langs->transnoentitiesnoconv("SalaryPayment"); } elseif ($typerecord == 'sc') { $sqlmid = 'SELECT sc.rowid as ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."paiementcharge as sc"; - $sqlmid .= " WHERE sc.rowid=".$val["paymentscid"]; + $sqlmid .= " WHERE sc.rowid=".((int) $val["paymentscid"]); $ref = $langs->transnoentitiesnoconv("SocialContribution"); } elseif ($typerecord == 'payment_vat') { $sqlmid = 'SELECT v.rowid as ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."tva as v"; - $sqlmid .= " WHERE v.rowid=".$val["paymentvatid"]; + $sqlmid .= " WHERE v.rowid=".((int) $val["paymentvatid"]); $ref = $langs->transnoentitiesnoconv("PaymentVat"); } elseif ($typerecord == 'payment_donation') { $sqlmid = 'SELECT payd.fk_donation as ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."payment_donation as payd"; - $sqlmid .= " WHERE payd.fk_donation=".$val["paymentdonationid"]; + $sqlmid .= " WHERE payd.fk_donation=".((int) $val["paymentdonationid"]); $ref = $langs->transnoentitiesnoconv("Donation"); } elseif ($typerecord == 'payment_loan') { $sqlmid = 'SELECT l.rowid as ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."payment_loan as l"; - $sqlmid .= " WHERE l.rowid=".$val["paymentloanid"]; + $sqlmid .= " WHERE l.rowid=".((int) $val["paymentloanid"]); $ref = $langs->transnoentitiesnoconv("LoanPayment"); } elseif ($typerecord == 'payment_various') { $sqlmid = 'SELECT v.rowid as ref'; $sqlmid .= " FROM ".MAIN_DB_PREFIX."payment_various as v"; - $sqlmid .= " WHERE v.rowid=".$val["paymentvariousid"]; + $sqlmid .= " WHERE v.rowid=".((int) $val["paymentvariousid"]); $ref = $langs->transnoentitiesnoconv("VariousPayment"); } // Add warning diff --git a/htdocs/accountancy/supplier/index.php b/htdocs/accountancy/supplier/index.php index 392551708de..91dd921f1fa 100644 --- a/htdocs/accountancy/supplier/index.php +++ b/htdocs/accountancy/supplier/index.php @@ -118,13 +118,13 @@ if ($action == 'validatehistory') { $sql1 = "UPDATE " . MAIN_DB_PREFIX . "facture_fourn_det"; $sql1 .= " SET fk_code_ventilation = accnt.rowid"; $sql1 .= " FROM " . MAIN_DB_PREFIX . "product as p, " . MAIN_DB_PREFIX . "accounting_account as accnt , " . MAIN_DB_PREFIX . "accounting_system as syst"; - $sql1 .= " WHERE " . MAIN_DB_PREFIX . "facture_fourn_det.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . $conf->global->CHARTOFACCOUNTS.' AND accnt.entity = '.$conf->entity; + $sql1 .= " WHERE " . MAIN_DB_PREFIX . "facture_fourn_det.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . ((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.$conf->entity; $sql1 .= " AND accnt.active = 1 AND p.accountancy_code_buy=accnt.account_number"; $sql1 .= " AND " . MAIN_DB_PREFIX . "facture_fourn_det.fk_code_ventilation = 0"; } else { $sql1 = "UPDATE " . MAIN_DB_PREFIX . "facture_fourn_det as fd, " . MAIN_DB_PREFIX . "product as p, " . MAIN_DB_PREFIX . "accounting_account as accnt , " . MAIN_DB_PREFIX . "accounting_system as syst"; $sql1 .= " SET fk_code_ventilation = accnt.rowid"; - $sql1 .= " WHERE fd.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . $conf->global->CHARTOFACCOUNTS.' AND accnt.entity = '.$conf->entity; + $sql1 .= " WHERE fd.fk_product = p.rowid AND accnt.fk_pcg_version = syst.pcg_version AND syst.rowid=" . ((int) $conf->global->CHARTOFACCOUNTS).' AND accnt.entity = '.$conf->entity; $sql1 .= " AND accnt.active = 1 AND p.accountancy_code_buy=accnt.account_number"; $sql1 .= " AND fd.fk_code_ventilation = 0"; }*/ diff --git a/htdocs/adherents/class/adherent.class.php b/htdocs/adherents/class/adherent.class.php index 0299b32663c..d7dbeb9eb13 100644 --- a/htdocs/adherents/class/adherent.class.php +++ b/htdocs/adherents/class/adherent.class.php @@ -1597,8 +1597,8 @@ class Adherent extends CommonObject $inserturlid = $acct->add_url_line($insertid, $this->id, DOL_URL_ROOT.'/adherents/card.php?rowid=', $this->getFullname($langs), 'member'); if ($inserturlid > 0) { // Update table subscription - $sql = "UPDATE ".MAIN_DB_PREFIX."subscription SET fk_bank=".$insertid; - $sql .= " WHERE rowid=".$subscriptionid; + $sql = "UPDATE ".MAIN_DB_PREFIX."subscription SET fk_bank=".((int) $insertid); + $sql .= " WHERE rowid=".((int) $subscriptionid); dol_syslog("subscription::subscription", LOG_DEBUG); $resql = $this->db->query($sql); diff --git a/htdocs/adherents/class/adherent_type.class.php b/htdocs/adherents/class/adherent_type.class.php index b2f181e59be..d051c40810b 100644 --- a/htdocs/adherents/class/adherent_type.class.php +++ b/htdocs/adherents/class/adherent_type.class.php @@ -365,7 +365,7 @@ class AdherentType extends CommonObject $sql .= "note = '".$this->db->escape($this->note)."',"; $sql .= "vote = ".(integer) $this->db->escape($this->vote).","; $sql .= "mail_valid = '".$this->db->escape($this->mail_valid)."'"; - $sql .= " WHERE rowid =".$this->id; + $sql .= " WHERE rowid =".((int) $this->id); $result = $this->db->query($sql); if ($result) { diff --git a/htdocs/adherents/class/subscription.class.php b/htdocs/adherents/class/subscription.class.php index 65b01991100..95bbe79804f 100644 --- a/htdocs/adherents/class/subscription.class.php +++ b/htdocs/adherents/class/subscription.class.php @@ -217,7 +217,7 @@ class Subscription extends CommonObject $sql .= " datef,"; $sql .= " subscription, note, fk_bank"; $sql .= " FROM ".MAIN_DB_PREFIX."subscription"; - $sql .= " WHERE rowid=".$rowid; + $sql .= " WHERE rowid=".((int) $rowid); dol_syslog(get_class($this)."::fetch", LOG_DEBUG); $resql = $this->db->query($sql); diff --git a/htdocs/adherents/list.php b/htdocs/adherents/list.php index 9560a284e2a..b713362912e 100644 --- a/htdocs/adherents/list.php +++ b/htdocs/adherents/list.php @@ -318,7 +318,7 @@ if ($sall) { $sql .= natural_search(array_keys($fieldstosearchall), $sall); } if ($search_type > 0) { - $sql .= " AND t.rowid=".$db->escape($search_type); + $sql .= " AND t.rowid=".((int) $search_type); } if ($search_filter == 'withoutsubscription') { $sql .= " AND (datefin IS NULL OR t.subscription = 0)"; diff --git a/htdocs/adherents/subscription.php b/htdocs/adherents/subscription.php index 54729e5ba8a..ec9b2c3a65e 100644 --- a/htdocs/adherents/subscription.php +++ b/htdocs/adherents/subscription.php @@ -677,7 +677,7 @@ if ($rowid > 0) { $sql .= " FROM ".MAIN_DB_PREFIX."adherent as d, ".MAIN_DB_PREFIX."subscription as c"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."bank as b ON c.fk_bank = b.rowid"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."bank_account as ba ON b.fk_account = ba.rowid"; - $sql .= " WHERE d.rowid = c.fk_adherent AND d.rowid=".$rowid; + $sql .= " WHERE d.rowid = c.fk_adherent AND d.rowid=".((int) $rowid); $sql .= $db->order($sortfield, $sortorder); $result = $db->query($sql); diff --git a/htdocs/adherents/subscription/list.php b/htdocs/adherents/subscription/list.php index 7322f92fccd..55cafade309 100644 --- a/htdocs/adherents/subscription/list.php +++ b/htdocs/adherents/subscription/list.php @@ -170,7 +170,7 @@ if (isset($date_select) && $date_select != '') { } if ($search_ref) { if (is_numeric($search_ref)) { - $sql .= " AND (c.rowid = ".$db->escape($search_ref).")"; + $sql .= " AND c.rowid = ".((int) $search_ref); } else { $sql .= " AND 1 = 2"; // Always wrong } diff --git a/htdocs/adherents/type.php b/htdocs/adherents/type.php index 25c44baa7db..c9b98784142 100644 --- a/htdocs/adherents/type.php +++ b/htdocs/adherents/type.php @@ -500,7 +500,7 @@ if ($rowid > 0) { $sql .= " FROM ".MAIN_DB_PREFIX."adherent as d, ".MAIN_DB_PREFIX."adherent_type as t"; $sql .= " WHERE d.fk_adherent_type = t.rowid "; $sql .= " AND d.entity IN (".getEntity('adherent').")"; - $sql .= " AND t.rowid = ".$object->id; + $sql .= " AND t.rowid = ".((int) $object->id); if ($sall) { $sql .= natural_search(array("f.firstname", "d.lastname", "d.societe", "d.email", "d.login", "d.address", "d.town", "d.note_public", "d.note_private"), $sall); } diff --git a/htdocs/admin/boxes.php b/htdocs/admin/boxes.php index e8793ca3c30..fc3e30a484b 100644 --- a/htdocs/admin/boxes.php +++ b/htdocs/admin/boxes.php @@ -156,7 +156,7 @@ if ($action == 'delete') { $sql = "DELETE FROM ".MAIN_DB_PREFIX."boxes"; $sql .= " WHERE entity = ".$conf->entity; - $sql .= " AND box_id=".$obj->box_id; + $sql .= " AND box_id=".((int) $obj->box_id); $resql = $db->query($sql); @@ -255,7 +255,7 @@ if ($resql) { // We renumber the order of the boxes if one of them is in '' // This occurs just after an insert. if ($decalage) { - $sql = "UPDATE ".MAIN_DB_PREFIX."boxes SET box_order='".$db->escape($decalage)."' WHERE rowid=".$obj->rowid; + $sql = "UPDATE ".MAIN_DB_PREFIX."boxes SET box_order='".$db->escape($decalage)."' WHERE rowid=".((int) $obj->rowid); $db->query($sql); } } diff --git a/htdocs/admin/dict.php b/htdocs/admin/dict.php index 636278dd6fb..455c01d0337 100644 --- a/htdocs/admin/dict.php +++ b/htdocs/admin/dict.php @@ -1151,7 +1151,7 @@ if ($id) { $sql .= " WHERE 1 = 1"; } if ($search_country_id > 0) { - $sql .= " AND c.rowid = ".$search_country_id; + $sql .= " AND c.rowid = ".((int) $search_country_id); } if ($search_code != '' && $id == 9) { $sql .= natural_search("code_iso", $search_code); diff --git a/htdocs/admin/external_rss.php b/htdocs/admin/external_rss.php index b8b412ad6f8..71086096e4f 100644 --- a/htdocs/admin/external_rss.php +++ b/htdocs/admin/external_rss.php @@ -136,7 +136,7 @@ if (GETPOST("delete")) { $sql = "DELETE FROM ".MAIN_DB_PREFIX."boxes"; $sql .= " WHERE entity = ".$conf->entity; - $sql .= " AND box_id = ".$obj->rowid; + $sql .= " AND box_id = ".((int) $obj->rowid); $resql = $db->query($sql); $sql = "DELETE FROM ".MAIN_DB_PREFIX."boxes_def"; diff --git a/htdocs/admin/security.php b/htdocs/admin/security.php index 9ce22b7c08e..e3521f1d0af 100644 --- a/htdocs/admin/security.php +++ b/htdocs/admin/security.php @@ -71,7 +71,7 @@ if ($action == 'activate_encrypt') { if (dol_hash($obj->pass)) { $sql = "UPDATE ".MAIN_DB_PREFIX."user"; $sql .= " SET pass_crypted = '".dol_hash($obj->pass)."', pass = NULL"; - $sql .= " WHERE rowid=".$obj->rowid; + $sql .= " WHERE rowid=".((int) $obj->rowid); //print $sql; $resql2 = $db->query($sql); diff --git a/htdocs/asset/class/asset_type.class.php b/htdocs/asset/class/asset_type.class.php index 99205d2b3f3..36c654c28ba 100644 --- a/htdocs/asset/class/asset_type.class.php +++ b/htdocs/asset/class/asset_type.class.php @@ -188,7 +188,7 @@ class AssetType extends CommonObject $sql .= "accountancy_code_depreciation_asset = '".$this->db->escape($this->accountancy_code_depreciation_asset)."',"; $sql .= "accountancy_code_depreciation_expense = '".$this->db->escape($this->accountancy_code_depreciation_expense)."',"; $sql .= "note = '".$this->db->escape($this->note)."'"; - $sql .= " WHERE rowid =".$this->id; + $sql .= " WHERE rowid = ".((int) $this->id); $result = $this->db->query($sql); if ($result) { diff --git a/htdocs/blockedlog/class/authority.class.php b/htdocs/blockedlog/class/authority.class.php index 9fc10fdc59e..2071eb03c47 100644 --- a/htdocs/blockedlog/class/authority.class.php +++ b/htdocs/blockedlog/class/authority.class.php @@ -148,7 +148,7 @@ class BlockedLogAuthority global $langs; - dol_syslog(get_class($this)."::fetch id=".$id, LOG_DEBUG); + dol_syslog(get_class($this)."::fetch id=".((int) $id), LOG_DEBUG); if (empty($id) && empty($signature)) { $this->error = 'BadParameter'; diff --git a/htdocs/bookmarks/class/bookmark.class.php b/htdocs/bookmarks/class/bookmark.class.php index 4fe8c3cee83..9a5b3a53c20 100644 --- a/htdocs/bookmarks/class/bookmark.class.php +++ b/htdocs/bookmarks/class/bookmark.class.php @@ -219,7 +219,7 @@ class Bookmark extends CommonObject $sql .= " ,title = '".$this->db->escape($this->title)."'"; $sql .= " ,favicon = '".$this->db->escape($this->favicon)."'"; $sql .= " ,position = ".(int) $this->position; - $sql .= " WHERE rowid = ".$this->id; + $sql .= " WHERE rowid = ".((int) $this->id); dol_syslog("Bookmark::update", LOG_DEBUG); if ($this->db->query($sql)) { diff --git a/htdocs/categories/class/categorie.class.php b/htdocs/categories/class/categorie.class.php index 1f467b507d1..51079636d4f 100644 --- a/htdocs/categories/class/categorie.class.php +++ b/htdocs/categories/class/categorie.class.php @@ -1470,7 +1470,7 @@ class Categorie extends CommonObject // Load bank categories $sql = "SELECT c.label, c.rowid"; $sql .= " FROM ".MAIN_DB_PREFIX."bank_class as a, ".MAIN_DB_PREFIX."bank_categ as c"; - $sql .= " WHERE a.lineid=".$id." AND a.fk_categ = c.rowid"; + $sql .= " WHERE a.lineid=".((int) $id)." AND a.fk_categ = c.rowid"; $sql .= " AND c.entity IN (".getEntity('category').")"; $sql .= " ORDER BY c.label"; diff --git a/htdocs/comm/action/class/actioncomm.class.php b/htdocs/comm/action/class/actioncomm.class.php index f7ceea4743d..d8bcd0efb1b 100644 --- a/htdocs/comm/action/class/actioncomm.class.php +++ b/htdocs/comm/action/class/actioncomm.class.php @@ -2436,7 +2436,7 @@ class ActionComm extends CommonObject $sql = "UPDATE ".MAIN_DB_PREFIX."actioncomm "; $sql .= " SET percent = ".(int) $percent; - $sql .= " WHERE id=".$id; + $sql .= " WHERE id = ".((int) $id); if ($this->db->query($sql)) { $this->db->commit(); diff --git a/htdocs/comm/action/index.php b/htdocs/comm/action/index.php index 33e4fabe2aa..be0884a5556 100644 --- a/htdocs/comm/action/index.php +++ b/htdocs/comm/action/index.php @@ -720,7 +720,7 @@ if ($action == 'show_day') { $sql .= ')'; } if ($type) { - $sql .= " AND ca.id = ".$type; + $sql .= " AND ca.id = ".((int) $type); } if ($status == '0') { $sql .= " AND a.percent = 0"; diff --git a/htdocs/comm/action/pertype.php b/htdocs/comm/action/pertype.php index 8d436f0e0f6..19f8a8ce31c 100644 --- a/htdocs/comm/action/pertype.php +++ b/htdocs/comm/action/pertype.php @@ -592,7 +592,7 @@ if ($action == 'show_day') { $sql .= ')'; } if ($type) { - $sql .= " AND ca.id = ".$type; + $sql .= " AND ca.id = ".((int) $type); } if ($status == '0') { $sql .= " AND a.percent = 0"; diff --git a/htdocs/comm/action/peruser.php b/htdocs/comm/action/peruser.php index 3ad2d31b353..62af33b34ee 100644 --- a/htdocs/comm/action/peruser.php +++ b/htdocs/comm/action/peruser.php @@ -613,7 +613,7 @@ if ($action == 'show_day') { $sql .= ')'; } if ($type) { - $sql .= " AND ca.id = ".$type; + $sql .= " AND ca.id = ".((int) $type); } if ($status == '0') { $sql .= " AND a.percent = 0"; diff --git a/htdocs/comm/index.php b/htdocs/comm/index.php index 60a6bd5974b..5c2360624a4 100644 --- a/htdocs/comm/index.php +++ b/htdocs/comm/index.php @@ -219,7 +219,7 @@ if (!empty($conf->supplier_proposal->enabled) && $user->rights->supplier_proposa $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } $resql = $db->query($sql); @@ -605,7 +605,7 @@ if (((!empty($conf->fournisseur->enabled) && empty($conf->global->MAIN_USE_NEW_S $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } $sql .= " ORDER BY s.datec DESC"; $sql .= $db->plimit($max, 0); @@ -711,7 +711,7 @@ if (!empty($conf->contrat->enabled) && $user->rights->contrat->lire && 0) { // T $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } $sql .= " ORDER BY c.tms DESC"; $sql .= $db->plimit($max + 1, 0); @@ -786,7 +786,7 @@ if (!empty($conf->propal->enabled) && $user->rights->propal->lire) { $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } $sql .= " ORDER BY p.rowid DESC"; @@ -902,7 +902,7 @@ if (!empty($conf->commande->enabled) && $user->rights->commande->lire) { $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } $sql .= " ORDER BY c.rowid DESC"; diff --git a/htdocs/comm/mailing/advtargetemailing.php b/htdocs/comm/mailing/advtargetemailing.php index 2487e772373..bd052f4161e 100644 --- a/htdocs/comm/mailing/advtargetemailing.php +++ b/htdocs/comm/mailing/advtargetemailing.php @@ -379,7 +379,7 @@ if ($action == 'deletefilter') { if ($action == 'delete') { // Ici, rowid indique le destinataire et id le mailing - $sql = "DELETE FROM ".MAIN_DB_PREFIX."mailing_cibles WHERE rowid=".$rowid; + $sql = "DELETE FROM ".MAIN_DB_PREFIX."mailing_cibles WHERE rowid = ".((int) $rowid); $resql = $db->query($sql); if ($resql) { if (!empty($id)) { diff --git a/htdocs/comm/mailing/cibles.php b/htdocs/comm/mailing/cibles.php index d9557845492..27859403d96 100644 --- a/htdocs/comm/mailing/cibles.php +++ b/htdocs/comm/mailing/cibles.php @@ -167,7 +167,7 @@ if (GETPOST('exportcsv', 'int')) { if ($action == 'delete') { // Ici, rowid indique le destinataire et id le mailing - $sql = "DELETE FROM ".MAIN_DB_PREFIX."mailing_cibles WHERE rowid=".$rowid; + $sql = "DELETE FROM ".MAIN_DB_PREFIX."mailing_cibles WHERE rowid = ".((int) $rowid); $resql = $db->query($sql); if ($resql) { if (!empty($id)) { diff --git a/htdocs/comm/propal/class/propal.class.php b/htdocs/comm/propal/class/propal.class.php index ffee98ffbba..441020c9b5d 100644 --- a/htdocs/comm/propal/class/propal.class.php +++ b/htdocs/comm/propal/class/propal.class.php @@ -1477,7 +1477,7 @@ class Propal extends CommonObject $sql .= " WHERE p.entity IN (".getEntity('propal').")"; // Dont't use entity if you use rowid $sql .= " AND p.ref='".$this->db->escape($ref)."'"; } else { - $sql .= " WHERE p.rowid=".$rowid; + $sql .= " WHERE p.rowid = ".((int) $rowid); } dol_syslog(get_class($this)."::fetch", LOG_DEBUG); diff --git a/htdocs/comm/prospect/index.php b/htdocs/comm/prospect/index.php index 3aacd070ae4..8883e0af6f3 100644 --- a/htdocs/comm/prospect/index.php +++ b/htdocs/comm/prospect/index.php @@ -194,7 +194,7 @@ if (!empty($conf->propal->enabled) && $user->rights->propale->lire) { $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } $sql .= " ORDER BY p.rowid DESC"; $sql .= $db->plimit(5, 0); diff --git a/htdocs/commande/class/commande.class.php b/htdocs/commande/class/commande.class.php index 635e561eaef..c89ad9340d2 100644 --- a/htdocs/commande/class/commande.class.php +++ b/htdocs/commande/class/commande.class.php @@ -1807,7 +1807,7 @@ class Commande extends CommonOrder $sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_incoterms as i ON c.fk_incoterms = i.rowid'; if ($id) { - $sql .= " WHERE c.rowid=".$id; + $sql .= " WHERE c.rowid=".((int) $id); } else { $sql .= " WHERE c.entity IN (".getEntity('commande').")"; // Dont't use entity if you use rowid } @@ -2687,7 +2687,7 @@ class Commande extends CommonOrder $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } if ($draft) { $sql .= " AND c.fk_statut = ".self::STATUS_DRAFT; diff --git a/htdocs/commande/customer.php b/htdocs/commande/customer.php index 4f75ca3d4c5..6dfa898a024 100644 --- a/htdocs/commande/customer.php +++ b/htdocs/commande/customer.php @@ -105,7 +105,7 @@ if (dol_strlen($begin)) { $sql .= " AND s.nom like '".$db->escape($begin)."'"; } if ($socid > 0) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } $sql .= " AND c.fk_statut in (1, 2) AND c.facture = 0"; $sql .= " GROUP BY s.nom"; diff --git a/htdocs/compta/bank/class/account.class.php b/htdocs/compta/bank/class/account.class.php index 943fef0c32a..13c2bdba4ce 100644 --- a/htdocs/compta/bank/class/account.class.php +++ b/htdocs/compta/bank/class/account.class.php @@ -509,6 +509,7 @@ class Account extends CommonObject } // Clean parameters + $label = $emetteur = trim($emetteur); $banque = trim($banque); @@ -516,7 +517,7 @@ class Account extends CommonObject if (is_numeric($oper)) { // Clean operation to have a code instead of a rowid $sql = "SELECT code FROM ".MAIN_DB_PREFIX."c_paiement"; - $sql .= " WHERE id=".$oper; + $sql .= " WHERE id = ".((int) $oper); $sql .= " AND entity IN (".getEntity('c_paiement').")"; $resql = $this->db->query($sql); if ($resql) { @@ -1223,7 +1224,7 @@ class Account extends CommonObject $sql .= " AND (ba.rappro = 1 AND ba.courant != 2)"; // Compte rapprochable $sql .= " AND clos = 0"; if ($filteraccountid) { - $sql .= " AND ba.rowid = ".$filteraccountid; + $sql .= " AND ba.rowid = ".((int) $filteraccountid); } $resql = $this->db->query($sql); @@ -1278,7 +1279,7 @@ class Account extends CommonObject $sql .= " AND (ba.rappro = 1 AND ba.courant != 2)"; // Compte rapprochable $sql .= " AND clos = 0"; if ($filteraccountid) { - $sql .= " AND ba.rowid = ".$filteraccountid; + $sql .= " AND ba.rowid = ".((int) $filteraccountid); } $resql = $this->db->query($sql); diff --git a/htdocs/compta/bank/line.php b/htdocs/compta/bank/line.php index bfea7c74b60..3aa477dfc9c 100644 --- a/htdocs/compta/bank/line.php +++ b/htdocs/compta/bank/line.php @@ -268,7 +268,7 @@ $sql = "SELECT b.rowid,b.dateo as do,b.datev as dv, b.amount, b.label, b.rappro, $sql .= " b.num_releve, b.fk_user_author, b.num_chq, b.fk_type, b.fk_account, b.fk_bordereau as receiptid,"; $sql .= " b.emetteur,b.banque"; $sql .= " FROM ".MAIN_DB_PREFIX."bank as b"; -$sql .= " WHERE rowid=".$rowid; +$sql .= " WHERE rowid=".((int) $rowid); $sql .= " ORDER BY dateo ASC"; $result = $db->query($sql); if ($result) { diff --git a/htdocs/compta/cashcontrol/report.php b/htdocs/compta/cashcontrol/report.php index add61ac086c..653161ca3bc 100644 --- a/htdocs/compta/cashcontrol/report.php +++ b/htdocs/compta/cashcontrol/report.php @@ -342,7 +342,7 @@ if ($resql) { $sql .= "SET"; $sql .= " cash='".$db->escape($cash)."'"; $sql .= ", card='".$db->escape($bank)."'"; - $sql .= " where rowid=".$id; + $sql .= " where rowid = ".((int) $id); $db->query($sql); */ diff --git a/htdocs/compta/clients.php b/htdocs/compta/clients.php index 191038ed28a..60924dae644 100644 --- a/htdocs/compta/clients.php +++ b/htdocs/compta/clients.php @@ -127,7 +127,7 @@ if (dol_strlen($begin)) { $sql .= natural_search("s.nom", $begin); } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } $sql .= " ORDER BY $sortfield $sortorder "; $sql .= $db->plimit($conf->liste_limit + 1, $offset); diff --git a/htdocs/compta/facture/class/facture.class.php b/htdocs/compta/facture/class/facture.class.php index b949877dc82..9ae760220a4 100644 --- a/htdocs/compta/facture/class/facture.class.php +++ b/htdocs/compta/facture/class/facture.class.php @@ -1604,7 +1604,7 @@ class Facture extends CommonInvoice $sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_incoterms as i ON f.fk_incoterms = i.rowid'; if ($rowid) { - $sql .= " WHERE f.rowid=".$rowid; + $sql .= " WHERE f.rowid=".((int) $rowid); } else { $sql .= ' WHERE f.entity IN ('.getEntity('invoice').')'; // Dont't use entity if you use rowid if ($ref) { diff --git a/htdocs/compta/prelevement/class/bonprelevement.class.php b/htdocs/compta/prelevement/class/bonprelevement.class.php index 087911ce140..ea44a75899d 100644 --- a/htdocs/compta/prelevement/class/bonprelevement.class.php +++ b/htdocs/compta/prelevement/class/bonprelevement.class.php @@ -290,7 +290,7 @@ class BonPrelevement extends CommonObject $sql .= " FROM ".MAIN_DB_PREFIX."prelevement_bons as p"; $sql .= " WHERE p.entity IN (".getEntity('invoice').")"; if ($rowid > 0) { - $sql .= " AND p.rowid = ".$rowid; + $sql .= " AND p.rowid = ".((int) $rowid); } else { $sql .= " AND p.ref = '".$this->db->escape($ref)."'"; } diff --git a/htdocs/compta/prelevement/class/ligneprelevement.class.php b/htdocs/compta/prelevement/class/ligneprelevement.class.php index 6fa9b94b637..1c57feca37e 100644 --- a/htdocs/compta/prelevement/class/ligneprelevement.class.php +++ b/htdocs/compta/prelevement/class/ligneprelevement.class.php @@ -79,7 +79,7 @@ class LignePrelevement $sql .= ", pl.statut, pl.fk_soc"; $sql .= " FROM ".MAIN_DB_PREFIX."prelevement_lignes as pl"; $sql .= ", ".MAIN_DB_PREFIX."prelevement_bons as p"; - $sql .= " WHERE pl.rowid=".$rowid; + $sql .= " WHERE pl.rowid=".((int) $rowid); $sql .= " AND p.rowid = pl.fk_prelevement_bons"; $sql .= " AND p.entity = ".$conf->entity; diff --git a/htdocs/compta/prelevement/list.php b/htdocs/compta/prelevement/list.php index 0818dbb61d1..feb69bdc7fb 100644 --- a/htdocs/compta/prelevement/list.php +++ b/htdocs/compta/prelevement/list.php @@ -125,7 +125,7 @@ if ($type == 'bank-transfer') { $sql .= " AND f.fk_soc = s.rowid"; $sql .= " AND f.entity IN (".getEntity('invoice').")"; if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } if ($search_line) { $sql .= " AND pl.rowid = '".$db->escape($search_line)."'"; diff --git a/htdocs/compta/prelevement/rejets.php b/htdocs/compta/prelevement/rejets.php index fb03f2a6c6c..5aec35cf504 100644 --- a/htdocs/compta/prelevement/rejets.php +++ b/htdocs/compta/prelevement/rejets.php @@ -99,7 +99,7 @@ if ($type == 'bank-transfer') { $sql .= " AND p.type = 'debit-order'"; } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } $sql .= $db->order($sortfield, $sortorder); $sql .= $db->plimit($limit + 1, $offset); diff --git a/htdocs/compta/sociales/class/chargesociales.class.php b/htdocs/compta/sociales/class/chargesociales.class.php index 20cc2c82b0c..1977ac9791b 100644 --- a/htdocs/compta/sociales/class/chargesociales.class.php +++ b/htdocs/compta/sociales/class/chargesociales.class.php @@ -147,7 +147,7 @@ class ChargeSociales extends CommonObject $sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_paiement as p ON cs.fk_mode_reglement = p.id'; $sql .= ' WHERE cs.entity IN ('.getEntity('tax').')'; if ($ref) { - $sql .= " AND cs.rowid = ".$ref; + $sql .= " AND cs.ref = '".$this->db->escape($ref)."'"; } else { $sql .= " AND cs.rowid = ".((int) $id); } diff --git a/htdocs/compta/sociales/list.php b/htdocs/compta/sociales/list.php index ffebc7dcc73..2b0c3961759 100644 --- a/htdocs/compta/sociales/list.php +++ b/htdocs/compta/sociales/list.php @@ -195,7 +195,7 @@ $sql .= " WHERE cs.fk_type = c.id"; $sql .= " AND cs.entity = ".$conf->entity; // Search criteria if ($search_ref) { - $sql .= " AND cs.rowid=".$db->escape($search_ref); + $sql .= " AND cs.ref = '".$db->escape($search_ref)."'"; } if ($search_label) { $sql .= natural_search("cs.libelle", $search_label); diff --git a/htdocs/contact/list.php b/htdocs/contact/list.php index b02856ceb3b..c7386c260ed 100644 --- a/htdocs/contact/list.php +++ b/htdocs/contact/list.php @@ -513,7 +513,7 @@ if ($type == "o") { // filtre sur type $sql .= " AND s.client IN (2, 3)"; } if (!empty($socid)) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } // Add where from extra fields include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_sql.tpl.php'; diff --git a/htdocs/contrat/index.php b/htdocs/contrat/index.php index 8ab94ca6793..aed4cba2fe1 100644 --- a/htdocs/contrat/index.php +++ b/htdocs/contrat/index.php @@ -323,11 +323,11 @@ if (!$user->rights->societe->client->voir && !$socid) { $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } $sql .= " GROUP BY c.rowid, c.ref, c.datec, c.tms, c.statut, s.nom, s.rowid"; $sql .= " ORDER BY c.tms DESC"; -$sql .= " LIMIT ".$max; +$sql .= $db->plimit($max); dol_syslog("contrat/index.php", LOG_DEBUG); $result = $db->query($sql); @@ -398,7 +398,7 @@ if (!$user->rights->societe->client->voir && !$socid) { $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } $sql .= " ORDER BY cd.tms DESC"; @@ -480,7 +480,7 @@ if (!$user->rights->societe->client->voir && !$socid) { $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } $sql .= " ORDER BY cd.tms DESC"; @@ -562,7 +562,7 @@ if (!$user->rights->societe->client->voir && !$socid) { $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } $sql .= " ORDER BY cd.tms DESC"; diff --git a/htdocs/contrat/services_list.php b/htdocs/contrat/services_list.php index 7247dc02c83..a0ecc6b4be8 100644 --- a/htdocs/contrat/services_list.php +++ b/htdocs/contrat/services_list.php @@ -288,7 +288,7 @@ if ($search_service) { $sql .= " AND (p.ref LIKE '%".$db->escape($search_service)."%' OR p.description LIKE '%".$db->escape($search_service)."%' OR cd.description LIKE '%".$db->escape($search_service)."%')"; } if ($socid > 0) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } $filter_dateouvertureprevue_start = dol_mktime(0, 0, 0, $opouvertureprevuemonth, $opouvertureprevueday, $opouvertureprevueyear); diff --git a/htdocs/core/class/commoninvoice.class.php b/htdocs/core/class/commoninvoice.class.php index 50d94da8531..81f2b529f1d 100644 --- a/htdocs/core/class/commoninvoice.class.php +++ b/htdocs/core/class/commoninvoice.class.php @@ -604,10 +604,10 @@ abstract class CommonInvoice extends CommonObject $sqltemp = 'SELECT c.type_cdr, c.nbjour, c.decalage'; $sqltemp .= ' FROM '.MAIN_DB_PREFIX.'c_payment_term as c'; if (is_numeric($cond_reglement)) { - $sqltemp .= " WHERE c.rowid=".$cond_reglement; + $sqltemp .= " WHERE c.rowid=".((int) $cond_reglement); } else { $sqltemp .= " WHERE c.entity IN (".getEntity('c_payment_term').")"; - $sqltemp .= " AND c.code='".$this->db->escape($cond_reglement)."'"; + $sqltemp .= " AND c.code = '".$this->db->escape($cond_reglement)."'"; } dol_syslog(get_class($this).'::calculate_date_lim_reglement', LOG_DEBUG); diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php index a93acda2a17..2088263a2c2 100644 --- a/htdocs/core/class/commonobject.class.php +++ b/htdocs/core/class/commonobject.class.php @@ -3969,7 +3969,7 @@ abstract class CommonObject $sql = "DELETE FROM " . MAIN_DB_PREFIX . "element_element"; $sql .= " WHERE"; if ($rowid > 0) { - $sql .= " rowid = " . $rowid; + $sql .= " rowid = " . ((int) $rowid); } else { if ($deletesource) { $sql .= " fk_source = " . $sourceid . " AND sourcetype = '" . $this->db->escape($sourcetype) . "'"; @@ -5012,7 +5012,7 @@ abstract class CommonObject $this->db->begin(); $sql = "DELETE FROM ".MAIN_DB_PREFIX."element_resources"; - $sql .= " WHERE rowid=".$rowid; + $sql .= " WHERE rowid = ".((int) $rowid); dol_syslog(get_class($this)."::delete_resource", LOG_DEBUG); diff --git a/htdocs/core/lib/company.lib.php b/htdocs/core/lib/company.lib.php index fb97d2e5361..7183e24dea5 100644 --- a/htdocs/core/lib/company.lib.php +++ b/htdocs/core/lib/company.lib.php @@ -504,11 +504,11 @@ function getCountry($searchkey, $withcode = '', $dbtouse = 0, $outputlangs = '', $sql = "SELECT rowid, code, label FROM ".MAIN_DB_PREFIX."c_country"; if (is_numeric($searchkey)) { - $sql .= " WHERE rowid=".$searchkey; + $sql .= " WHERE rowid = ".((int) $searchkey); } elseif (!empty($searchkey)) { - $sql .= " WHERE code='".$db->escape($searchkey)."'"; + $sql .= " WHERE code = '".$db->escape($searchkey)."'"; } else { - $sql .= " WHERE label='".$db->escape($searchlabel)."'"; + $sql .= " WHERE label = '".$db->escape($searchlabel)."'"; } $resql = $dbtouse->query($sql); diff --git a/htdocs/core/modules/movement/doc/pdf_standard.modules.php b/htdocs/core/modules/movement/doc/pdf_standard.modules.php index c8a0c50862b..c2817fb50f6 100644 --- a/htdocs/core/modules/movement/doc/pdf_standard.modules.php +++ b/htdocs/core/modules/movement/doc/pdf_standard.modules.php @@ -295,7 +295,7 @@ class pdf_stdandard extends ModelePDFMovement $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."product_lot as pl ON m.batch = pl.batch AND m.fk_product = pl.fk_product"; $sql .= " WHERE m.fk_product = p.rowid"; if ($msid > 0) { - $sql .= " AND m.rowid = ".$msid; + $sql .= " AND m.rowid = ".((int) $msid); } $sql .= " AND m.fk_entrepot = e.rowid"; $sql .= " AND e.entity IN (".getEntity('stock').")"; diff --git a/htdocs/core/website.inc.php b/htdocs/core/website.inc.php index 30ffee00248..8ffa69e31ac 100644 --- a/htdocs/core/website.inc.php +++ b/htdocs/core/website.inc.php @@ -94,7 +94,7 @@ if ($_SERVER['PHP_SELF'] != DOL_URL_ROOT.'/website/index.php') { // If we browsi $sql = "SELECT wp.rowid, wp.lang, wp.pageurl, wp.fk_page"; $sql .= " FROM ".MAIN_DB_PREFIX."website_page as wp"; $sql .= " WHERE wp.fk_website = ".((int) $website->id); - $sql .= " AND (wp.fk_page = ".$pageid." OR wp.rowid = ".$pageid; + $sql .= " AND (wp.fk_page = ".((int) $pageid)." OR wp.rowid = ".((int) $pageid); if (is_object($websitepage) && $websitepage->fk_page > 0) { $sql .= " OR wp.fk_page = ".$websitepage->fk_page." OR wp.rowid = ".$websitepage->fk_page; } diff --git a/htdocs/don/class/don.class.php b/htdocs/don/class/don.class.php index 1ec3ebe1cc5..a925cdb4ba4 100644 --- a/htdocs/don/class/don.class.php +++ b/htdocs/don/class/don.class.php @@ -612,7 +612,7 @@ class Don extends CommonObject $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON d.fk_country = c.rowid"; $sql .= " WHERE d.entity IN (".getEntity('donation').")"; if (!empty($id)) { - $sql .= " AND d.rowid=".$id; + $sql .= " AND d.rowid=".((int) $id); } elseif (!empty($ref)) { $sql .= " AND d.ref='".$this->db->escape($ref)."'"; } diff --git a/htdocs/expedition/class/expedition.class.php b/htdocs/expedition/class/expedition.class.php index ed6f7a25eaf..f7c5a1d32a8 100644 --- a/htdocs/expedition/class/expedition.class.php +++ b/htdocs/expedition/class/expedition.class.php @@ -545,7 +545,7 @@ class Expedition extends CommonObject $sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_shipment_mode as s ON e.fk_shipping_method = s.rowid'; $sql .= " WHERE e.entity IN (".getEntity('expedition').")"; if ($id) { - $sql .= " AND e.rowid=".$id; + $sql .= " AND e.rowid = ".((int) $id); } if ($ref) { $sql .= " AND e.ref='".$this->db->escape($ref)."'"; @@ -2033,7 +2033,7 @@ class Expedition extends CommonObject $sql = "SELECT em.rowid, em.code, em.libelle as label, em.description, em.tracking, em.active"; $sql .= " FROM ".MAIN_DB_PREFIX."c_shipment_mode as em"; if ($id != '') { - $sql .= " WHERE em.rowid=".$id; + $sql .= " WHERE em.rowid=".((int) $id); } $resql = $this->db->query($sql); @@ -2072,7 +2072,7 @@ class Expedition extends CommonObject $sql .= ",libelle='".$this->db->escape($this->update['libelle'])."'"; $sql .= ",description='".$this->db->escape($this->update['description'])."'"; $sql .= ",tracking='".$this->db->escape($this->update['tracking'])."'"; - $sql .= " WHERE rowid=".$id; + $sql .= " WHERE rowid=".((int) $id); $resql = $this->db->query($sql); } if ($resql < 0) { @@ -2952,7 +2952,7 @@ class ExpeditionLigne extends CommonObjectLine // delete lot expedition line $sql = "DELETE FROM ".MAIN_DB_PREFIX."expeditiondet_batch"; $sql .= " WHERE fk_expeditiondet = ".$this->id; - $sql .= " AND rowid = ".$expedition_batch_id; + $sql .= " AND rowid = ".((int) $expedition_batch_id); if (!$this->db->query($sql)) { $this->errors[] = $this->db->lasterror()." - sql=$sql"; diff --git a/htdocs/fichinter/card-rec.php b/htdocs/fichinter/card-rec.php index b7280c2f4a4..26ea2cfaaa8 100644 --- a/htdocs/fichinter/card-rec.php +++ b/htdocs/fichinter/card-rec.php @@ -771,7 +771,7 @@ if ($action == 'create') { $sql .= " WHERE f.fk_soc = s.rowid"; $sql .= " AND f.entity = ".$conf->entity; if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } if (!$user->rights->societe->client->voir && !$socid) { $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; diff --git a/htdocs/fichinter/class/fichinter.class.php b/htdocs/fichinter/class/fichinter.class.php index 1fef1ed7c03..1c1c1ab37be 100644 --- a/htdocs/fichinter/class/fichinter.class.php +++ b/htdocs/fichinter/class/fichinter.class.php @@ -432,7 +432,7 @@ class Fichinter extends CommonObject $sql .= " WHERE f.entity IN (".getEntity('intervention').")"; $sql .= " AND f.ref='".$this->db->escape($ref)."'"; } else { - $sql .= " WHERE f.rowid=".$rowid; + $sql .= " WHERE f.rowid=".((int) $rowid); } dol_syslog(get_class($this)."::fetch", LOG_DEBUG); diff --git a/htdocs/fichinter/list.php b/htdocs/fichinter/list.php index ee9edc6694b..86c1cccef95 100644 --- a/htdocs/fichinter/list.php +++ b/htdocs/fichinter/list.php @@ -282,7 +282,7 @@ if (!$user->rights->societe->client->voir && empty($socid)) { $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } if ($sall) { $sql .= natural_search(array_keys($fieldstosearchall), $sall); diff --git a/htdocs/fourn/class/fournisseur.commande.class.php b/htdocs/fourn/class/fournisseur.commande.class.php index c999f204749..331e211e5ac 100644 --- a/htdocs/fourn/class/fournisseur.commande.class.php +++ b/htdocs/fourn/class/fournisseur.commande.class.php @@ -331,7 +331,7 @@ class CommandeFournisseur extends CommonOrder if (empty($id)) { $sql .= " WHERE c.entity IN (".getEntity('supplier_order').")"; } else { - $sql .= " WHERE c.rowid=".$id; + $sql .= " WHERE c.rowid=".((int) $id); } if ($ref) { diff --git a/htdocs/loan/list.php b/htdocs/loan/list.php index fa1de74b0cc..f9b08a63a48 100644 --- a/htdocs/loan/list.php +++ b/htdocs/loan/list.php @@ -113,7 +113,7 @@ if ($search_amount) { $sql .= natural_search("l.capital", $search_amount, 1); } if ($search_ref) { - $sql .= " AND l.rowid = ".$db->escape($search_ref); + $sql .= " AND l.rowid = ".((int) $search_ref); } if ($search_label) { $sql .= natural_search("l.label", $search_label); diff --git a/htdocs/mrp/mo_movements.php b/htdocs/mrp/mo_movements.php index b4b777f7b49..7b9c0662e53 100644 --- a/htdocs/mrp/mo_movements.php +++ b/htdocs/mrp/mo_movements.php @@ -441,7 +441,7 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea $sql .= " WHERE m.fk_product = p.rowid"; $sql .= " AND m.origintype = 'mo' AND m.fk_origin = ".(int) $object->id; if ($msid > 0) { - $sql .= " AND m.rowid = ".$msid; + $sql .= " AND m.rowid = ".((int) $msid); } $sql .= " AND m.fk_entrepot = e.rowid"; $sql .= " AND e.entity IN (".getEntity('stock').")"; diff --git a/htdocs/product/class/product.class.php b/htdocs/product/class/product.class.php index 6ed0b4266a8..fbe706e93db 100644 --- a/htdocs/product/class/product.class.php +++ b/htdocs/product/class/product.class.php @@ -1679,11 +1679,11 @@ class Product extends CommonObject { // phpcs:enable $sql = "DELETE FROM ".MAIN_DB_PREFIX."product_price_by_qty"; - $sql .= " WHERE fk_product_price=".$rowid; + $sql .= " WHERE fk_product_price=".((int) $rowid); $resql = $this->db->query($sql); $sql = "DELETE FROM ".MAIN_DB_PREFIX."product_price"; - $sql .= " WHERE rowid=".$rowid; + $sql .= " WHERE rowid=".((int) $rowid); $resql = $this->db->query($sql); if ($resql) { return 1; diff --git a/htdocs/product/stock/stockatdate.php b/htdocs/product/stock/stockatdate.php index d9a9be0cd70..e5eb2751109 100644 --- a/htdocs/product/stock/stockatdate.php +++ b/htdocs/product/stock/stockatdate.php @@ -266,7 +266,7 @@ $reshook = $hookmanager->executeHooks('printFieldListJoin', $parameters); // Not $sql .= $hookmanager->resPrint; $sql .= ' WHERE p.entity IN ('.getEntity('product').')'; if ($productid > 0) { - $sql .= " AND p.rowid = ".$productid; + $sql .= " AND p.rowid = ".((int) $productid); } if (empty($conf->global->STOCK_SUPPORTS_SERVICES)) { $sql .= " AND p.fk_product_type = 0"; diff --git a/htdocs/projet/list.php b/htdocs/projet/list.php index a0888daee2a..a9f17f5439b 100644 --- a/htdocs/projet/list.php +++ b/htdocs/projet/list.php @@ -424,7 +424,7 @@ if ($search_public != '') { $sql .= " AND p.public = ".$db->escape($search_public); } // For external user, no check is done on company permission because readability is managed by public status of project and assignement. -//if ($socid > 0) $sql.= " AND s.rowid = ".$socid; +//if ($socid > 0) $sql.= " AND s.rowid = ".((int) $socid); if ($search_sale > 0) { $sql .= " AND sc.fk_user = ".((int) $search_sale); } diff --git a/htdocs/reception/class/reception.class.php b/htdocs/reception/class/reception.class.php index b2f31505c44..d5e3feaa255 100644 --- a/htdocs/reception/class/reception.class.php +++ b/htdocs/reception/class/reception.class.php @@ -384,7 +384,7 @@ class Reception extends CommonObject $sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_incoterms as i ON e.fk_incoterms = i.rowid'; $sql .= " WHERE e.entity IN (".getEntity('reception').")"; if ($id) { - $sql .= " AND e.rowid=".$id; + $sql .= " AND e.rowid=".((int) $id); } if ($ref) { $sql .= " AND e.ref='".$this->db->escape($ref)."'"; @@ -1356,7 +1356,7 @@ class Reception extends CommonObject $sql .= ",libelle='".$this->db->escape($this->update['libelle'])."'"; $sql .= ",description='".$this->db->escape($this->update['description'])."'"; $sql .= ",tracking='".$this->db->escape($this->update['tracking'])."'"; - $sql .= " WHERE rowid=".$id; + $sql .= " WHERE rowid=".((int) $id); $resql = $this->db->query($sql); } if ($resql < 0) { diff --git a/htdocs/societe/index.php b/htdocs/societe/index.php index a8a4c454c2c..f56beedb64e 100644 --- a/htdocs/societe/index.php +++ b/htdocs/societe/index.php @@ -274,7 +274,7 @@ if (!$user->rights->societe->client->voir && !$socid) { $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } if (!$user->rights->fournisseur->lire) { $sql .= " AND (s.fournisseur != 1 OR s.client != 0)"; diff --git a/htdocs/supplier_proposal/class/supplier_proposal.class.php b/htdocs/supplier_proposal/class/supplier_proposal.class.php index 0320a663ea8..728bf8f0fd9 100644 --- a/htdocs/supplier_proposal/class/supplier_proposal.class.php +++ b/htdocs/supplier_proposal/class/supplier_proposal.class.php @@ -1938,7 +1938,7 @@ class SupplierProposal extends CommonObject $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } if ($draft) { $sql .= " AND p.fk_statut = 0"; diff --git a/htdocs/supplier_proposal/index.php b/htdocs/supplier_proposal/index.php index 0cfdc5a09b6..75eba410d0f 100644 --- a/htdocs/supplier_proposal/index.php +++ b/htdocs/supplier_proposal/index.php @@ -315,7 +315,7 @@ if (!empty($conf->supplier_proposal->enabled) && $user->rights->supplier_proposa $sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; } if ($socid) { - $sql .= " AND s.rowid = ".$socid; + $sql .= " AND s.rowid = ".((int) $socid); } $sql .= " ORDER BY p.rowid DESC"; diff --git a/htdocs/user/class/usergroup.class.php b/htdocs/user/class/usergroup.class.php index f0b6bcdfe87..3738c63b435 100644 --- a/htdocs/user/class/usergroup.class.php +++ b/htdocs/user/class/usergroup.class.php @@ -504,7 +504,7 @@ class UserGroup extends CommonObject } $sql = "DELETE FROM ".MAIN_DB_PREFIX."usergroup_rights"; - $sql .= " WHERE fk_usergroup = $this->id AND fk_id=".$nid; + $sql .= " WHERE fk_usergroup = $this->id AND fk_id=".((int) $nid); $sql .= " AND entity = ".$entity; if (!$this->db->query($sql)) { $error++; From 9f03054fc45fac448fe76e3af0711a9ac7759fac Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sat, 24 Apr 2021 20:52:48 +0200 Subject: [PATCH 09/27] Fix #yogosha5877 --- htdocs/compta/bank/bankentries_list.php | 23 ++++++++++--------- htdocs/compta/bank/class/account.class.php | 2 +- .../bank/class/api_bankaccounts.class.php | 8 ++++++- htdocs/core/lib/functions.lib.php | 6 ++--- 4 files changed, 23 insertions(+), 16 deletions(-) diff --git a/htdocs/compta/bank/bankentries_list.php b/htdocs/compta/bank/bankentries_list.php index f6b719515cc..39967304e4c 100644 --- a/htdocs/compta/bank/bankentries_list.php +++ b/htdocs/compta/bank/bankentries_list.php @@ -791,7 +791,7 @@ if ($resql) { $nbmax = 12; // We show last 12 receipts (so we can have more than one year) $liste = ""; $sql = "SELECT DISTINCT num_releve FROM ".MAIN_DB_PREFIX."bank"; - $sql .= " WHERE fk_account=".$object->id." AND num_releve IS NOT NULL"; + $sql .= " WHERE fk_account = ".((int) $object->id)." AND num_releve IS NOT NULL"; $sql .= $db->order("num_releve", "DESC"); $sql .= $db->plimit($nbmax + 1); print '
'; @@ -967,7 +967,7 @@ if ($resql) { $moreforfilter = ''; $moreforfilter .= '
'; - $moreforfilter .= $langs->trans('DateOperationShort').' :'; + $moreforfilter .= $langs->trans('DateOperationShort').' '; $moreforfilter .= ($conf->browser->layout == 'phone' ? '
' : ' '); $moreforfilter .= '
'; $moreforfilter .= $form->selectDate($search_dt_start, 'search_start_dt', 0, 0, 1, "search_form", 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From')).'
'; @@ -976,7 +976,7 @@ if ($resql) { $moreforfilter .= '
'; $moreforfilter .= '
'; - $moreforfilter .= $langs->trans('DateValueShort').' : '; + $moreforfilter .= $langs->trans('DateValueShort').' '; $moreforfilter .= ($conf->browser->layout == 'phone' ? '
' : ' '); $moreforfilter .= '
'; $moreforfilter .= $form->selectDate($search_dv_start, 'search_start_dv', 0, 0, 1, "search_form", 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From')).'
'; @@ -1329,21 +1329,22 @@ if ($resql) { // Description if (!empty($arrayfields['b.label']['checked'])) { - print ""; - - //print "rowid."&account=".$objp->fk_account."\">"; + $labeltoshow = ''; + $titletoshow = ''; $reg = array(); preg_match('/\((.+)\)/i', $objp->label, $reg); // Si texte entoure de parenthee on tente recherche de traduction if ($reg[1] && $langs->trans($reg[1]) != $reg[1]) { - print $langs->trans($reg[1]); + $labeltoshow = $langs->trans($reg[1]); } else { if ($objp->label == '(payment_salary)') { - print dol_trunc($langs->trans("SalaryPayment", 40)); + $labeltoshow = dol_trunc($langs->trans("SalaryPayment", 40)); } else { - print dol_trunc($objp->label, 40); + $labeltoshow = dol_escape_htmltag($objp->label); + $titletoshow = $objp->label; } } - //print " "; + print ''; + print $labeltoshow; // Already escaped // Add links after description $cachebankaccount = array(); @@ -1498,7 +1499,7 @@ if ($resql) { // Num cheque if (!empty($arrayfields['b.num_chq']['checked'])) { - print ''.($objp->num_chq ? $objp->num_chq : "")."\n"; + print ''.($objp->num_chq ? dol_escape_htmltag($objp->num_chq) : "")."\n"; if (!$i) { $totalarray['nbfield']++; } diff --git a/htdocs/compta/bank/class/account.class.php b/htdocs/compta/bank/class/account.class.php index 13c2bdba4ce..4e2e60908d8 100644 --- a/htdocs/compta/bank/class/account.class.php +++ b/htdocs/compta/bank/class/account.class.php @@ -509,9 +509,9 @@ class Account extends CommonObject } // Clean parameters - $label = $emetteur = trim($emetteur); $banque = trim($banque); + $label = trim($label); $now = dol_now(); diff --git a/htdocs/compta/bank/class/api_bankaccounts.class.php b/htdocs/compta/bank/class/api_bankaccounts.class.php index 04ef9543867..0f13ed1e523 100644 --- a/htdocs/compta/bank/class/api_bankaccounts.class.php +++ b/htdocs/compta/bank/class/api_bankaccounts.class.php @@ -249,6 +249,10 @@ class BankAccounts extends DolibarrApi $typeto = 'LIQ'; } + // Clean data + $description = checkVal($description, 'alphanohtml'); + + /** * Creating bank line records */ @@ -295,7 +299,9 @@ class BankAccounts extends DolibarrApi return array( 'success' => array( 'code' => 201, - 'message' => 'Internal wire transfer created successfully.' + 'message' => 'Internal wire transfer created successfully.', + 'bank_id_from' => $bank_line_id_from, + 'bank_id_to' => $bank_line_id_to, ) ); } else { diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 7368510484f..cb48ac4d45d 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -686,11 +686,11 @@ function GETPOSTINT($paramname, $method = 0, $filter = null, $options = null, $n /** * Return a value after checking on a rule. * - * @param string $out Value to get/check - * @param string $check Type of check + * @param string $out Value to check/clear. + * @param string $check Type of check/sanitizing * @param int $filter Filter to apply when $check is set to 'custom'. (See http://php.net/manual/en/filter.filters.php for détails) * @param mixed $options Options to pass to filter_var when $check is set to 'custom' - * @return string|array Value found (string or array), or '' if check fails + * @return string|array Value sanitized (string or array). It may be '' if format check fails. */ function checkVal($out = '', $check = 'alphanohtml', $filter = null, $options = null) { From b2c2c552141d76b4d82ea67cc179dc81ac070ea0 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sat, 24 Apr 2021 21:00:26 +0200 Subject: [PATCH 10/27] Fix #yogosha5877 --- htdocs/product/class/api_products.class.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/htdocs/product/class/api_products.class.php b/htdocs/product/class/api_products.class.php index 6b26421d0f8..9b06b30765d 100644 --- a/htdocs/product/class/api_products.class.php +++ b/htdocs/product/class/api_products.class.php @@ -721,6 +721,11 @@ class Products extends DolibarrApi throw new RestException(404, 'Supplier not found'); } + // Clean data + $ref_fourn = checkVal($ref_fourn, 'alphanohtml'); + $desc_fourn = checkVal($desc_fourn, 'restricthtml'); + $barcode = checkVal($barcode, 'alphanohtml'); + $result = $this->productsupplier->update_buyprice($qty, $buyprice, DolibarrApiAccess::$user, $price_base_type, $fourn, $availability, $ref_fourn, $tva_tx, $charges, $remise_percent, $remise, $newnpr, $delivery_time_days, $supplier_reputation, $localtaxes_array, $newdefaultvatcode, $multicurrency_buyprice, $multicurrency_price_base_type, $multicurrency_tx, $multicurrency_code, $desc_fourn, $barcode, $fk_barcode_type); if ($result <= 0) { From ac68599fab8c79acbdaac5c3cb255ec904c8c2c7 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sat, 24 Apr 2021 21:02:48 +0200 Subject: [PATCH 11/27] Fix #yogosha5877 --- .../modulebuilder/template/class/api_mymodule.class.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/htdocs/modulebuilder/template/class/api_mymodule.class.php b/htdocs/modulebuilder/template/class/api_mymodule.class.php index da616de0d82..47a3ac984f9 100644 --- a/htdocs/modulebuilder/template/class/api_mymodule.class.php +++ b/htdocs/modulebuilder/template/class/api_mymodule.class.php @@ -208,12 +208,17 @@ class MyModuleApi extends DolibarrApi if (!DolibarrApiAccess::$user->rights->mymodule->write) { throw new RestException(401); } + // Check mandatory fields $result = $this->_validate($request_data); foreach ($request_data as $field => $value) { $this->myobject->$field = $value; } + + // Clean data + // $this->myobject->abc = checkVal($this->myobject->abc, 'alphanohtml'); + if ($this->myobject->create(DolibarrApiAccess::$user)<0) { throw new RestException(500, "Error creating MyObject", array_merge(array($this->myobject->error), $this->myobject->errors)); } @@ -253,6 +258,9 @@ class MyModuleApi extends DolibarrApi $this->myobject->$field = $value; } + // Clean data + // $this->myobject->abc = checkVal($this->myobject->abc, 'alphanohtml'); + if ($this->myobject->update(DolibarrApiAccess::$user, false) > 0) { return $this->get($id); } else { From 42938ffe31da85c013dc7e8598b5f913736f2393 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sat, 24 Apr 2021 21:15:09 +0200 Subject: [PATCH 12/27] FIX #yogosha5879 --- .../accountancy/class/bookkeeping.class.php | 8 +++--- htdocs/adherents/class/subscription.class.php | 2 +- htdocs/admin/boxes.php | 4 +-- htdocs/compta/bank/class/account.class.php | 26 +++++++++++-------- .../cheque/class/remisecheque.class.php | 2 +- .../class/bonprelevement.class.php | 4 +-- htdocs/compta/tva/class/tva.class.php | 2 +- 7 files changed, 26 insertions(+), 22 deletions(-) diff --git a/htdocs/accountancy/class/bookkeeping.class.php b/htdocs/accountancy/class/bookkeeping.class.php index 00ed8879076..a93b36cf2b4 100644 --- a/htdocs/accountancy/class/bookkeeping.class.php +++ b/htdocs/accountancy/class/bookkeeping.class.php @@ -371,8 +371,8 @@ class BookKeeping extends CommonObject $sql .= ", ".(!isset($this->date_lim_reglement) || dol_strlen($this->date_lim_reglement) == 0 ? 'NULL' : "'".$this->db->idate($this->date_lim_reglement)."'"); $sql .= ", '".$this->db->escape($this->doc_type)."'"; $sql .= ", '".$this->db->escape($this->doc_ref)."'"; - $sql .= ", ".$this->fk_doc; - $sql .= ", ".$this->fk_docdet; + $sql .= ", ".((int) $this->fk_doc); + $sql .= ", ".((int) $this->fk_docdet); $sql .= ", ".(!empty($this->thirdparty_code) ? ("'".$this->db->escape($this->thirdparty_code)."'") : "NULL"); $sql .= ", ".(!empty($this->subledger_account) ? ("'".$this->db->escape($this->subledger_account)."'") : "NULL"); $sql .= ", ".(!empty($this->subledger_label) ? ("'".$this->db->escape($this->subledger_label)."'") : "NULL"); @@ -632,8 +632,8 @@ class BookKeeping extends CommonObject $sql .= ' '.(!isset($this->date_lim_reglement) || dol_strlen($this->date_lim_reglement) == 0 ? 'NULL' : "'".$this->db->idate($this->date_lim_reglement)."'").','; $sql .= ' '.(!isset($this->doc_type) ? 'NULL' : "'".$this->db->escape($this->doc_type)."'").','; $sql .= ' '.(!isset($this->doc_ref) ? 'NULL' : "'".$this->db->escape($this->doc_ref)."'").','; - $sql .= ' '.(empty($this->fk_doc) ? '0' : $this->fk_doc).','; - $sql .= ' '.(empty($this->fk_docdet) ? '0' : $this->fk_docdet).','; + $sql .= ' '.(empty($this->fk_doc) ? '0' : (int) $this->fk_doc).','; + $sql .= ' '.(empty($this->fk_docdet) ? '0' : (int) $this->fk_docdet).','; $sql .= ' '.(!isset($this->thirdparty_code) ? 'NULL' : "'".$this->db->escape($this->thirdparty_code)."'").','; $sql .= ' '.(!isset($this->subledger_account) ? 'NULL' : "'".$this->db->escape($this->subledger_account)."'").','; $sql .= ' '.(!isset($this->subledger_label) ? 'NULL' : "'".$this->db->escape($this->subledger_label)."'").','; diff --git a/htdocs/adherents/class/subscription.class.php b/htdocs/adherents/class/subscription.class.php index 95bbe79804f..1285b12b2d0 100644 --- a/htdocs/adherents/class/subscription.class.php +++ b/htdocs/adherents/class/subscription.class.php @@ -165,7 +165,7 @@ class Subscription extends CommonObject } else { $type = $this->fk_type; } - $sql .= " VALUES (".$this->fk_adherent.", '".$this->db->escape($type)."', '".$this->db->idate($now)."',"; + $sql .= " VALUES (".((int) $this->fk_adherent).", '".$this->db->escape($type)."', '".$this->db->idate($now)."',"; $sql .= " '".$this->db->idate($this->dateh)."',"; $sql .= " '".$this->db->idate($this->datef)."',"; $sql .= " ".$this->amount.","; diff --git a/htdocs/admin/boxes.php b/htdocs/admin/boxes.php index fc3e30a484b..44629525a26 100644 --- a/htdocs/admin/boxes.php +++ b/htdocs/admin/boxes.php @@ -114,8 +114,8 @@ if ($action == 'add') { if (empty($arrayofexistingboxid[$boxid['value']])) { $sql = "INSERT INTO ".MAIN_DB_PREFIX."boxes ("; $sql .= "box_id, position, box_order, fk_user, entity"; - $sql .= ") values ("; - $sql .= $boxid['value'].", ".$pos.", '".(($nbboxonleft > $nbboxonright) ? 'B01' : 'A01')."', ".$fk_user.", ".$conf->entity; + $sql .= ") VALUES ("; + $sql .= $boxid['value'].", ".((int) $pos).", '".(($nbboxonleft > $nbboxonright) ? 'B01' : 'A01')."', ".$fk_user.", ".$conf->entity; $sql .= ")"; dol_syslog("boxes.php activate box", LOG_DEBUG); diff --git a/htdocs/compta/bank/class/account.class.php b/htdocs/compta/bank/class/account.class.php index 4e2e60908d8..5a00e93e83f 100644 --- a/htdocs/compta/bank/class/account.class.php +++ b/htdocs/compta/bank/class/account.class.php @@ -508,6 +508,10 @@ class Account extends CommonObject dol_syslog(__METHOD__.": using numeric operations is deprecated", LOG_WARNING); } + if (empty($this->id) && !empty($this->rowid)) { // For backward compatibility + $this->id = $this->rowid; + } + // Clean parameters $emetteur = trim($emetteur); $banque = trim($banque); @@ -534,8 +538,8 @@ class Account extends CommonObject $this->error = "oper not defined"; return -1; } - if (!$this->rowid) { - $this->error = "this->rowid not defined"; + if (!$this->id) { + $this->error = "this->id not defined"; return -2; } if ($this->courant == Account::TYPE_CASH && $oper != 'LIQ') { @@ -556,7 +560,7 @@ class Account extends CommonObject $accline->label = $label; $accline->amount = $amount; $accline->fk_user_author = $user->id; - $accline->fk_account = $this->rowid; + $accline->fk_account = $this->id; $accline->fk_type = $oper; $accline->numero_compte = $accountancycode; $accline->num_releve = $num_releve; @@ -575,10 +579,10 @@ class Account extends CommonObject if ($accline->insert() > 0) { if ($categorie > 0) { - $sql = "INSERT INTO ".MAIN_DB_PREFIX."bank_class ("; + $sql = "INSERT INTO ".MAIN_DB_PREFIX."bank_class("; $sql .= "lineid, fk_categ"; $sql .= ") VALUES ("; - $sql .= $accline->id.", ".$categorie; + $sql .= ((int) $accline->id).", '".$this->db->escape($categorie)."'"; $sql .= ")"; $result = $this->db->query($sql); @@ -611,7 +615,7 @@ class Account extends CommonObject */ public function create(User $user, $notrigger = 0) { - global $langs, $conf, $hookmanager; + global $langs, $conf; $error = 0; @@ -770,7 +774,7 @@ class Account extends CommonObject */ public function update(User $user, $notrigger = 0) { - global $langs, $conf, $hookmanager; + global $langs, $conf; $error = 0; @@ -796,9 +800,9 @@ class Account extends CommonObject $sql .= " ref = '".$this->db->escape($this->ref)."'"; $sql .= ",label = '".$this->db->escape($this->label)."'"; - $sql .= ",courant = ".$this->courant; - $sql .= ",clos = ".$this->clos; - $sql .= ",rappro = ".$this->rappro; + $sql .= ",courant = ".((int) $this->courant); + $sql .= ",clos = ".((int) $this->clos); + $sql .= ",rappro = ".((int) $this->rappro); $sql .= ",url = ".($this->url ? "'".$this->db->escape($this->url)."'" : "null"); $sql .= ",account_number = '".$this->db->escape($this->account_number)."'"; $sql .= ",fk_accountancy_journal = ".($this->fk_accountancy_journal > 0 ? $this->db->escape($this->fk_accountancy_journal) : "null"); @@ -824,7 +828,7 @@ class Account extends CommonObject $sql .= ",ics = '".$this->db->escape($this->ics)."'"; $sql .= ",ics_transfer = '".$this->db->escape($this->ics_transfer)."'"; - $sql .= " WHERE rowid = ".$this->id; + $sql .= " WHERE rowid = ".((int) $this->id); dol_syslog(get_class($this)."::update", LOG_DEBUG); $result = $this->db->query($sql); diff --git a/htdocs/compta/paiement/cheque/class/remisecheque.class.php b/htdocs/compta/paiement/cheque/class/remisecheque.class.php index 489d4c7cec0..0c05a1bc03a 100644 --- a/htdocs/compta/paiement/cheque/class/remisecheque.class.php +++ b/htdocs/compta/paiement/cheque/class/remisecheque.class.php @@ -171,7 +171,7 @@ class RemiseCheque extends CommonObject $sql .= "'".$this->db->idate($now)."'"; $sql .= ", '".$this->db->idate($now)."'"; $sql .= ", ".$user->id; - $sql .= ", ".$account_id; + $sql .= ", ".((int) $account_id); $sql .= ", 0"; $sql .= ", 0"; $sql .= ", 0"; diff --git a/htdocs/compta/prelevement/class/bonprelevement.class.php b/htdocs/compta/prelevement/class/bonprelevement.class.php index ea44a75899d..dbf2d67778a 100644 --- a/htdocs/compta/prelevement/class/bonprelevement.class.php +++ b/htdocs/compta/prelevement/class/bonprelevement.class.php @@ -229,9 +229,9 @@ class BonPrelevement extends CommonObject $sql .= ", cle_rib"; $sql .= ") VALUES ("; $sql .= $this->id; - $sql .= ", ".$client_id; + $sql .= ", ".((int) $client_id); $sql .= ", '".$this->db->escape($client_nom)."'"; - $sql .= ", '".price2num($amount)."'"; + $sql .= ", ".((float) price2num($amount)); $sql .= ", '".$this->db->escape($code_banque)."'"; $sql .= ", '".$this->db->escape($code_guichet)."'"; $sql .= ", '".$this->db->escape($number)."'"; diff --git a/htdocs/compta/tva/class/tva.class.php b/htdocs/compta/tva/class/tva.class.php index 25d622d825d..ff35ece947b 100644 --- a/htdocs/compta/tva/class/tva.class.php +++ b/htdocs/compta/tva/class/tva.class.php @@ -585,7 +585,7 @@ class Tva extends CommonObject $sql .= " '".$this->db->idate($this->datec)."'"; $sql .= ", '".$this->db->idate($this->datep)."'"; $sql .= ", '".$this->db->idate($this->datev)."'"; - $sql .= ", ".$this->amount; + $sql .= ", ".((float) $this->amount); $sql .= ", '".$this->db->escape($this->type_payment)."'"; $sql .= ", '".$this->db->escape($this->num_payment)."'"; if ($this->note) { From 2fd2c671391d9b5a423063f3707266013b819d9b Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sun, 25 Apr 2021 15:09:56 +0200 Subject: [PATCH 13/27] Clean edit of user card --- htdocs/core/class/html.formcompany.class.php | 4 +- htdocs/core/lib/ajax.lib.php | 6 +- htdocs/langs/en_US/main.lang | 4 +- htdocs/langs/en_US/users.lang | 3 +- htdocs/theme/eldy/global.inc.php | 3 + htdocs/theme/md/style.css.php | 3 + htdocs/user/card.php | 447 ++++++++++--------- 7 files changed, 253 insertions(+), 217 deletions(-) diff --git a/htdocs/core/class/html.formcompany.class.php b/htdocs/core/class/html.formcompany.class.php index 6677f7f8dce..48f46860717 100644 --- a/htdocs/core/class/html.formcompany.class.php +++ b/htdocs/core/class/html.formcompany.class.php @@ -312,9 +312,9 @@ class FormCompany extends Form $out .= ''; } else { if (!$country || $country != $obj->country) { - // Affiche la rupture si on est en mode liste multipays + // Show break if we are in list with multiple countries if (!$country_codeid && $obj->country_code) { - $out .= '\n"; + $out .= '\n"; $country = $obj->country; } } diff --git a/htdocs/core/lib/ajax.lib.php b/htdocs/core/lib/ajax.lib.php index 4108724236d..8874b96eda5 100644 --- a/htdocs/core/lib/ajax.lib.php +++ b/htdocs/core/lib/ajax.lib.php @@ -454,8 +454,10 @@ function ajax_combobox($htmlname, $events = array(), $minLengthToAutocomplete = templateResult: function (data, container) { /* Format visible output into combo list */ /* Code to add class of origin OPTION propagated to the new select2
  • tag */ if (data.element) { $(container).addClass($(data.element).attr("class")); } - //console.log(data.html); - if (data.id == -1) return \' \'; + console.log($(data.element).attr("data-html")); + if (data.id == -1 && $(data.element).attr("data-html") == undefined) { + return \' \'; + } if ($(data.element).attr("data-html") != undefined) return htmlEntityDecodeJs($(data.element).attr("data-html")); // If property html set, we decode html entities and use this return data.text; }, diff --git a/htdocs/langs/en_US/main.lang b/htdocs/langs/en_US/main.lang index dc2a83f2015..8fea1ffd839 100644 --- a/htdocs/langs/en_US/main.lang +++ b/htdocs/langs/en_US/main.lang @@ -503,9 +503,11 @@ By=By From=From FromDate=From FromLocation=From -at=at to=to To=to +ToDate=to +ToLocation=to +at=at and=and or=or Other=Other diff --git a/htdocs/langs/en_US/users.lang b/htdocs/langs/en_US/users.lang index 727773a9606..d84257b69ad 100644 --- a/htdocs/langs/en_US/users.lang +++ b/htdocs/langs/en_US/users.lang @@ -12,6 +12,7 @@ PasswordChangedTo=Password changed to: %s SubjectNewPassword=Your new password for %s GroupRights=Group permissions UserRights=User permissions +Credentials=Credentials UserGUISetup=User Display Setup DisableUser=Disable DisableAUser=Disable a user @@ -115,7 +116,7 @@ DateOfEmployment=Employment date DateEmployment=Employment DateEmploymentstart=Employment Start Date DateEmploymentEnd=Employment End Date -RangeOfLoginValidity=Date range of login validity +RangeOfLoginValidity=Access validity date range CantDisableYourself=You can't disable your own user record ForceUserExpenseValidator=Force expense report validator ForceUserHolidayValidator=Force leave request validator diff --git a/htdocs/theme/eldy/global.inc.php b/htdocs/theme/eldy/global.inc.php index 12d9677c4b5..3622d77de2f 100644 --- a/htdocs/theme/eldy/global.inc.php +++ b/htdocs/theme/eldy/global.inc.php @@ -1354,6 +1354,9 @@ table[summary="list_of_modules"] .fa-cog { .width125 { width: 125px; } .width150 { width: 150px; } .width200 { width: 200px; } +.width300 { width: 300px; } +.width400 { width: 400px; } +.width500 { width: 500px; } .maxwidth25 { max-width: 25px; } .maxwidth50 { max-width: 50px; } .maxwidth75 { max-width: 75px; } diff --git a/htdocs/theme/md/style.css.php b/htdocs/theme/md/style.css.php index 87a9d6b1b47..7b49acc63b5 100644 --- a/htdocs/theme/md/style.css.php +++ b/htdocs/theme/md/style.css.php @@ -1390,6 +1390,9 @@ table[summary="list_of_modules"] .fa-cog { .width125 { width: 125px; } .width150 { width: 150px; } .width200 { width: 200px; } +.width300 { width: 300px; } +.width400 { width: 400px; } +.width500 { width: 500px; } .maxwidth25 { max-width: 25px; } .maxwidth50 { max-width: 50px; } .maxwidth75 { max-width: 75px; } diff --git a/htdocs/user/card.php b/htdocs/user/card.php index 57d5c44615f..9d2039a4678 100644 --- a/htdocs/user/card.php +++ b/htdocs/user/card.php @@ -839,54 +839,6 @@ if ($action == 'create' || $action == 'adduserldap') { } $password = (GETPOSTISSET('password') ?GETPOST('password') : $generated_password); - // Password - print ''.$langs->trans("Password").''; - print ''; - $valuetoshow = ''; - if (preg_match('/ldap/', $dolibarr_main_authentication)) { - $valuetoshow .= ($valuetoshow ? ', ' : '').$langs->trans("PasswordOfUserInLDAP"); - } - if (preg_match('/http/', $dolibarr_main_authentication)) { - $valuetoshow .= ($valuetoshow ? ', ' : '').$langs->trans("HTTPBasicPassword"); - } - if (preg_match('/dolibarr/', $dolibarr_main_authentication)) { - if (!empty($ldap_pass)) { // For very old system comaptibilty. Now clear password can't be viewed from LDAP read - $valuetoshow .= ($valuetoshow ? ', ' : '').''; // Dolibarr password is preffiled with LDAP known password - $valuetoshow .= preg_replace('/./i', '*', $ldap_pass); - } else { - // We do not use a field password but a field text to show new password to use. - $valuetoshow .= ($valuetoshow ? ', ' : '').''; - } - } - - // Other form for user password - $parameters = array('valuetoshow' => $valuetoshow, 'password' => $password); - $reshook = $hookmanager->executeHooks('printUserPasswordField', $parameters, $object, $action); // Note that $action and $object may have been modified by hook - if ($reshook > 0) { - $valuetoshow = $hookmanager->resPrint; // to replace - } else { - $valuetoshow .= $hookmanager->resPrint; // to add - } - - print $valuetoshow; - print ''; - - if (!empty($conf->api->enabled)) { - // API key - //$generated_password = getRandomPassword(false); - print ''.$langs->trans("ApiKey").''; - print ''; - print ''; - if (!empty($conf->use_javascript_ajax)) { - print ' '.img_picto($langs->trans('Generate'), 'refresh', 'id="generate_api_key" class="linkobject"'); - } - print ''; - } else { - // PARTIAL WORKAROUND - $generated_fake_api_key = getRandomPassword(false); - print ''; - } - // Administrator if (!empty($user->admin)) { print ''.$langs->trans("Administrator").''; @@ -936,10 +888,11 @@ if ($action == 'create' || $action == 'adduserldap') { print ''; // Employee - $defaultemployee = 1; + $defaultemployee = '1'; print ''; print ''.$langs->trans('Employee').''; - print $form->selectyesno("employee", (GETPOST('employee') != '' ?GETPOST('employee') : $defaultemployee), 1); + print ''; + //print $form->selectyesno("employee", (GETPOST('employee') != '' ?GETPOST('employee') : $defaultemployee), 1); print ''; // Hierarchy @@ -979,6 +932,70 @@ if ($action == 'create' || $action == 'adduserldap') { print $form->textwithpicto($langs->trans("Internal"), $langs->trans("InternalExternalDesc"), 1, 'help', '', 0, 2); print ''; + + print '
    '; + + + // Date validity + print ''; + print ''; + print "\n"; + + // Password + print ''; + print ''; + + if (!empty($conf->api->enabled)) { + // API key + //$generated_password = getRandomPassword(false); + print ''; + print ''; + } else { + // PARTIAL WORKAROUND + $generated_fake_api_key = getRandomPassword(false); + print ''; + } + + print '
    '.$langs->trans("RangeOfLoginValidity").''; + print $form->selectDate($datestartvalidity, 'datestartvalidity', 0, 0, 1, 'formdatestartvalidity', 1, 1); + + print '   '; + + print $form->selectDate($dateendvalidity, 'dateendvalidity', 0, 0, 1, 'formdateendvalidity', 1, 0); + print '
    '.$langs->trans("Password").''; + $valuetoshow = ''; + if (preg_match('/ldap/', $dolibarr_main_authentication)) { + $valuetoshow .= ($valuetoshow ? ', ' : '').$langs->trans("PasswordOfUserInLDAP"); + } + if (preg_match('/http/', $dolibarr_main_authentication)) { + $valuetoshow .= ($valuetoshow ? ', ' : '').$langs->trans("HTTPBasicPassword"); + } + if (preg_match('/dolibarr/', $dolibarr_main_authentication)) { + if (!empty($ldap_pass)) { // For very old system comaptibilty. Now clear password can't be viewed from LDAP read + $valuetoshow .= ($valuetoshow ? ', ' : '').''; // Dolibarr password is preffiled with LDAP known password + $valuetoshow .= preg_replace('/./i', '*', $ldap_pass); + } else { + // We do not use a field password but a field text to show new password to use. + $valuetoshow .= ($valuetoshow ? ', ' : '').''; + } + } + + // Other form for user password + $parameters = array('valuetoshow' => $valuetoshow, 'password' => $password); + $reshook = $hookmanager->executeHooks('printUserPasswordField', $parameters, $object, $action); // Note that $action and $object may have been modified by hook + if ($reshook > 0) { + $valuetoshow = $hookmanager->resPrint; // to replace + } else { + $valuetoshow .= $hookmanager->resPrint; // to add + } + + print $valuetoshow; + print '
    '.$langs->trans("ApiKey").''; + print ''; + if (!empty($conf->use_javascript_ajax)) { + print ' '.img_picto($langs->trans('Generate'), 'refresh', 'id="generate_api_key" class="linkobject"'); + } + print '
    '; @@ -1223,17 +1240,6 @@ if ($action == 'create' || $action == 'adduserldap') { print ''; print "\n"; - // Date validity - print ''; - print ''; - print "\n"; - // Date birth print ''; print '
    '.$langs->trans("RangeOfLoginValidity").''; - print $form->selectDate($datestartvalidity, 'datestartvalidity', 0, 0, 1, 'formdatestartvalidity', 1, 1); - - print ' - '; - - print $form->selectDate($dateendvalidity, 'dateendvalidity', 0, 0, 1, 'formdateendvalidity', 1, 0); - print '
    '.$langs->trans("DateOfBirth").''; @@ -1371,7 +1377,7 @@ if ($action == 'create' || $action == 'adduserldap') { print ''; // Login - print ''; + print ''; if (!empty($object->ldap_sid) && $object->statut == 0) { print ''; } else { @@ -1379,72 +1385,6 @@ if ($action == 'create' || $action == 'adduserldap') { } print ''."\n"; - // Password - print ''; - - print '"; - print ''."\n"; - - // API key - if (!empty($conf->api->enabled) && $user->admin) { - print ''; - print ''; - } - // Administrator print ''."\n"; // TODO Move this into tab RH, visible when salarie or RH is visible (HierarchicalResponsible must be on both tab) @@ -1604,20 +1545,6 @@ if ($action == 'create' || $action == 'adduserldap') { print ''; print "\n"; - // Date login validity - print ''; - print ''; - print "\n"; - // Date of birth print ''; print ''; print ''; - // Pass - print ''; - print '\n"; - - // API key - if (!empty($conf->api->enabled) && $user->admin) { - print ''; - print ''; - } - // Administrator print ''; if ($object->socid > 0) { @@ -2145,13 +2123,15 @@ if ($action == 'create' || $action == 'adduserldap') { print ''; print ''; @@ -2246,6 +2226,74 @@ if ($action == 'create' || $action == 'adduserldap') { } print ''; + + print '
    '.$langs->trans("Login").'
    '.$langs->trans("Login").''.$langs->trans("LoginAccountDisableInDolibarr").'
    '.$langs->trans("Password").''; - $valuetoshow = ''; - if (preg_match('/ldap/', $dolibarr_main_authentication)) { - if (!empty($object->ldap_sid)) { - if ($passDoNotExpire) { - $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').$langs->trans("LdapUacf_".$statutUACF); - } elseif ($userChangePassNextLogon) { - $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').''.$langs->trans("UserMustChangePassNextLogon", $ldap->domainFQDN).''; - } elseif ($userDisabled) { - $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').''.$langs->trans("LdapUacf_".$statutUACF, $ldap->domainFQDN).''; - } else { - $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').$langs->trans("PasswordOfUserInLDAP"); - } - } else { - $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').$langs->trans("PasswordOfUserInLDAP"); - } - } - if (preg_match('/http/', $dolibarr_main_authentication)) { - $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').$langs->trans("HTTPBasicPassword"); - } - if (preg_match('/dolibarr/', $dolibarr_main_authentication)) { - if ($object->pass) { - $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : ''); - $valuetoshow .= ''.$langs->trans("Hidden").''; - } else { - if ($user->admin && $user->id == $object->id) { - $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : ''); - //$valuetoshow .= ''.$langs->trans("Crypted").' - '; - $valuetoshow .= ''.$langs->trans("Hidden").''; - // TODO Add a feature to reveal the hash - $valuetoshow .= ''; - } else { - $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').''.$langs->trans("Hidden").''; - } - } - } - - // Other form for user password - $parameters = array('valuetoshow' => $valuetoshow); - $reshook = $hookmanager->executeHooks('printUserPasswordField', $parameters, $object, $action); // Note that $action and $object may have been modified by hook - if ($reshook > 0) { - $valuetoshow = $hookmanager->resPrint; // to replace - } else { - $valuetoshow .= $hookmanager->resPrint; // to add - } - - print $valuetoshow; - print "
    '.$langs->trans("ApiKey").''; - if (!empty($object->api_key)) { - print ''.preg_replace('/./', '*', $object->api_key).''; - } - if ($user->admin || $user->id == $object->id) { - // TODO Add a feature to reveal the hash - } - print '
    '.$langs->trans("Administrator").''; if (!empty($conf->multicompany->enabled) && $object->admin && !$object->entity) { @@ -1480,7 +1420,8 @@ if ($action == 'create' || $action == 'adduserldap') { // Employee print '
    '.$langs->trans("Employee").''; - print yn($object->employee); + print 'employee ? ' checked="checked"' : '').'>'; + //print yn($object->employee); print '
    '.$langs->trans("RangeOfLoginValidity").''; - if ($object->datestartvalidity) { - print ''.$langs->trans("FromDate").' '; - print dol_print_date($object->datestartvalidity, 'day'); - } - if ($object->dateendvalidity) { - print ' - '.$langs->trans("To").' '; - print dol_print_date($object->dateendvalidity, 'day'); - } - print '
    '.$langs->trans("DateOfBirth").''; @@ -1637,6 +1564,7 @@ if ($action == 'create' || $action == 'adduserldap') { print '
    '; print '
    '; + print ''; // Color user @@ -1755,7 +1683,7 @@ if ($action == 'create' || $action == 'adduserldap') { print dol_htmlentitiesbr($object->signature); print "\n"; - //VCard + // VCard print ''; print '\n"; print "
    '.$langs->trans("VCard").''; print ''; @@ -1765,6 +1693,97 @@ if ($action == 'create' || $action == 'adduserldap') { print "
    \n"; + + + print '
    '; + print ''; + print ''; + print ''; + print ''; + + // Date login validity + print ''; + print ''; + print "\n"; + + // Password + print ''; + + print '"; + print ''."\n"; + + // API key + if (!empty($conf->api->enabled) && $user->admin) { + print ''; + print ''; + } + print '
    '; + print $langs->trans("Credentials"); + print '
    '.$langs->trans("RangeOfLoginValidity").''; + if ($object->datestartvalidity) { + print ''.$langs->trans("FromDate").' '; + print dol_print_date($object->datestartvalidity, 'day'); + } + if ($object->dateendvalidity) { + print ' - '.$langs->trans("To").' '; + print dol_print_date($object->dateendvalidity, 'day'); + } + print '
    '.$langs->trans("Password").''; + $valuetoshow = ''; + if (preg_match('/ldap/', $dolibarr_main_authentication)) { + if (!empty($object->ldap_sid)) { + if ($passDoNotExpire) { + $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').$langs->trans("LdapUacf_".$statutUACF); + } elseif ($userChangePassNextLogon) { + $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').''.$langs->trans("UserMustChangePassNextLogon", $ldap->domainFQDN).''; + } elseif ($userDisabled) { + $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').''.$langs->trans("LdapUacf_".$statutUACF, $ldap->domainFQDN).''; + } else { + $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').$langs->trans("PasswordOfUserInLDAP"); + } + } else { + $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').$langs->trans("PasswordOfUserInLDAP"); + } + } + if (preg_match('/http/', $dolibarr_main_authentication)) { + $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').$langs->trans("HTTPBasicPassword"); + } + if (preg_match('/dolibarr/', $dolibarr_main_authentication)) { + if ($object->pass) { + $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : ''); + $valuetoshow .= ''.$langs->trans("Hidden").''; + } else { + if ($user->admin && $user->id == $object->id) { + $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : ''); + //$valuetoshow .= ''.$langs->trans("Crypted").' - '; + $valuetoshow .= ''.$langs->trans("Hidden").''; + // TODO Add a feature to reveal the hash + $valuetoshow .= ''; + } else { + $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').''.$langs->trans("Hidden").''; + } + } + } + + // Other form for user password + $parameters = array('valuetoshow' => $valuetoshow); + $reshook = $hookmanager->executeHooks('printUserPasswordField', $parameters, $object, $action); // Note that $action and $object may have been modified by hook + if ($reshook > 0) { + $valuetoshow = $hookmanager->resPrint; // to replace + } else { + $valuetoshow .= $hookmanager->resPrint; // to add + } + + print $valuetoshow; + print "
    '.$langs->trans("ApiKey").''; + if (!empty($object->api_key)) { + print ''.preg_replace('/./', '*', $object->api_key).''; + } + if ($user->admin || $user->id == $object->id) { + // TODO Add a feature to reveal the hash + } + print '
    '; + print '
    '; print '
    '; @@ -2011,47 +2030,6 @@ if ($action == 'create' || $action == 'adduserldap') { print '
    '.$langs->trans("Password").''; - $valuetoshow = ''; - if (preg_match('/ldap/', $dolibarr_main_authentication)) { - $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').$langs->trans("PasswordOfUserInLDAP"); - } - if (preg_match('/http/', $dolibarr_main_authentication)) { - $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').$form->textwithpicto($text, $langs->trans("DolibarrInHttpAuthenticationSoPasswordUseless", $dolibarr_main_authentication), 1, 'warning'); - } - if (preg_match('/dolibarr/', $dolibarr_main_authentication)) { - if ($caneditpassword) { - $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').''; - } else { - $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').preg_replace('/./i', '*', $object->pass); - } - } - - // Other form for user password - $parameters = array('valuetoshow' => $valuetoshow, 'caneditpassword' => $caneditpassword); - $reshook = $hookmanager->executeHooks('printUserPasswordField', $parameters, $object, $action); // Note that $action and $object may have been modified by hook - if ($reshook > 0) { - $valuetoshow = $hookmanager->resPrint; // to replace - } else { - $valuetoshow .= $hookmanager->resPrint; // to add - } - - print $valuetoshow; - print "
    '.$langs->trans("ApiKey").''; - print ''; - if (!empty($conf->use_javascript_ajax)) { - print ' '.img_picto($langs->trans('Generate'), 'refresh', 'id="generate_api_key" class="linkobject"'); - } - print '
    '.$langs->trans("Administrator").'
    '.$form->editfieldkey('Employee', 'employee', '', $object, 0).''; if ($caneditfield) { - print $form->selectyesno("employee", $object->employee, 1); + print 'employee ? ' checked="checked"' : '').'>'; + //print $form->selectyesno("employee", $object->employee, 1); } else { - if ($object->employee) { + print 'employee ? ' checked="checked"' : '').'>'; + /*if ($object->employee) { print $langs->trans("Yes"); } else { print $langs->trans("No"); - } + }*/ } print '
    '; + + + // Date access validity + print ''; + print ''; + print "\n"; + + // Pass + print ''; + print '\n"; + + // API key + if (!empty($conf->api->enabled) && $user->admin) { + print ''; + print ''; + } + + print '
    '.$langs->trans("RangeOfLoginValidity").''; + if ($caneditfield) { + print $form->selectDate($datestartvalidity ? $datestartvalidity : $object->datestartvalidity, 'datestartvalidity', 0, 0, 1, 'formdatestartvalidity', 1, 1, 0, '', '', '', '', 1, '', ''); + } else { + print dol_print_date($object->datestartvalidity, 'day'); + } + + /*if ($datestartvalidity && $dateendvalidity) { + print ' - '; + }*/ + print '   '; + + if ($caneditfield) { + print $form->selectDate($dateendvalidity ? $datendevalidity : $object->dateendvalidity, 'dateendvalidity', 0, 0, 1, 'formdateendvalidity', 1, 0, 0, '', '', '', '', 1, '', ''); + } else { + print dol_print_date($object->dateendvalidity, 'day'); + } + print '
    '.$langs->trans("Password").''; + $valuetoshow = ''; + if (preg_match('/ldap/', $dolibarr_main_authentication)) { + $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').$langs->trans("PasswordOfUserInLDAP"); + } + if (preg_match('/http/', $dolibarr_main_authentication)) { + $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').$form->textwithpicto($text, $langs->trans("DolibarrInHttpAuthenticationSoPasswordUseless", $dolibarr_main_authentication), 1, 'warning'); + } + if (preg_match('/dolibarr/', $dolibarr_main_authentication)) { + if ($caneditpassword) { + $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').''; + } else { + $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').preg_replace('/./i', '*', $object->pass); + } + } + + // Other form for user password + $parameters = array('valuetoshow' => $valuetoshow, 'caneditpassword' => $caneditpassword); + $reshook = $hookmanager->executeHooks('printUserPasswordField', $parameters, $object, $action); // Note that $action and $object may have been modified by hook + if ($reshook > 0) { + $valuetoshow = $hookmanager->resPrint; // to replace + } else { + $valuetoshow .= $hookmanager->resPrint; // to add + } + + print $valuetoshow; + print "
    '.$langs->trans("ApiKey").''; + print ''; + if (!empty($conf->use_javascript_ajax)) { + print ' '.img_picto($langs->trans('Generate'), 'refresh', 'id="generate_api_key" class="linkobject"'); + } + print '
    '; @@ -2636,29 +2684,6 @@ if ($action == 'create' || $action == 'adduserldap') { print ''; print "\n"; - - // Date login validity - print ''; - print ''; - print "\n"; - - // Date birth print ''; print ''; - print '\n"; From fd2d317b4af758680c4173c1c3d3a5ae795983c7 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sun, 25 Apr 2021 15:55:36 +0200 Subject: [PATCH 15/27] Fix #yogosha5881 --- htdocs/accountancy/journal/bankjournal.php | 2 +- htdocs/comm/action/card.php | 2 +- htdocs/comm/mailing/card.php | 4 ++-- htdocs/comm/mailing/cibles.php | 2 -- htdocs/comm/propal/card.php | 4 ++-- htdocs/commande/card.php | 4 ++-- htdocs/commande/class/commande.class.php | 8 ++++++-- htdocs/compta/bank/account_statement_document.php | 2 +- htdocs/compta/bank/line.php | 2 +- htdocs/compta/bank/various_payment/list.php | 2 +- htdocs/compta/deplacement/card.php | 2 +- htdocs/compta/facture/card-rec.php | 6 +++--- htdocs/compta/facture/card.php | 10 +++++----- htdocs/compta/facture/class/facture-rec.class.php | 2 +- htdocs/compta/facture/class/facture.class.php | 2 +- htdocs/compta/prelevement/card.php | 2 +- htdocs/compta/prelevement/factures.php | 2 +- htdocs/compta/prelevement/line.php | 2 +- htdocs/contrat/card.php | 4 ++-- htdocs/contrat/class/contrat.class.php | 2 +- htdocs/core/class/commonobject.class.php | 2 +- htdocs/core/lib/company.lib.php | 2 +- htdocs/core/tpl/resource_view.tpl.php | 4 ++-- htdocs/don/card.php | 2 +- htdocs/expedition/class/expeditionbatch.class.php | 4 +--- htdocs/expedition/shipment.php | 2 +- htdocs/fourn/class/fournisseur.facture.class.php | 2 +- htdocs/fourn/commande/card.php | 4 ++-- htdocs/fourn/commande/dispatch.php | 2 +- htdocs/fourn/facture/card.php | 2 +- htdocs/ftp/admin/ftpclient.php | 1 + htdocs/install/lib/repair.lib.php | 2 +- htdocs/intracommreport/card.php | 2 +- htdocs/margin/productMargins.php | 2 +- htdocs/product/class/product.class.php | 4 ++-- htdocs/product/price.php | 2 +- htdocs/product/stock/card.php | 2 +- htdocs/reception/class/reception.class.php | 2 +- htdocs/societe/list.php | 2 +- htdocs/supplier_proposal/card.php | 2 +- htdocs/ticket/class/ticket.class.php | 2 +- htdocs/user/notify/card.php | 6 +++--- htdocs/variants/combinations.php | 2 +- 43 files changed, 62 insertions(+), 61 deletions(-) diff --git a/htdocs/accountancy/journal/bankjournal.php b/htdocs/accountancy/journal/bankjournal.php index 741b2c9f038..e3e2a308cf9 100644 --- a/htdocs/accountancy/journal/bankjournal.php +++ b/htdocs/accountancy/journal/bankjournal.php @@ -130,7 +130,7 @@ $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."bank_url as bu3 ON bu3.fk_bank = b.rowid A $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."bank_url as bu4 ON bu4.fk_bank = b.rowid AND bu4.type='payment_supplier'"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe as soc on bu1.url_id=soc.rowid"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."user as u on bu2.url_id=u.rowid"; -$sql .= " WHERE ba.fk_accountancy_journal=".$id_journal; +$sql .= " WHERE ba.fk_accountancy_journal=".((int) $id_journal); $sql .= ' AND b.amount != 0 AND ba.entity IN ('.getEntity('bank_account', 0).')'; // We don't share object for accountancy if ($date_start && $date_end) { $sql .= " AND b.dateo >= '".$db->idate($date_start)."' AND b.dateo <= '".$db->idate($date_end)."'"; diff --git a/htdocs/comm/action/card.php b/htdocs/comm/action/card.php index 74ff6c6aa62..322a688bd45 100644 --- a/htdocs/comm/action/card.php +++ b/htdocs/comm/action/card.php @@ -1395,7 +1395,7 @@ if ($id > 0) { // Confirmation suppression action if ($action == 'delete') { - print $form->formconfirm("card.php?id=".$id, $langs->trans("DeleteAction"), $langs->trans("ConfirmDeleteAction"), "confirm_delete", '', '', 1); + print $form->formconfirm("card.php?id=".urlencode($id), $langs->trans("DeleteAction"), $langs->trans("ConfirmDeleteAction"), "confirm_delete", '', '', 1); } if ($action == 'edit') { diff --git a/htdocs/comm/mailing/card.php b/htdocs/comm/mailing/card.php index 4958811ef4d..c3ef480d2ae 100644 --- a/htdocs/comm/mailing/card.php +++ b/htdocs/comm/mailing/card.php @@ -308,7 +308,7 @@ if (empty($reshook)) { dol_syslog("comm/mailing/card.php: ok for #".$i.($mail->error ? ' - '.$mail->error : ''), LOG_DEBUG); $sql = "UPDATE ".MAIN_DB_PREFIX."mailing_cibles"; - $sql .= " SET statut=1, date_envoi='".$db->idate($now)."' WHERE rowid=".$obj->rowid; + $sql .= " SET statut=1, date_envoi = '".$db->idate($now)."' WHERE rowid=".((int) $obj->rowid); $resql2 = $db->query($sql); if (!$resql2) { dol_print_error($db); @@ -378,7 +378,7 @@ if (empty($reshook)) { } } - $sql = "UPDATE ".MAIN_DB_PREFIX."mailing SET statut=".$statut." WHERE rowid=".$object->id; + $sql = "UPDATE ".MAIN_DB_PREFIX."mailing SET statut=".((int) $statut)." WHERE rowid = ".((int) $object->id); dol_syslog("comm/mailing/card.php: update global status", LOG_DEBUG); $resql2 = $db->query($sql); if (!$resql2) { diff --git a/htdocs/comm/mailing/cibles.php b/htdocs/comm/mailing/cibles.php index 27859403d96..afd6273d6c0 100644 --- a/htdocs/comm/mailing/cibles.php +++ b/htdocs/comm/mailing/cibles.php @@ -104,8 +104,6 @@ if ($action == 'add') { } if ($result > 0) { setEventMessages($langs->trans("XTargetsAdded", $result), null, 'mesgs'); - //header("Location: ".$_SERVER['PHP_SELF']."?id=".$id); - //exit; $action = ''; } if ($result == 0) { diff --git a/htdocs/comm/propal/card.php b/htdocs/comm/propal/card.php index ebca0177868..44e2ad8a4cd 100644 --- a/htdocs/comm/propal/card.php +++ b/htdocs/comm/propal/card.php @@ -1248,7 +1248,7 @@ if (empty($reshook)) { if (empty($user->rights->margins->creer)) { foreach ($object->lines as &$line) { - if ($line->id == GETPOST('lineid')) { + if ($line->id == GETPOST('lineid', 'int')) { $fournprice = $line->fk_fournprice; $buyingprice = $line->pa_ht; break; @@ -2433,7 +2433,7 @@ if ($action == 'create') { // Show object lines $result = $object->getLinesArray(); - print '
    + print ' diff --git a/htdocs/commande/card.php b/htdocs/commande/card.php index 0665a567738..12117a5f1cb 100644 --- a/htdocs/commande/card.php +++ b/htdocs/commande/card.php @@ -1052,7 +1052,7 @@ if (empty($reshook)) { if (!$error) { if (empty($user->rights->margins->creer)) { foreach ($object->lines as &$line) { - if ($line->id == GETPOST('lineid')) { + if ($line->id == GETPOST('lineid', 'int')) { $fournprice = $line->fk_fournprice; $buyingprice = $line->pa_ht; break; @@ -2416,7 +2416,7 @@ if ($action == 'create' && $usercancreate) { */ $result = $object->getLinesArray(); - print ' + print ' diff --git a/htdocs/commande/class/commande.class.php b/htdocs/commande/class/commande.class.php index c89ad9340d2..40fd3892c4c 100644 --- a/htdocs/commande/class/commande.class.php +++ b/htdocs/commande/class/commande.class.php @@ -4206,11 +4206,15 @@ class OrderLine extends CommonOrderLine $error = 0; + if (empty($this->id) && !empty($this->rowid)) { // For backward compatibility + $this->id = $this->rowid; + } + // check if order line is not in a shipment line before deleting $sqlCheckShipmentLine = "SELECT"; $sqlCheckShipmentLine .= " ed.rowid"; $sqlCheckShipmentLine .= " FROM ".MAIN_DB_PREFIX."expeditiondet ed"; - $sqlCheckShipmentLine .= " WHERE ed.fk_origin_line = ".$this->rowid; + $sqlCheckShipmentLine .= " WHERE ed.fk_origin_line = ".((int) $this->id); $resqlCheckShipmentLine = $this->db->query($sqlCheckShipmentLine); if (!$resqlCheckShipmentLine) { @@ -4235,7 +4239,7 @@ class OrderLine extends CommonOrderLine $this->db->begin(); - $sql = 'DELETE FROM '.MAIN_DB_PREFIX."commandedet WHERE rowid=".$this->rowid; + $sql = 'DELETE FROM '.MAIN_DB_PREFIX."commandedet WHERE rowid = ".((int) $this->id); dol_syslog("OrderLine::delete", LOG_DEBUG); $resql = $this->db->query($sql); diff --git a/htdocs/compta/bank/account_statement_document.php b/htdocs/compta/bank/account_statement_document.php index 6103df38f66..4f317c1a9ed 100644 --- a/htdocs/compta/bank/account_statement_document.php +++ b/htdocs/compta/bank/account_statement_document.php @@ -129,7 +129,7 @@ if (!empty($numref)) { $object->fetch_thirdparty(); $upload_dir = $conf->bank->dir_output."/".$id."/statement/".dol_sanitizeFileName($numref); } -$backtopage = $_SERVER['PHP_SELF']."?account=".$id."&num=".$numref; +$backtopage = $_SERVER['PHP_SELF']."?account=".urlencode($id)."&num=".urlencode($numref); include DOL_DOCUMENT_ROOT.'/core/actions_linkedfiles.inc.php'; diff --git a/htdocs/compta/bank/line.php b/htdocs/compta/bank/line.php index 3aa477dfc9c..76f7f821f8a 100644 --- a/htdocs/compta/bank/line.php +++ b/htdocs/compta/bank/line.php @@ -291,7 +291,7 @@ if ($result) { // Confirmations if ($action == 'delete_categ') { - print $form->formconfirm($_SERVER['PHP_SELF']."?rowid=".$rowid."&cat1=".GETPOST("fk_categ")."&orig_account=".$orig_account, $langs->trans("RemoveFromRubrique"), $langs->trans("RemoveFromRubriqueConfirm"), "confirm_delete_categ", '', 'yes', 1); + print $form->formconfirm($_SERVER['PHP_SELF']."?rowid=".urlencode($rowid)."&cat1=".urlencode(GETPOST("fk_categ", 'int'))."&orig_account=".urlencode($orig_account), $langs->trans("RemoveFromRubrique"), $langs->trans("RemoveFromRubriqueConfirm"), "confirm_delete_categ", '', 'yes', 1); } print ''; diff --git a/htdocs/compta/bank/various_payment/list.php b/htdocs/compta/bank/various_payment/list.php index dcc1f4aef97..5e6d199db0a 100644 --- a/htdocs/compta/bank/various_payment/list.php +++ b/htdocs/compta/bank/various_payment/list.php @@ -226,7 +226,7 @@ $sql .= " WHERE v.entity IN (".getEntity('payment_various').")"; // Search criteria if ($search_ref) { - $sql .= " AND v.rowid=".$db->escape($search_ref); + $sql .= " AND v.rowid = ".((int) $search_ref); } if ($search_label) { $sql .= natural_search(array('v.label'), $search_label); diff --git a/htdocs/compta/deplacement/card.php b/htdocs/compta/deplacement/card.php index 3d4693f8c7b..6f390e82552 100644 --- a/htdocs/compta/deplacement/card.php +++ b/htdocs/compta/deplacement/card.php @@ -366,7 +366,7 @@ if ($action == 'create') { * Confirm delete trip */ if ($action == 'delete') { - print $form->formconfirm($_SERVER["PHP_SELF"]."?id=".$id, $langs->trans("DeleteTrip"), $langs->trans("ConfirmDeleteTrip"), "confirm_delete"); + print $form->formconfirm($_SERVER["PHP_SELF"]."?id=".urlencode($id), $langs->trans("DeleteTrip"), $langs->trans("ConfirmDeleteTrip"), "confirm_delete"); } $soc = new Societe($db); diff --git a/htdocs/compta/facture/card-rec.php b/htdocs/compta/facture/card-rec.php index 4f0148a05a1..1ee26e6daf3 100644 --- a/htdocs/compta/facture/card-rec.php +++ b/htdocs/compta/facture/card-rec.php @@ -770,7 +770,7 @@ if (empty($reshook)) { } /*$line = new FactureLigne($db); - $line->fetch(GETPOST('lineid')); + $line->fetch(GETPOST('lineid', 'int')); $percent = $line->get_prev_progress($object->id); if (GETPOST('progress') < $percent) @@ -823,7 +823,7 @@ if (empty($reshook)) { // Update line if (!$error) { $result = $object->updateline( - GETPOST('lineid'), + GETPOST('lineid', 'int'), $description, $pu_ht, $qty, @@ -1597,7 +1597,7 @@ if ($action == 'create') { // Lines - print ' + print ' diff --git a/htdocs/compta/facture/card.php b/htdocs/compta/facture/card.php index bde5a6e6c38..df27efe91ed 100644 --- a/htdocs/compta/facture/card.php +++ b/htdocs/compta/facture/card.php @@ -238,13 +238,13 @@ if (empty($reshook)) { $object->fetch($id); $object->fetch_thirdparty(); - $result = $object->deleteline(GETPOST('lineid')); + $result = $object->deleteline(GETPOST('lineid', 'int')); if ($result > 0) { // Define output language $outputlangs = $langs; $newlang = ''; - if ($conf->global->MAIN_MULTILANGS && empty($newlang) && !empty($_REQUEST['lang_id'])) { - $newlang = $_REQUEST['lang_id']; + if ($conf->global->MAIN_MULTILANGS && empty($newlang) && GETPOST('lang_id')) { + $newlang = GETPOST('lang_id'); } if ($conf->global->MAIN_MULTILANGS && empty($newlang)) { $newlang = $object->thirdparty->default_lang; @@ -2416,7 +2416,7 @@ if (empty($reshook)) { if (!$error) { if (empty($usercancreatemargin)) { foreach ($object->lines as &$line) { - if ($line->id == GETPOST('lineid')) { + if ($line->id == GETPOST('lineid', 'int')) { $fournprice = $line->fk_fournprice; $buyingprice = $line->pa_ht; break; @@ -5168,7 +5168,7 @@ if ($action == 'create') { } } - print ' + print ' diff --git a/htdocs/compta/facture/class/facture-rec.class.php b/htdocs/compta/facture/class/facture-rec.class.php index 363a781538a..ee4d1a48397 100644 --- a/htdocs/compta/facture/class/facture-rec.class.php +++ b/htdocs/compta/facture/class/facture-rec.class.php @@ -765,7 +765,7 @@ class FactureRec extends CommonInvoice { $rowid = $this->id; - dol_syslog(get_class($this)."::delete rowid=".$rowid, LOG_DEBUG); + dol_syslog(get_class($this)."::delete rowid=".((int) $rowid), LOG_DEBUG); $error = 0; $this->db->begin(); diff --git a/htdocs/compta/facture/class/facture.class.php b/htdocs/compta/facture/class/facture.class.php index 9ae760220a4..26a5d862457 100644 --- a/htdocs/compta/facture/class/facture.class.php +++ b/htdocs/compta/facture/class/facture.class.php @@ -3657,7 +3657,7 @@ class Facture extends CommonInvoice { global $user; - dol_syslog(get_class($this)."::deleteline rowid=".$rowid, LOG_DEBUG); + dol_syslog(get_class($this)."::deleteline rowid=".((int) $rowid), LOG_DEBUG); if ($this->statut != self::STATUS_DRAFT) { $this->error = 'ErrorDeleteLineNotAllowedByObjectStatus'; diff --git a/htdocs/compta/prelevement/card.php b/htdocs/compta/prelevement/card.php index 20a11effdad..cd3e155ae06 100644 --- a/htdocs/compta/prelevement/card.php +++ b/htdocs/compta/prelevement/card.php @@ -380,7 +380,7 @@ if ($id > 0 || $ref) { $num = $db->num_rows($result); $i = 0; - $urladd = "&id=".$id; + $urladd = "&id=".urlencode($id); print ''."\n"; print ''; diff --git a/htdocs/compta/prelevement/factures.php b/htdocs/compta/prelevement/factures.php index 9cfeb860d33..c00c29e1c39 100644 --- a/htdocs/compta/prelevement/factures.php +++ b/htdocs/compta/prelevement/factures.php @@ -220,7 +220,7 @@ if ($resql) { $num = $db->num_rows($resql); $i = 0; - $param = "&id=".$id; + $param = "&id=".urlencode($id); // Lines of title fields print ''; diff --git a/htdocs/compta/prelevement/line.php b/htdocs/compta/prelevement/line.php index dce5dd39b60..a912ecdba3a 100644 --- a/htdocs/compta/prelevement/line.php +++ b/htdocs/compta/prelevement/line.php @@ -275,7 +275,7 @@ if ($id) { $num = $db->num_rows($result); $i = 0; - $urladd = "&id=".$id; + $urladd = "&id=".urlencode($id); print_barre_liste($langs->trans("Bills"), $page, "factures.php", $urladd, $sortfield, $sortorder, '', $num, 0, ''); diff --git a/htdocs/contrat/card.php b/htdocs/contrat/card.php index 1ab26b73c75..c925dea94bf 100644 --- a/htdocs/contrat/card.php +++ b/htdocs/contrat/card.php @@ -711,7 +711,7 @@ if (empty($reshook)) { $db->rollback(); } } elseif ($action == 'confirm_deleteline' && $confirm == 'yes' && $user->rights->contrat->creer) { - $result = $object->deleteline(GETPOST('lineid'), $user); + $result = $object->deleteline(GETPOST('lineid', 'int'), $user); if ($result >= 0) { header("Location: ".$_SERVER['PHP_SELF']."?id=".$object->id); @@ -1963,7 +1963,7 @@ if ($action == 'create') { $dateSelector = 1; print "\n"; - print ' + print ' diff --git a/htdocs/contrat/class/contrat.class.php b/htdocs/contrat/class/contrat.class.php index 33dd0e8e2f7..3bfe1a2315e 100644 --- a/htdocs/contrat/class/contrat.class.php +++ b/htdocs/contrat/class/contrat.class.php @@ -1832,7 +1832,7 @@ class Contrat extends CommonObject $this->db->begin(); $sql = "DELETE FROM ".MAIN_DB_PREFIX.$this->table_element_line; - $sql .= " WHERE rowid=".$idline; + $sql .= " WHERE rowid = ".((int) $idline); dol_syslog(get_class($this)."::deleteline", LOG_DEBUG); $resql = $this->db->query($sql); diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php index 2088263a2c2..4aa20d8f41a 100644 --- a/htdocs/core/class/commonobject.class.php +++ b/htdocs/core/class/commonobject.class.php @@ -8893,7 +8893,7 @@ abstract class CommonObject $this->db->begin(); $sql = "DELETE FROM ".MAIN_DB_PREFIX.$this->table_element_line; - $sql .= " WHERE rowid=".$idline; + $sql .= " WHERE rowid = ".((int) $idline); dol_syslog(get_class($this)."::deleteLineCommon", LOG_DEBUG); $resql = $this->db->query($sql); diff --git a/htdocs/core/lib/company.lib.php b/htdocs/core/lib/company.lib.php index 7183e24dea5..d197b687876 100644 --- a/htdocs/core/lib/company.lib.php +++ b/htdocs/core/lib/company.lib.php @@ -571,7 +571,7 @@ function getState($id, $withcode = '', $dbtouse = 0, $withregion = 0, $outputlan $sql = "SELECT d.rowid as id, d.code_departement as code, d.nom as name, d.active, c.label as country, c.code as country_code, r.code_region as region_code, r.nom as region_name FROM"; $sql .= " ".MAIN_DB_PREFIX."c_departements as d, ".MAIN_DB_PREFIX."c_regions as r,".MAIN_DB_PREFIX."c_country as c"; - $sql .= " WHERE d.fk_region=r.code_region and r.fk_pays=c.rowid and d.rowid=".$id; + $sql .= " WHERE d.fk_region=r.code_region and r.fk_pays=c.rowid and d.rowid=".((int) $id); $sql .= " AND d.active = 1 AND r.active = 1 AND c.active = 1"; $sql .= " ORDER BY c.code, d.code_departement"; diff --git a/htdocs/core/tpl/resource_view.tpl.php b/htdocs/core/tpl/resource_view.tpl.php index 81ad11ebdc9..740590cb34a 100644 --- a/htdocs/core/tpl/resource_view.tpl.php +++ b/htdocs/core/tpl/resource_view.tpl.php @@ -33,7 +33,7 @@ if ((array) $linked_resources && count($linked_resources) > 0) { //$element_id = $linked_resource['rowid']; - if ($mode == 'edit' && $linked_resource['rowid'] == GETPOST('lineid')) { + if ($mode == 'edit' && $linked_resource['rowid'] == GETPOST('lineid', 'int')) { print '
    '; print ''; print ''; @@ -47,7 +47,7 @@ if ((array) $linked_resources && count($linked_resources) > 0) { print '
    '; } else { $class = ''; - if ($linked_resource['rowid'] == GETPOST('lineid')) { + if ($linked_resource['rowid'] == GETPOST('lineid', 'int')) { $class = 'highlight'; } diff --git a/htdocs/don/card.php b/htdocs/don/card.php index 1dfade00bec..0763ff9b7e5 100644 --- a/htdocs/don/card.php +++ b/htdocs/don/card.php @@ -120,7 +120,7 @@ if ($action == 'confirm_reopen' && $confirm == 'yes' && $permissiontoadd) { if ($action == 'update') { if (!empty($cancel)) { - header("Location: ".$_SERVER['PHP_SELF']."?id=".$id); + header("Location: ".$_SERVER['PHP_SELF']."?id=".urlencode($id)); exit; } diff --git a/htdocs/expedition/class/expeditionbatch.class.php b/htdocs/expedition/class/expeditionbatch.class.php index f97d6b87a1b..736cfba6e42 100644 --- a/htdocs/expedition/class/expeditionbatch.class.php +++ b/htdocs/expedition/class/expeditionbatch.class.php @@ -151,10 +151,8 @@ class ExpeditionLineBatch extends CommonObject */ public static function deletefromexp($db, $id_expedition) { - $id_expedition = (int) $id_expedition; - $sql = "DELETE FROM ".MAIN_DB_PREFIX.self::$_table_element; - $sql .= " WHERE fk_expeditiondet in (SELECT rowid FROM ".MAIN_DB_PREFIX."expeditiondet WHERE fk_expedition=".$id_expedition.")"; + $sql .= " WHERE fk_expeditiondet in (SELECT rowid FROM ".MAIN_DB_PREFIX."expeditiondet WHERE fk_expedition=".((int) $id_expedition).")"; dol_syslog(__METHOD__, LOG_DEBUG); if ($db->query($sql)) { diff --git a/htdocs/expedition/shipment.php b/htdocs/expedition/shipment.php index cba2e14cf74..80dbaf698ef 100644 --- a/htdocs/expedition/shipment.php +++ b/htdocs/expedition/shipment.php @@ -258,7 +258,7 @@ if ($id > 0 || !empty($ref)) { // Confirm validation if ($action == 'cloture') { - $formconfirm = $form->formconfirm($_SERVER['PHP_SELF']."?id=".$id, $langs->trans("CloseShipment"), $langs->trans("ConfirmCloseShipment"), "confirm_cloture"); + $formconfirm = $form->formconfirm($_SERVER['PHP_SELF']."?id=".urlencode($id), $langs->trans("CloseShipment"), $langs->trans("ConfirmCloseShipment"), "confirm_cloture"); } // Call Hook formConfirm diff --git a/htdocs/fourn/class/fournisseur.facture.class.php b/htdocs/fourn/class/fournisseur.facture.class.php index fca16305047..8245e8ec1cc 100644 --- a/htdocs/fourn/class/fournisseur.facture.class.php +++ b/htdocs/fourn/class/fournisseur.facture.class.php @@ -678,7 +678,7 @@ class FactureFournisseur extends CommonInvoice $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_paiement as p ON t.fk_mode_reglement = p.id"; $sql .= ' LEFT JOIN '.MAIN_DB_PREFIX.'c_incoterms as i ON t.fk_incoterms = i.rowid'; if ($id) { - $sql .= " WHERE t.rowid=".$id; + $sql .= " WHERE t.rowid=".((int) $id); } if ($ref) { $sql .= " WHERE t.ref='".$this->db->escape($ref)."' AND t.entity IN (".getEntity('supplier_invoice').")"; diff --git a/htdocs/fourn/commande/card.php b/htdocs/fourn/commande/card.php index 8358b71f2c7..e33b9de48c1 100644 --- a/htdocs/fourn/commande/card.php +++ b/htdocs/fourn/commande/card.php @@ -1326,7 +1326,7 @@ if (empty($reshook)) { $_GET['socid'] = $_POST['socid']; } else { $db->commit(); - header("Location: ".$_SERVER['PHP_SELF']."?id=".$id); + header("Location: ".$_SERVER['PHP_SELF']."?id=".urlencode($id)); exit; } } @@ -2275,7 +2275,7 @@ if ($action == 'create') { //$result = $object->getLinesArray(); - print ' + print ' diff --git a/htdocs/fourn/commande/dispatch.php b/htdocs/fourn/commande/dispatch.php index c27a33f522b..b183092972e 100644 --- a/htdocs/fourn/commande/dispatch.php +++ b/htdocs/fourn/commande/dispatch.php @@ -1166,7 +1166,7 @@ if ($id > 0 || !empty($ref)) { $objp = $db->fetch_object($resql); if ($action == 'editline' && $lineid == $objp->dispatchlineid) { - print ' + print ' diff --git a/htdocs/fourn/facture/card.php b/htdocs/fourn/facture/card.php index 578c9c7e062..e59e4583e72 100644 --- a/htdocs/fourn/facture/card.php +++ b/htdocs/fourn/facture/card.php @@ -3293,7 +3293,7 @@ if ($action == 'create') { /* * Lines */ - print ''; + print ''; print ''; print ''; print ''; diff --git a/htdocs/ftp/admin/ftpclient.php b/htdocs/ftp/admin/ftpclient.php index 5094f178cea..12ee32a496f 100644 --- a/htdocs/ftp/admin/ftpclient.php +++ b/htdocs/ftp/admin/ftpclient.php @@ -237,6 +237,7 @@ if (!function_exists('ftp_connect')) { while ($i < $num) { $obj = $db->fetch_object($resql); + $reg = array(); preg_match('/([0-9]+)$/i', $obj->name, $reg); $idrss = $reg[0]; //print "x".join(',',$reg)."=".$obj->name."=".$idrss; diff --git a/htdocs/install/lib/repair.lib.php b/htdocs/install/lib/repair.lib.php index 242fbff25d4..bd54e55ebde 100644 --- a/htdocs/install/lib/repair.lib.php +++ b/htdocs/install/lib/repair.lib.php @@ -140,7 +140,7 @@ function clean_data_ecm_directories() $label = $obj->label; $newlabel = dol_sanitizeFileName($label); if ($label != $newlabel) { - $sqlupdate = "UPDATE ".MAIN_DB_PREFIX."ecm_directories set label='".$db->escape($newlabel)."' WHERE rowid=".$id; + $sqlupdate = "UPDATE ".MAIN_DB_PREFIX."ecm_directories set label = '".$db->escape($newlabel)."' WHERE rowid = ".((int) $id); print '    \n"; $resqlupdate = $db->query($sqlupdate); if (!$resqlupdate) { diff --git a/htdocs/intracommreport/card.php b/htdocs/intracommreport/card.php index 0226848bd48..24b8797a670 100644 --- a/htdocs/intracommreport/card.php +++ b/htdocs/intracommreport/card.php @@ -203,7 +203,7 @@ if ($id > 0 && $action != 'edit') { ); } print $form->formconfirm( - "card.php?rowid=".$id, + "card.php?rowid=".urlencode($id), $langs->trans("DeleteReport"), $langs->trans("ConfirmDeleteReport"), "confirm_delete", diff --git a/htdocs/margin/productMargins.php b/htdocs/margin/productMargins.php index f18cc4ee503..ac006c042aa 100644 --- a/htdocs/margin/productMargins.php +++ b/htdocs/margin/productMargins.php @@ -198,7 +198,7 @@ $sql .= ' AND f.entity IN ('.getEntity('invoice').')'; $sql .= " AND f.fk_statut NOT IN (".$db->sanitize(implode(', ', $invoice_status_except_list)).")"; $sql .= " AND d.fk_facture = f.rowid"; if ($id > 0) { - $sql .= " AND d.fk_product =".$id; + $sql .= " AND d.fk_product =".((int) $id); } if (!empty($TSelectedCats)) { $sql .= ' AND cp.fk_categorie IN ('.$db->sanitize(implode(',', $TSelectedCats)).')'; diff --git a/htdocs/product/class/product.class.php b/htdocs/product/class/product.class.php index fbe706e93db..a1fd7a5b1dc 100644 --- a/htdocs/product/class/product.class.php +++ b/htdocs/product/class/product.class.php @@ -4535,8 +4535,8 @@ class Product extends CommonObject $sql .= " FROM ".MAIN_DB_PREFIX."product as p,"; $sql .= " ".MAIN_DB_PREFIX."product_association as pa"; $sql .= " WHERE p.rowid = pa.fk_product_fils"; - $sql .= " AND pa.fk_product_pere = ".$id; - $sql .= " AND pa.fk_product_fils != ".$id; // This should not happens, it is to avoid infinite loop if it happens + $sql .= " AND pa.fk_product_pere = ".((int) $id); + $sql .= " AND pa.fk_product_fils <> ".((int) $id); // This should not happens, it is to avoid infinite loop if it happens dol_syslog(get_class($this).'::getChildsArbo id='.$id.' level='.$level, LOG_DEBUG); diff --git a/htdocs/product/price.php b/htdocs/product/price.php index a08eaa8558b..7dfb94be79f 100644 --- a/htdocs/product/price.php +++ b/htdocs/product/price.php @@ -568,7 +568,7 @@ if (empty($reshook)) { if ($action == 'delete_customer_price' && ($user->rights->produit->supprimer || $user->rights->service->supprimer)) { // Delete price by customer - $prodcustprice->id = GETPOST('lineid'); + $prodcustprice->id = GETPOST('lineid', 'int'); $result = $prodcustprice->delete($user); if ($result < 0) { diff --git a/htdocs/product/stock/card.php b/htdocs/product/stock/card.php index 0a77a39a0df..0d3783dc161 100644 --- a/htdocs/product/stock/card.php +++ b/htdocs/product/stock/card.php @@ -137,7 +137,7 @@ if (empty($reshook)) { header("Location: ".$backtopage); exit; } else { - header("Location: card.php?id=".$id); + header("Location: card.php?id=".urlencode($id)); exit; } } else { diff --git a/htdocs/reception/class/reception.class.php b/htdocs/reception/class/reception.class.php index d5e3feaa255..946990f0c7b 100644 --- a/htdocs/reception/class/reception.class.php +++ b/htdocs/reception/class/reception.class.php @@ -1317,7 +1317,7 @@ class Reception extends CommonObject $sql = "SELECT em.rowid, em.code, em.libelle, em.description, em.tracking, em.active"; $sql .= " FROM ".MAIN_DB_PREFIX."c_shipment_mode as em"; if ($id != '') { - $sql .= " WHERE em.rowid=".$id; + $sql .= " WHERE em.rowid = ".((int) $id); } $resql = $this->db->query($sql); diff --git a/htdocs/societe/list.php b/htdocs/societe/list.php index 9c5d261f996..f79857d744f 100644 --- a/htdocs/societe/list.php +++ b/htdocs/societe/list.php @@ -292,7 +292,7 @@ if ($action == "change") { // Change customer for TakePOS $db->query($sql); } - $sql = "UPDATE ".MAIN_DB_PREFIX."facture set fk_soc=".$idcustomer." where ref='(PROV-POS".$_SESSION["takeposterminal"]."-".$place.")'"; + $sql = "UPDATE ".MAIN_DB_PREFIX."facture set fk_soc=".((int) $idcustomer)." where ref='(PROV-POS".$_SESSION["takeposterminal"]."-".$place.")'"; $resql = $db->query($sql); ?> - - + + - + + @@ -37,6 +41,10 @@ url = "swagger.json"; } + hljs.configure({ + highlightSizeThreshold: 5000 + }); + // Pre load translate... if(window.SwaggerTranslator) { window.SwaggerTranslator.translate(); @@ -51,8 +59,8 @@ clientId: "your-client-id", clientSecret: "your-client-secret-if-required", realm: "your-realms", - appName: "your-app-name", - scopeSeparator: ",", + appName: "your-app-name", + scopeSeparator: " ", additionalQueryStringParams: {} }); } @@ -60,11 +68,7 @@ if(window.SwaggerTranslator) { window.SwaggerTranslator.translate(); } - - $('pre code').each(function(i, e) { - hljs.highlightBlock(e) - }); - + addApiKeyAuthorization(); }, onFailure: function(data) { @@ -74,8 +78,12 @@ jsonEditor: false, apisSorter: "alpha", operationsSorter: "alpha", - defaultModelRendering: 'schema', - showRequestHeaders: false + defaultModelRendering: 'model', /* example or model or schema */ + defaultModelsExpandDepth: -1, + showRequestHeaders: false, + showOperationIds: false, + displayOperationIds: false, + displayRequestDuration: true }); function addApiKeyAuthorization(){ @@ -100,13 +108,7 @@ } $('#input_apiKey').change(addApiKeyAuthorization); - - // if you have an apiKey you would like to pre-populate on the page for demonstration purposes... - /* - var apiKey = "myApiKeyXXXX123456789"; - $('#input_apiKey').val(apiKey); - */ - + window.swaggerUi.load(); function log() { @@ -118,14 +120,14 @@ -
    '.$langs->trans("RangeOfLoginValidity").''; - if ($caneditfield) { - print $form->selectDate($datestartvalidity ? $datestartvalidity : $object->datestartvalidity, 'datestartvalidity', 0, 0, 1, 'formdatestartvalidity', 1, 1); - } else { - print dol_print_date($object->datestartvalidity, 'day'); - } - - if ($datestartvalidity && $dateendvalidity) { - print ' - '; - } - - if ($caneditfield) { - print $form->selectDate($dateendvalidity ? $datendevalidity : $object->dateendvalidity, 'dateendvalidity', 0, 0, 1, 'formdateendvalidity', 1, 0); - } else { - print dol_print_date($object->dateendvalidity, 'day'); - } - print '
    '.$langs->trans("DateOfBirth").''; From e780bae77f609ae760a2022c3b1460fac2ec779b Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sun, 25 Apr 2021 15:27:10 +0200 Subject: [PATCH 14/27] css --- htdocs/user/card.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/user/card.php b/htdocs/user/card.php index 9d2039a4678..b1a9a229827 100644 --- a/htdocs/user/card.php +++ b/htdocs/user/card.php @@ -1165,7 +1165,7 @@ if ($action == 'create' || $action == 'adduserldap') { // Signature print '
    '.$langs->trans("Signature").''; + print ''; require_once DOL_DOCUMENT_ROOT.'/core/class/doleditor.class.php'; $doleditor = new DolEditor('signature', GETPOST('signature', 'restricthtml'), '', 138, 'dolibarr_notes', 'In', true, true, empty($conf->global->FCKEDITOR_ENABLE_USERSIGN) ? 0 : 1, ROWS_4, '90%'); print $doleditor->Create(1); @@ -1679,7 +1679,7 @@ if ($action == 'create' || $action == 'adduserldap') { } // Signature - print '
    '.$langs->trans('Signature').''; + print '
    '.$langs->trans('Signature').''; print dol_htmlentitiesbr($object->signature); print "
    '.$sqlupdate."