| '; - print $langs->trans('PaymentBankAccount'); - print ' | '; - if (($action != 'editbankaccount') && $user->rights->societe->creer) print ' | id.'">'.img_edit($langs->trans('SetBankAccount'),1).' | '; - print '
| '; + print $langs->trans('PaymentBankAccount'); + print ' | '; + if (($action != 'editbankaccount') && $user->rights->societe->creer) print ' | id.'">'.img_edit($langs->trans('SetBankAccount'),1).' | '; + print '
| '.$langs->trans("MailTopic").' | |||
| '.$langs->trans("BackgroundColorByDefault").' | '; - print $htmlother->selectColor($_POST['bgcolor'],'bgcolor','new_mailing',0); + print $htmlother->selectColor($_POST['bgcolor'],'bgcolor','',0); print ' | ||
\n";
@@ -941,7 +963,14 @@ else
if (($object->statut == 0 || $object->statut == 1) && $user->rights->mailing->creer)
{
- print ''.$langs->trans("EditWithEditor").'';
+ if (! empty($conf->fckeditor->enabled) && ! empty($conf->global->FCKEDITOR_ENABLE_MAILING))
+ {
+ print ''.$langs->trans("EditWithEditor").'';
+ }
+ else
+ {
+ print ''.$langs->trans("EditWithTextEditor").'';
+ }
if (! empty($conf->use_javascript_ajax)) print ''.$langs->trans("EditHTMLSource").'';
}
@@ -1091,19 +1120,19 @@ else
// Background color
/*print ''.$langs->trans("BackgroundColorByDefault").' ';
- print $htmlother->selectColor($object->bgcolor,'bgcolor','edit_mailing',0);
+ print $htmlother->selectColor($object->bgcolor,'bgcolor','',0);
print '
';
- if (empty($object->bgcolor) || strtolower($object->bgcolor) == 'ffffff')
+ print '
';
+ if (empty($object->bgcolor) || strtolower($object->bgcolor) == 'ffffff') // CKEditor does not apply the color of the div into its content area
{
$readonly=1;
// Editeur wysiwyg
require_once DOL_DOCUMENT_ROOT.'/core/class/doleditor.class.php';
- $doleditor=new DolEditor('bodyemail',$object->body,'',600,'dolibarr_mailings','',false,true,empty($conf->global->FCKEDITOR_ENABLE_MAILING)?0:1,20,120,$readonly);
+ $doleditor=new DolEditor('bodyemail',$object->body,'',600,'dolibarr_mailings','',false,true,empty($conf->global->FCKEDITOR_ENABLE_MAILING)?0:1,20,'90%',$readonly);
$doleditor->Create();
}
else print dol_htmlentitiesbr($object->body);
@@ -1245,7 +1274,7 @@ else
// Background color
print ''.$langs->trans("BackgroundColorByDefault").' ';
- print $htmlother->selectColor($object->bgcolor,'bgcolor','edit_mailing',0);
+ print $htmlother->selectColor($object->bgcolor,'bgcolor','',0);
print '
'.$desc, LR, 1, 0); + $pdf->writeHTMLCell(0, 0, $curX, $curY, dol_concatdesc($txt,$desc), 0, 1, 0); $pageposafter=$pdf->getPage(); $posyafter=$pdf->GetY(); //var_dump($posyafter); var_dump(($this->page_hauteur - ($heightforfooter+$heightforfreetext+$heightforinfotot))); exit; diff --git a/htdocs/core/modules/fichinter/mod_pacific.php b/htdocs/core/modules/fichinter/mod_pacific.php index 65e5aa979b9..c9f42f12949 100644 --- a/htdocs/core/modules/fichinter/mod_pacific.php +++ b/htdocs/core/modules/fichinter/mod_pacific.php @@ -74,7 +74,7 @@ class mod_pacific extends ModeleNumRefFicheinter $posindice=8; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; $sql.= " FROM ".MAIN_DB_PREFIX."fichinter"; - $sql.= " WHERE ref like '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $sql.= " WHERE entity = ".$conf->entity; $resql=$db->query($sql); @@ -110,7 +110,7 @@ class mod_pacific extends ModeleNumRefFicheinter $posindice=8; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; $sql.= " FROM ".MAIN_DB_PREFIX."fichinter"; - $sql.= " WHERE ref LIKE '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); diff --git a/htdocs/core/modules/livraison/mod_livraison_jade.php b/htdocs/core/modules/livraison/mod_livraison_jade.php index 3480bb6d609..cbb630543c7 100644 --- a/htdocs/core/modules/livraison/mod_livraison_jade.php +++ b/htdocs/core/modules/livraison/mod_livraison_jade.php @@ -80,7 +80,7 @@ class mod_livraison_jade extends ModeleNumRefDeliveryOrder $posindice=8; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; // This is standard SQL $sql.= " FROM ".MAIN_DB_PREFIX."livraison"; - $sql.= " WHERE ref LIKE '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); @@ -114,7 +114,7 @@ class mod_livraison_jade extends ModeleNumRefDeliveryOrder $posindice=8; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; // This is standard SQL $sql.= " FROM ".MAIN_DB_PREFIX."livraison"; - $sql.= " WHERE ref LIKE '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); diff --git a/htdocs/core/modules/payment/mod_payment_cicada.php b/htdocs/core/modules/payment/mod_payment_cicada.php index 482261e9fe1..6c75557864b 100644 --- a/htdocs/core/modules/payment/mod_payment_cicada.php +++ b/htdocs/core/modules/payment/mod_payment_cicada.php @@ -73,7 +73,7 @@ class mod_payment_cicada extends ModeleNumRefPayments $posindice=9; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; $sql.= " FROM ".MAIN_DB_PREFIX."paiement"; - $sql.= " WHERE ref LIKE '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); @@ -107,7 +107,7 @@ class mod_payment_cicada extends ModeleNumRefPayments $posindice=9; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; $sql.= " FROM ".MAIN_DB_PREFIX."paiement"; - $sql.= " WHERE ref like '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); diff --git a/htdocs/core/modules/project/mod_project_simple.php b/htdocs/core/modules/project/mod_project_simple.php index 49e4586d07b..fca1954c48a 100644 --- a/htdocs/core/modules/project/mod_project_simple.php +++ b/htdocs/core/modules/project/mod_project_simple.php @@ -75,7 +75,7 @@ class mod_project_simple extends ModeleNumRefProjects $posindice=8; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; $sql.= " FROM ".MAIN_DB_PREFIX."projet"; - $sql.= " WHERE ref LIKE '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); if ($resql) @@ -111,7 +111,7 @@ class mod_project_simple extends ModeleNumRefProjects $posindice=8; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; $sql.= " FROM ".MAIN_DB_PREFIX."projet"; - $sql.= " WHERE ref like '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); diff --git a/htdocs/core/modules/project/task/mod_task_simple.php b/htdocs/core/modules/project/task/mod_task_simple.php index 97203d402d5..fe4087cbd15 100644 --- a/htdocs/core/modules/project/task/mod_task_simple.php +++ b/htdocs/core/modules/project/task/mod_task_simple.php @@ -76,7 +76,7 @@ class mod_task_simple extends ModeleNumRefTask $sql = "SELECT MAX(CAST(SUBSTRING(task.ref FROM " . $posindice . ") AS SIGNED)) as max"; $sql .= " FROM " . MAIN_DB_PREFIX . "projet_task AS task, "; $sql .= MAIN_DB_PREFIX . "projet AS project WHERE task.fk_projet=project.rowid"; - $sql .= " AND task.ref LIKE '" . $this->prefix . "____-%'"; + $sql .= " AND task.ref LIKE '" . $this->db->escape($this->prefix) . "____-%'"; $sql .= " AND project.entity = " . $conf->entity; $resql=$db->query($sql); if ($resql) @@ -112,7 +112,7 @@ class mod_task_simple extends ModeleNumRefTask $posindice=8; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; $sql.= " FROM ".MAIN_DB_PREFIX."projet_task"; - $sql.= " WHERE ref like '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $resql=$db->query($sql); if ($resql) diff --git a/htdocs/core/modules/propale/mod_propale_marbre.php b/htdocs/core/modules/propale/mod_propale_marbre.php index 28260de97d8..0e434fb1e38 100644 --- a/htdocs/core/modules/propale/mod_propale_marbre.php +++ b/htdocs/core/modules/propale/mod_propale_marbre.php @@ -75,7 +75,7 @@ class mod_propale_marbre extends ModeleNumRefPropales $posindice=8; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; $sql.= " FROM ".MAIN_DB_PREFIX."propal"; - $sql.= " WHERE ref LIKE '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); @@ -112,7 +112,7 @@ class mod_propale_marbre extends ModeleNumRefPropales $posindice=8; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; // This is standard SQL $sql.= " FROM ".MAIN_DB_PREFIX."propal"; - $sql.= " WHERE ref LIKE '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); diff --git a/htdocs/core/modules/supplier_invoice/mod_facture_fournisseur_cactus.php b/htdocs/core/modules/supplier_invoice/mod_facture_fournisseur_cactus.php index 6e875af78f2..fafde547659 100644 --- a/htdocs/core/modules/supplier_invoice/mod_facture_fournisseur_cactus.php +++ b/htdocs/core/modules/supplier_invoice/mod_facture_fournisseur_cactus.php @@ -82,7 +82,7 @@ class mod_facture_fournisseur_cactus extends ModeleNumRefSuppliersInvoices $posindice=8; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; $sql.= " FROM ".MAIN_DB_PREFIX."facture_fourn"; - $sql.= " WHERE ref LIKE '".$this->prefixinvoice."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefixinvoice)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); if ($resql) @@ -103,7 +103,7 @@ class mod_facture_fournisseur_cactus extends ModeleNumRefSuppliersInvoices $posindice=8; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; // This is standard SQL $sql.= " FROM ".MAIN_DB_PREFIX."facture_fourn"; - $sql.= " WHERE ref LIKE '".$this->prefixcreditnote."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefixcreditnote)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); @@ -124,7 +124,7 @@ class mod_facture_fournisseur_cactus extends ModeleNumRefSuppliersInvoices $posindice=8; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; // This is standard SQL $sql.= " FROM ".MAIN_DB_PREFIX."facture_fourn"; - $sql.= " WHERE ref LIKE '".$this->prefixdeposit."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefixdeposit)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); @@ -202,7 +202,7 @@ class mod_facture_fournisseur_cactus extends ModeleNumRefSuppliersInvoices { $date=$object->date; // This is invoice date (not creation date) $yymm = strftime("%y%m",$date); - + if ($max >= (pow(10, 4) - 1)) $num=$max+1; // If counter > 9999, we do not format on 4 chars, we take number as it is else $num = sprintf("%04s",$max+1); diff --git a/htdocs/core/modules/supplier_order/mod_commande_fournisseur_muguet.php b/htdocs/core/modules/supplier_order/mod_commande_fournisseur_muguet.php index 0a017e3bc51..9788ac4c887 100644 --- a/htdocs/core/modules/supplier_order/mod_commande_fournisseur_muguet.php +++ b/htdocs/core/modules/supplier_order/mod_commande_fournisseur_muguet.php @@ -85,7 +85,7 @@ class mod_commande_fournisseur_muguet extends ModeleNumRefSuppliersOrders $posindice=8; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; $sql.= " FROM ".MAIN_DB_PREFIX."commande_fournisseur"; - $sql.= " WHERE ref LIKE '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); if ($resql) @@ -120,7 +120,7 @@ class mod_commande_fournisseur_muguet extends ModeleNumRefSuppliersOrders $posindice=8; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; $sql.= " FROM ".MAIN_DB_PREFIX."commande_fournisseur"; - $sql.= " WHERE ref like '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); diff --git a/htdocs/core/modules/supplier_payment/mod_supplier_payment_bronan.php b/htdocs/core/modules/supplier_payment/mod_supplier_payment_bronan.php index c94ef4296c0..b7eee9a3544 100644 --- a/htdocs/core/modules/supplier_payment/mod_supplier_payment_bronan.php +++ b/htdocs/core/modules/supplier_payment/mod_supplier_payment_bronan.php @@ -73,7 +73,7 @@ class mod_supplier_payment_bronan extends ModeleNumRefSupplierPayments $posindice=9; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; $sql.= " FROM ".MAIN_DB_PREFIX."paiementfourn"; - $sql.= " WHERE ref LIKE '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); @@ -107,7 +107,7 @@ class mod_supplier_payment_bronan extends ModeleNumRefSupplierPayments $posindice=10; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; $sql.= " FROM ".MAIN_DB_PREFIX."paiementfourn"; - $sql.= " WHERE ref like '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); diff --git a/htdocs/core/modules/supplier_proposal/mod_supplier_proposal_marbre.php b/htdocs/core/modules/supplier_proposal/mod_supplier_proposal_marbre.php index 07d027a68dd..26ccb038dda 100644 --- a/htdocs/core/modules/supplier_proposal/mod_supplier_proposal_marbre.php +++ b/htdocs/core/modules/supplier_proposal/mod_supplier_proposal_marbre.php @@ -75,7 +75,7 @@ class mod_supplier_proposal_marbre extends ModeleNumRefSupplierProposal $posindice=8; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; $sql.= " FROM ".MAIN_DB_PREFIX."supplier_proposal"; - $sql.= " WHERE ref LIKE '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); @@ -112,7 +112,7 @@ class mod_supplier_proposal_marbre extends ModeleNumRefSupplierProposal $posindice=8; $sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; // This is standard SQL $sql.= " FROM ".MAIN_DB_PREFIX."supplier_proposal"; - $sql.= " WHERE ref LIKE '".$this->prefix."____-%'"; + $sql.= " WHERE ref LIKE '".$this->db->escape($this->prefix)."____-%'"; $sql.= " AND entity = ".$conf->entity; $resql=$db->query($sql); diff --git a/htdocs/core/photos_resize.php b/htdocs/core/photos_resize.php index 5b29d25202e..69056ff02be 100644 --- a/htdocs/core/photos_resize.php +++ b/htdocs/core/photos_resize.php @@ -36,7 +36,7 @@ $action=GETPOST('action','alpha'); $modulepart=GETPOST('modulepart','alpha')?GETPOST('modulepart','alpha'):'produit|service'; $original_file = GETPOST("file"); $backtourl=GETPOST('backtourl'); -$cancel=GETPOST("cancel"); +$cancel=GETPOST('cancel','alpha'); // Security check if (empty($modulepart)) accessforbidden('Bad value for modulepart'); diff --git a/htdocs/core/tpl/onlinepaymentlinks.tpl.php b/htdocs/core/tpl/onlinepaymentlinks.tpl.php new file mode 100644 index 00000000000..8650ab4110d --- /dev/null +++ b/htdocs/core/tpl/onlinepaymentlinks.tpl.php @@ -0,0 +1,135 @@ + + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see
'; +print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnFreeAmount",$servicename).':
'; +print ''.getOnlinePaymentUrl(1,'free')."
\n"; +if (! empty($conf->commande->enabled)) +{ + print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnOrder",$servicename).':
'; + print ''.getOnlinePaymentUrl(1,'order')."
\n"; + if (! empty($conf->global->PAYMENT_SECURITY_TOKEN) && ! empty($conf->global->PAYMENT_SECURITY_TOKEN_UNIQUE)) + { + $langs->load("orders"); + print ''; + } + print '
'; +} +if (! empty($conf->facture->enabled)) +{ + print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnInvoice",$servicename).':
'; + print ''.getOnlinePaymentUrl(1,'invoice')."
\n"; + if (! empty($conf->global->PAYMENT_SECURITY_TOKEN) && ! empty($conf->global->PAYMENT_SECURITY_TOKEN_UNIQUE)) + { + $langs->load("bills"); + print ''; + } + print '
'; +} +if (! empty($conf->contrat->enabled)) +{ + print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnContractLine",$servicename).':
'; + print ''.getOnlinePaymentUrl(1,'contractline')."
\n"; + if (! empty($conf->global->PAYMENT_SECURITY_TOKEN) && ! empty($conf->global->PAYMENT_SECURITY_TOKEN_UNIQUE)) + { + $langs->load("contract"); + print ''; + } + print '
'; +} +if (! empty($conf->adherent->enabled)) +{ + print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnMemberSubscription",$servicename).':
'; + print ''.getOnlinePaymentUrl(1,'membersubscription')."
\n"; + if (! empty($conf->global->PAYMENT_SECURITY_TOKEN) && ! empty($conf->global->PAYMENT_SECURITY_TOKEN_UNIQUE)) + { + $langs->load("members"); + print ''; + } + print '
'; +} + +if (! empty($conf->use_javascript_ajax)) +{ + print "\n".''; +} + +print info_admin($langs->trans("YouCanAddTagOnUrl")); + +print ''; + diff --git a/htdocs/cron/card.php b/htdocs/cron/card.php index dce56ff5468..a1255954014 100644 --- a/htdocs/cron/card.php +++ b/htdocs/cron/card.php @@ -41,7 +41,7 @@ if (!$user->rights->cron->create) accessforbidden(); $id=GETPOST('id','int'); $action=GETPOST('action','alpha'); $confirm=GETPOST('confirm','alpha'); -$cancel=GETPOST('cancel'); +$cancel=GETPOST('cancel','alpha'); $backtourl=GETPOST('backtourl','alpha'); $securitykey = GETPOST('securitykey','alpha'); diff --git a/htdocs/cron/class/cronjob.class.php b/htdocs/cron/class/cronjob.class.php index 00f8d5d6ae0..5ba542c6945 100644 --- a/htdocs/cron/class/cronjob.class.php +++ b/htdocs/cron/class/cronjob.class.php @@ -201,7 +201,7 @@ class Cronjob extends CommonObject $sql.= " ".(! isset($this->lastresult)?'NULL':"'".$this->db->escape($this->lastresult)."'").","; $sql.= " ".(! isset($this->datelastresult) || dol_strlen($this->datelastresult)==0?'NULL':"'".$this->db->idate($this->datelastresult)."'").","; $sql.= " ".(! isset($this->lastoutput)?'NULL':"'".$this->db->escape($this->lastoutput)."'").","; - $sql.= " ".(! isset($this->unitfrequency)?'NULL':"'".$this->unitfrequency."'").","; + $sql.= " ".(! isset($this->unitfrequency)?'NULL':"'".$this->db->escape($this->unitfrequency)."'").","; $sql.= " ".(! isset($this->frequency)?'0':$this->frequency).","; $sql.= " ".(! isset($this->status)?'0':$this->status).","; $sql.= " ".$user->id.","; diff --git a/htdocs/don/card.php b/htdocs/don/card.php index 90f5c328ffc..c711aad8397 100644 --- a/htdocs/don/card.php +++ b/htdocs/don/card.php @@ -46,7 +46,7 @@ $langs->load("bills"); $id=GETPOST('rowid')?GETPOST('rowid','int'):GETPOST('id','int'); $action=GETPOST('action','alpha'); -$cancel=GETPOST('cancel'); +$cancel=GETPOST('cancel','alpha'); $amount=GETPOST('amount'); $donation_date=dol_mktime(12, 0, 0, GETPOST('remonth'), GETPOST('reday'), GETPOST('reyear')); $projectid = (GETPOST('projectid') ? GETPOST('projectid', 'int') : 0); diff --git a/htdocs/ecm/class/ecmdirectory.class.php b/htdocs/ecm/class/ecmdirectory.class.php index 5f713bdab91..07c8b0aff00 100644 --- a/htdocs/ecm/class/ecmdirectory.class.php +++ b/htdocs/ecm/class/ecmdirectory.class.php @@ -134,12 +134,12 @@ class EcmDirectory // extends CommonObject $sql.= "fk_user_c"; $sql.= ") VALUES ("; $sql.= " '".$this->db->escape($this->label)."',"; - $sql.= " '".$conf->entity."',"; - $sql.= " '".$this->fk_parent."',"; + $sql.= " '".$this->db->escape($conf->entity)."',"; + $sql.= " '".$this->db->escape($this->fk_parent)."',"; $sql.= " '".$this->db->escape($this->description)."',"; $sql.= " ".$this->cachenbofdoc.","; $sql.= " '".$this->db->idate($this->date_c)."',"; - $sql.= " '".$this->fk_user_c."'"; + $sql.= " '".$this->db->escape($this->fk_user_c)."'"; $sql.= ")"; dol_syslog(get_class($this)."::create", LOG_DEBUG); diff --git a/htdocs/ecm/docfile.php b/htdocs/ecm/docfile.php index 61cce03cc1d..192240b4943 100644 --- a/htdocs/ecm/docfile.php +++ b/htdocs/ecm/docfile.php @@ -61,7 +61,7 @@ $pagenext = $page + 1; if (! $sortorder) $sortorder="ASC"; if (! $sortfield) $sortfield="label"; -$cancel=GETPOST('cancel'); +$cancel=GETPOST('cancel','alpha'); $action=GETPOST('action','aZ09'); $section=GETPOST("section"); if (! $section) diff --git a/htdocs/ecm/docmine.php b/htdocs/ecm/docmine.php index f418627d1be..c722ba9a208 100644 --- a/htdocs/ecm/docmine.php +++ b/htdocs/ecm/docmine.php @@ -138,7 +138,7 @@ if ($action == 'confirm_deletedir' && $confirm == 'yes') } // Update description -if ($action == 'update' && ! GETPOST('cancel')) +if ($action == 'update' && ! GETPOST('cancel','alpha')) { $error=0; diff --git a/htdocs/expedition/class/expedition.class.php b/htdocs/expedition/class/expedition.class.php index 9e057106dd8..6c54c2e6615 100644 --- a/htdocs/expedition/class/expedition.class.php +++ b/htdocs/expedition/class/expedition.class.php @@ -1769,7 +1769,7 @@ class Expedition extends CommonObject if ($id=='') { $sql = "INSERT INTO ".MAIN_DB_PREFIX."c_shipment_mode (code, libelle, description, tracking)"; - $sql.=" VALUES ('".$this->update['code']."','".$this->update['libelle']."','".$this->update['description']."','".$this->update['tracking']."')"; + $sql.=" VALUES ('".$this->db->escape($this->update['code'])."','".$this->db->escape($this->update['libelle'])."','".$this->db->escape($this->update['description'])."','".$this->db->escape($this->update['tracking'])."')"; $resql = $this->db->query($sql); } else diff --git a/htdocs/expedition/list.php b/htdocs/expedition/list.php index ab5fa27b13f..a5b693aa3f9 100644 --- a/htdocs/expedition/list.php +++ b/htdocs/expedition/list.php @@ -119,8 +119,8 @@ if (is_array($extrafields->attribute_label) && count($extrafields->attribute_lab * Actions */ -if (GETPOST('cancel')) { $action='list'; $massaction=''; } -if (! GETPOST('confirmmassaction')) { $massaction=''; } +if (GETPOST('cancel','alpha')) { $action='list'; $massaction=''; } +if (! GETPOST('confirmmassaction','alpha')) { $massaction=''; } $parameters=array('socid'=>$socid); $reshook=$hookmanager->executeHooks('doActions',$parameters,$object,$action); // Note that $action and $object may have been modified by some hooks diff --git a/htdocs/expensereport/card.php b/htdocs/expensereport/card.php index 3043ee3d592..df6c188a030 100644 --- a/htdocs/expensereport/card.php +++ b/htdocs/expensereport/card.php @@ -49,7 +49,7 @@ $langs->load("bills"); $langs->load("mails"); $action=GETPOST('action','aZ09'); -$cancel=GETPOST('cancel'); +$cancel=GETPOST('cancel','alpha'); $confirm = GETPOST('confirm', 'alpha'); $date_start = dol_mktime(0, 0, 0, GETPOST('date_debutmonth'), GETPOST('date_debutday'), GETPOST('date_debutyear')); diff --git a/htdocs/expensereport/list.php b/htdocs/expensereport/list.php index 28fcdefcf62..a02e23c3123 100644 --- a/htdocs/expensereport/list.php +++ b/htdocs/expensereport/list.php @@ -130,8 +130,8 @@ if (is_array($extrafields->attribute_label) && count($extrafields->attribute_lab * Actions */ -if (GETPOST('cancel')) { $action='list'; $massaction=''; } -if (! GETPOST('confirmmassaction') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } +if (GETPOST('cancel','alpha')) { $action='list'; $massaction=''; } +if (! GETPOST('confirmmassaction','alpha') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } $parameters=array('socid'=>$socid); $reshook=$hookmanager->executeHooks('doActions',$parameters,$object,$action); // Note that $action and $object may have been modified by some hooks diff --git a/htdocs/fichinter/list.php b/htdocs/fichinter/list.php index 866d8cab17c..9dca5d1badb 100644 --- a/htdocs/fichinter/list.php +++ b/htdocs/fichinter/list.php @@ -128,8 +128,8 @@ if (is_array($extrafields->attribute_label) && count($extrafields->attribute_lab * Actions */ -if (GETPOST('cancel')) { $action='list'; $massaction=''; } -if (! GETPOST('confirmmassaction') && $massaction != 'presend' && $massaction != 'confirm_presend' && $massaction != 'confirm_createbills') { $massaction=''; } +if (GETPOST('cancel','alpha')) { $action='list'; $massaction=''; } +if (! GETPOST('confirmmassaction','alpha') && $massaction != 'presend' && $massaction != 'confirm_presend' && $massaction != 'confirm_createbills') { $massaction=''; } $parameters=array('socid'=>$socid); $reshook=$hookmanager->executeHooks('doActions',$parameters,$object,$action); // Note that $action and $object may have been modified by some hooks diff --git a/htdocs/fourn/card.php b/htdocs/fourn/card.php index a413820cbe0..02e0749d8c5 100644 --- a/htdocs/fourn/card.php +++ b/htdocs/fourn/card.php @@ -45,7 +45,7 @@ $langs->load('orders'); $langs->load('commercial'); $action = GETPOST('action','aZ09'); -$cancelbutton = GETPOST('cancel'); +$cancelbutton = GETPOST('cancel','alpha'); // Security check $id = (GETPOST('socid','int') ? GETPOST('socid','int') : GETPOST('id','int')); @@ -707,27 +707,58 @@ if ($object->id > 0) print ''; } - if ($conf->supplier_proposal->enabled && $user->rights->supplier_proposal->creer && $object->status==1) + if ($conf->supplier_proposal->enabled && $user->rights->supplier_proposal->creer) { $langs->load("supplier_proposal"); - print ''.$langs->trans("AddSupplierProposal").''; + if ($object->status == 1) + { + print ''.$langs->trans("AddSupplierProposal").''; + } + else + { + print ''.$langs->trans("AddSupplierProposal").''; + } } - if ($user->rights->fournisseur->commande->creer && $object->status==1) + if ($user->rights->fournisseur->commande->creer) { $langs->load("orders"); - print ''.$langs->trans("AddOrder").''; + if ($object->status == 1) + { + print ''.$langs->trans("AddOrder").''; + } + else + { + print ''.$langs->trans("AddOrder").''; + } } - if ($user->rights->fournisseur->facture->creer && $object->status==1) + if ($user->rights->fournisseur->facture->creer) { $langs->load("bills"); - print ''.$langs->trans("AddBill").''; + if ($object->status == 1) + { + print ''.$langs->trans("AddBill").''; + } + else + { + print ''.$langs->trans("AddBill").''; + } } - if ($user->rights->fournisseur->facture->creer && $object->status==1) + if ($user->rights->fournisseur->facture->creer) { - if (! empty($orders2invoice) && $orders2invoice > 0) print ''; + if (! empty($orders2invoice) && $orders2invoice > 0) + { + if ($object->status == 1) + { + print ''; + } + else + { + print ''; + } + } else print ''; } diff --git a/htdocs/fourn/class/api_supplier_invoices.class.php b/htdocs/fourn/class/api_supplier_invoices.class.php index 26ae936d5a0..92792428a38 100644 --- a/htdocs/fourn/class/api_supplier_invoices.class.php +++ b/htdocs/fourn/class/api_supplier_invoices.class.php @@ -351,7 +351,7 @@ class SupplierInvoices extends DolibarrApi function _validate($data) { $invoice = array(); - foreach (Invoices::$FIELDS as $field) { + foreach (SupplierInvoices::$FIELDS as $field) { if (!isset($data[$field])) throw new RestException(400, "$field field missing"); $invoice[$field] = $data[$field]; diff --git a/htdocs/fourn/class/fournisseur.commande.class.php b/htdocs/fourn/class/fournisseur.commande.class.php index 6ca854bf319..95f573530bf 100644 --- a/htdocs/fourn/class/fournisseur.commande.class.php +++ b/htdocs/fourn/class/fournisseur.commande.class.php @@ -3129,15 +3129,15 @@ class CommandeFournisseurLigne extends CommonOrderLine $sql.= " ".($this->date_end?"'".$this->db->idate($this->date_end)."'":"null").","; if ($this->fk_product) { $sql.= $this->fk_product.","; } else { $sql.= "null,"; } - $sql.= "'".$this->product_type."',"; - $sql.= "'".$this->qty."', "; + $sql.= "'".$this->db->escape($this->product_type)."',"; + $sql.= "'".$this->db->escape($this->qty)."', "; - $sql.= " ".(empty($this->vat_src_code)?"''":"'".$this->vat_src_code."'").","; + $sql.= " ".(empty($this->vat_src_code)?"''":"'".$this->db->escape($this->vat_src_code)."'").","; $sql.= " ".$this->tva_tx.", "; $sql.= " ".$this->localtax1_tx.","; $sql.= " ".$this->localtax2_tx.","; - $sql.= " '".$this->localtax1_type."',"; - $sql.= " '".$this->localtax2_type."',"; + $sql.= " '".$this->db->escape($this->localtax1_type)."',"; + $sql.= " '".$this->db->escape($this->localtax2_type)."',"; $sql.= " ".$this->remise_percent.", ".price2num($this->subprice,'MU').", '".$this->db->escape($this->ref_supplier)."',"; $sql.= " ".price2num($this->total_ht).","; $sql.= " ".price2num($this->total_tva).","; diff --git a/htdocs/fourn/class/fournisseur.commande.dispatch.class.php b/htdocs/fourn/class/fournisseur.commande.dispatch.class.php index 7fd56f81aac..a72e225b535 100644 --- a/htdocs/fourn/class/fournisseur.commande.dispatch.class.php +++ b/htdocs/fourn/class/fournisseur.commande.dispatch.class.php @@ -105,14 +105,11 @@ class CommandeFournisseurDispatch extends CommonObject if (isset($this->status)) $this->status=trim($this->status); if (isset($this->batch)) $this->batch=trim($this->batch); - - // Check parameters // Put here code to add control on parameters values // Insert request $sql = "INSERT INTO ".MAIN_DB_PREFIX.$this->table_element."("; - $sql.= "fk_commande,"; $sql.= "fk_product,"; $sql.= "fk_commandefourndet,"; @@ -125,24 +122,19 @@ class CommandeFournisseurDispatch extends CommonObject $sql.= "batch,"; $sql.= "eatby,"; $sql.= "sellby"; - - $sql.= ") VALUES ("; - - $sql.= " ".(! isset($this->fk_commande)?'NULL':"'".$this->fk_commande."'").","; - $sql.= " ".(! isset($this->fk_product)?'NULL':"'".$this->fk_product."'").","; - $sql.= " ".(! isset($this->fk_commandefourndet)?'NULL':"'".$this->fk_commandefourndet."'").","; - $sql.= " ".(! isset($this->qty)?'NULL':"'".$this->qty."'").","; - $sql.= " ".(! isset($this->fk_entrepot)?'NULL':"'".$this->fk_entrepot."'").","; - $sql.= " ".(! isset($this->fk_user)?'NULL':"'".$this->fk_user."'").","; + $sql.= " ".(! isset($this->fk_commande)?'NULL':"'".$this->db->escape($this->fk_commande)."'").","; + $sql.= " ".(! isset($this->fk_product)?'NULL':"'".$this->db->escape($this->fk_product)."'").","; + $sql.= " ".(! isset($this->fk_commandefourndet)?'NULL':"'".$this->db->escape($this->fk_commandefourndet)."'").","; + $sql.= " ".(! isset($this->qty)?'NULL':"'".$this->db->escape($this->qty)."'").","; + $sql.= " ".(! isset($this->fk_entrepot)?'NULL':"'".$this->db->escape($this->fk_entrepot)."'").","; + $sql.= " ".(! isset($this->fk_user)?'NULL':"'".$this->db->escape($this->fk_user)."'").","; $sql.= " ".(! isset($this->datec) || dol_strlen($this->datec)==0?'NULL':"'".$this->db->idate($this->datec)."'").","; $sql.= " ".(! isset($this->comment)?'NULL':"'".$this->db->escape($this->comment)."'").","; - $sql.= " ".(! isset($this->status)?'NULL':"'".$this->status."'").","; + $sql.= " ".(! isset($this->status)?'NULL':"'".$this->db->escape($this->status)."'").","; $sql.= " ".(! isset($this->batch)?'NULL':"'".$this->db->escape($this->batch)."'").","; $sql.= " ".(! isset($this->eatby) || dol_strlen($this->eatby)==0?'NULL':"'".$this->db->idate($this->eatby)."'").","; $sql.= " ".(! isset($this->sellby) || dol_strlen($this->sellby)==0?'NULL':"'".$this->db->idate($this->sellby)."'").""; - - $sql.= ")"; $this->db->begin(); diff --git a/htdocs/fourn/class/fournisseur.facture.class.php b/htdocs/fourn/class/fournisseur.facture.class.php index 4d24d2f920b..78c08478321 100644 --- a/htdocs/fourn/class/fournisseur.facture.class.php +++ b/htdocs/fourn/class/fournisseur.facture.class.php @@ -2701,17 +2701,17 @@ class SupplierInvoiceLine extends CommonObjectLine $sql.= ', fk_multicurrency, multicurrency_code, multicurrency_subprice, multicurrency_total_ht, multicurrency_total_tva, multicurrency_total_ttc'; $sql.= ')'; $sql.= " VALUES (".$this->fk_facture_fourn.","; - $sql.= " ".($this->fk_parent_line>0?"'".$this->fk_parent_line."'":"null").","; + $sql.= " ".($this->fk_parent_line>0?"'".$this->db->escape($this->fk_parent_line)."'":"null").","; $sql.= " ".(! empty($this->label)?"'".$this->db->escape($this->label)."'":"null").","; $sql.= " '".$this->db->escape($this->desc)."',"; $sql.= " ".price2num($this->qty).","; - $sql.= " ".(empty($this->vat_src_code)?"''":"'".$this->vat_src_code."'").","; + $sql.= " ".(empty($this->vat_src_code)?"''":"'".$this->db->escape($this->vat_src_code)."'").","; $sql.= " ".price2num($this->tva_tx).","; $sql.= " ".price2num($this->localtax1_tx).","; $sql.= " ".price2num($this->localtax2_tx).","; - $sql.= " '".$this->localtax1_type."',"; - $sql.= " '".$this->localtax2_type."',"; + $sql.= " '".$this->db->escape($this->localtax1_type)."',"; + $sql.= " '".$this->db->escape($this->localtax2_type)."',"; $sql.= ' '.(! empty($this->fk_product)?$this->fk_product:"null").','; $sql.= " ".$this->product_type.","; $sql.= " ".price2num($this->remise_percent).","; @@ -2722,7 +2722,7 @@ class SupplierInvoiceLine extends CommonObjectLine $sql.= ' '.(!empty($this->fk_code_ventilation)?$this->fk_code_ventilation:0).','; $sql.= ' '.$this->rang.','; $sql.= ' '.$this->special_code.','; - $sql.= " '".$this->info_bits."',"; + $sql.= " '".$this->db->escape($this->info_bits)."',"; $sql.= " ".price2num($this->total_ht).","; $sql.= " ".price2num($this->total_tva).","; $sql.= " ".price2num($this->total_ttc).","; diff --git a/htdocs/fourn/commande/card.php b/htdocs/fourn/commande/card.php index 754e34e0d97..e92a7c25de3 100644 --- a/htdocs/fourn/commande/card.php +++ b/htdocs/fourn/commande/card.php @@ -542,7 +542,7 @@ if (empty($reshook)) /* * Updating a line in the order */ - if ($action == 'updateline' && $user->rights->fournisseur->commande->creer && ! GETPOST('cancel')) + if ($action == 'updateline' && $user->rights->fournisseur->commande->creer && ! GETPOST('cancel','alpha')) { $tva_tx = GETPOST('tva_tx'); @@ -1170,7 +1170,7 @@ if (empty($reshook)) include DOL_DOCUMENT_ROOT.'/core/actions_sendmails.inc.php'; - if ($action == 'webservice' && GETPOST('mode', 'alpha') == "send" && ! GETPOST('cancel')) + if ($action == 'webservice' && GETPOST('mode', 'alpha') == "send" && ! GETPOST('cancel','alpha')) { $ws_url = $object->thirdparty->webservices_url; $ws_key = $object->thirdparty->webservices_key; @@ -2269,7 +2269,7 @@ elseif (! empty($object->id)) /* * Action webservice */ - elseif ($action == 'webservice' && GETPOST('mode', 'alpha') != "send" && ! GETPOST('cancel')) + elseif ($action == 'webservice' && GETPOST('mode', 'alpha') != "send" && ! GETPOST('cancel','alpha')) { $mode = GETPOST('mode', 'alpha'); $ws_url = $object->thirdparty->webservices_url; diff --git a/htdocs/fourn/commande/list.php b/htdocs/fourn/commande/list.php index ac67d256824..4794d72da6a 100644 --- a/htdocs/fourn/commande/list.php +++ b/htdocs/fourn/commande/list.php @@ -172,8 +172,8 @@ if (is_array($extrafields->attribute_label) && count($extrafields->attribute_lab * Actions */ -if (GETPOST('cancel')) { $action='list'; $massaction=''; } -if (! GETPOST('confirmmassaction')) { $massaction=''; } +if (GETPOST('cancel','alpha')) { $action='list'; $massaction=''; } +if (! GETPOST('confirmmassaction','alpha')) { $massaction=''; } $parameters=array('socid'=>$socid); $reshook=$hookmanager->executeHooks('doActions',$parameters,$object,$action); // Note that $action and $object may have been modified by some hooks @@ -689,7 +689,7 @@ if ($resql) { $langs->load("mails"); - if (! GETPOST('cancel')) + if (! GETPOST('cancel','alpha')) { $objecttmp=new CommandeFournisseur($db); $listofselectedid=array(); diff --git a/htdocs/fourn/facture/list.php b/htdocs/fourn/facture/list.php index ec785c5e206..96473dd6e6e 100644 --- a/htdocs/fourn/facture/list.php +++ b/htdocs/fourn/facture/list.php @@ -183,8 +183,8 @@ if (is_array($extrafields->attribute_label) && count($extrafields->attribute_lab * Actions */ -if (GETPOST('cancel')) { $action='list'; $massaction=''; } -if (! GETPOST('confirmmassaction') && $massaction != 'presend' && $massaction != 'confirm_presend' && $massaction != 'confirm_createbills') { $massaction=''; } +if (GETPOST('cancel','alpha')) { $action='list'; $massaction=''; } +if (! GETPOST('confirmmassaction','alpha') && $massaction != 'presend' && $massaction != 'confirm_presend' && $massaction != 'confirm_createbills') { $massaction=''; } $parameters=array('socid'=>$socid); $reshook=$hookmanager->executeHooks('doActions',$parameters,$object,$action); // Note that $action and $object may have been modified by some hooks @@ -493,7 +493,7 @@ if ($resql) { $langs->load("mails"); - if (! GETPOST('cancel')) + if (! GETPOST('cancel','alpha')) { $objecttmp=new FactureFournisseur($db); $listofselectedid=array(); diff --git a/htdocs/fourn/product/list.php b/htdocs/fourn/product/list.php index 5707c0bff30..c6a8f24f98f 100644 --- a/htdocs/fourn/product/list.php +++ b/htdocs/fourn/product/list.php @@ -69,8 +69,8 @@ $extrafields = new ExtraFields($db); * Put here all code to do according to value of "action" parameter */ -if (GETPOST('cancel')) { $action='list'; $massaction=''; } -if (! GETPOST('confirmmassaction') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } +if (GETPOST('cancel','alpha')) { $action='list'; $massaction=''; } +if (! GETPOST('confirmmassaction','alpha') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } $parameters=array(); $reshook=$hookmanager->executeHooks('doActions',$parameters,$object,$action); // Note that $action and $object may have been modified by some hooks diff --git a/htdocs/holiday/class/holiday.class.php b/htdocs/holiday/class/holiday.class.php index 4815bee4b00..ad9ead401dd 100644 --- a/htdocs/holiday/class/holiday.class.php +++ b/htdocs/holiday/class/holiday.class.php @@ -143,14 +143,14 @@ class Holiday extends CommonObject $sql.= "fk_user_create,"; $sql.= "entity"; $sql.= ") VALUES ("; - $sql.= "'".$this->fk_user."',"; + $sql.= "'".$this->db->escape($this->fk_user)."',"; $sql.= " '".$this->db->idate($now)."',"; $sql.= " '".$this->db->escape($this->description)."',"; $sql.= " '".$this->db->idate($this->date_debut)."',"; $sql.= " '".$this->db->idate($this->date_fin)."',"; $sql.= " ".$this->halfday.","; $sql.= " '1',"; - $sql.= " '".$this->fk_validator."',"; + $sql.= " '".$this->db->escape($this->fk_validator)."',"; $sql.= " ".$this->fk_type.","; $sql.= " ".$user->id.","; $sql.= " ".$conf->entity; diff --git a/htdocs/holiday/define_holiday.php b/htdocs/holiday/define_holiday.php index 66e490ae420..de8a7147267 100644 --- a/htdocs/holiday/define_holiday.php +++ b/htdocs/holiday/define_holiday.php @@ -71,8 +71,8 @@ $holiday = new Holiday($db); * Actions */ -if (GETPOST('cancel')) { $action='list'; $massaction=''; } -if (! GETPOST('confirmmassaction') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } +if (GETPOST('cancel','alpha')) { $action='list'; $massaction=''; } +if (! GETPOST('confirmmassaction','alpha') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } $parameters=array(); $reshook=$hookmanager->executeHooks('doActions',$parameters,$object,$action); // Note that $action and $object may have been modified by some hooks diff --git a/htdocs/imports/class/import.class.php b/htdocs/imports/class/import.class.php index 828e0f53719..2235812bae8 100644 --- a/htdocs/imports/class/import.class.php +++ b/htdocs/imports/class/import.class.php @@ -45,7 +45,7 @@ class Import var $error; var $errors; - + /** * Constructor @@ -242,7 +242,7 @@ class Import $sql = 'INSERT INTO '.MAIN_DB_PREFIX.'import_model ('; $sql.= 'fk_user, label, type, field'; $sql.= ')'; - $sql.= " VALUES (".($user->id > 0 ? $user->id : 0).", '".$this->db->escape($this->model_name)."', '".$this->datatoimport."', '".$this->hexa."')"; + $sql.= " VALUES (".($user->id > 0 ? $user->id : 0).", '".$this->db->escape($this->model_name)."', '".$this->db->escape($this->datatoimport)."', '".$this->db->escape($this->hexa)."')"; dol_syslog(get_class($this)."::create", LOG_DEBUG); $resql=$this->db->query($sql); diff --git a/htdocs/install/check.php b/htdocs/install/check.php index ebf1de7f552..2b09d1c9813 100644 --- a/htdocs/install/check.php +++ b/htdocs/install/check.php @@ -306,7 +306,19 @@ else } else { - require_once $dolibarr_main_document_root.'/core/lib/admin.lib.php'; + require_once $dolibarr_main_document_root.'/core/lib/admin.lib.php'; + + // If password is encoded, we decode it + if (preg_match('/crypted:/i',$dolibarr_main_db_pass) || ! empty($dolibarr_main_db_encrypted_pass)) + { + require_once $dolibarr_main_document_root.'/core/lib/security.lib.php'; + if (preg_match('/crypted:/i',$dolibarr_main_db_pass)) + { + $dolibarr_main_db_encrypted_pass = preg_replace('/crypted:/i', '', $dolibarr_main_db_pass); // We need to set this as it is used to know the password was initially crypted + $dolibarr_main_db_pass = dol_decode($dolibarr_main_db_encrypted_pass); + } + else $dolibarr_main_db_pass = dol_decode($dolibarr_main_db_encrypted_pass); + } // $conf is already instancied inside inc.php $conf->db->type = $dolibarr_main_db_type; @@ -315,12 +327,12 @@ else $conf->db->name = $dolibarr_main_db_name; $conf->db->user = $dolibarr_main_db_user; $conf->db->pass = $dolibarr_main_db_pass; - $db=getDoliDBInstance($conf->db->type,$conf->db->host,$conf->db->user,$conf->db->pass,$conf->db->name,$conf->db->port); + $db=getDoliDBInstance($conf->db->type,$conf->db->host,$conf->db->user,$conf->db->pass,$conf->db->name,$conf->db->port); if ($db->connected && $db->database_selected) { $ok=true; } - } + } } } diff --git a/htdocs/install/mysql/migration/4.0.0-5.0.0.sql b/htdocs/install/mysql/migration/4.0.0-5.0.0.sql index 86421894fec..25a92f1e265 100644 --- a/htdocs/install/mysql/migration/4.0.0-5.0.0.sql +++ b/htdocs/install/mysql/migration/4.0.0-5.0.0.sql @@ -61,6 +61,8 @@ ALTER TABLE llx_user DROP COLUMN phenix_login; ALTER TABLE llx_user DROP COLUMN phenix_pass; ALTER TABLE llx_user ADD COLUMN dateemployment datetime; +ALTER TABLE llx_user MODIFY login varchar(50) NOT NULL; + ALTER TABLE llx_societe ADD COLUMN fk_account integer; ALTER TABLE llx_commandedet ADD COLUMN fk_commandefourndet integer DEFAULT NULL after import_key; -- link to detail line of commande fourn (resplenish) diff --git a/htdocs/install/mysql/migration/6.0.0-7.0.0.sql b/htdocs/install/mysql/migration/6.0.0-7.0.0.sql index 75462abe6b5..53400d9806b 100644 --- a/htdocs/install/mysql/migration/6.0.0-7.0.0.sql +++ b/htdocs/install/mysql/migration/6.0.0-7.0.0.sql @@ -25,6 +25,9 @@ -- -- VMYSQL4.1 DELETE FROM llx_usergroup_user WHERE fk_usergroup NOT IN (SELECT rowid from llx_usergroup); +-- Missing in 5.0 +ALTER TABLE llx_user MODIFY login varchar(50) NOT NULL; + -- Missing in 6.0 ? ALTER TABLE llx_product_price ADD COLUMN fk_multicurrency integer; ALTER TABLE llx_product_price ADD COLUMN multicurrency_code varchar(255); diff --git a/htdocs/langs/en_US/accountancy.lang b/htdocs/langs/en_US/accountancy.lang index f81e689260c..9e1efae59bb 100644 --- a/htdocs/langs/en_US/accountancy.lang +++ b/htdocs/langs/en_US/accountancy.lang @@ -57,7 +57,7 @@ AccountancyAreaDescContrib=STEP %s: Define default accounting accounts for speci AccountancyAreaDescDonation=STEP %s: Define default accounting accounts for donation. For this, use the menu entry %s. AccountancyAreaDescMisc=STEP %s: Define mandatory default account and default accounting accounts for miscellaneous transactions. For this, use the menu entry %s. AccountancyAreaDescLoan=STEP %s: Define default accounting accounts for loans. For this, use the menu entry %s. -AccountancyAreaDescBank=STEP %s: Define accounting accounts and journal code for each bank and financial accounts. For this, go on the card of each financial account. You can start from page %s. +AccountancyAreaDescBank=STEP %s: Define accounting accounts and journal code for each bank and financial accounts. For this, use the menu entry %s. AccountancyAreaDescProd=STEP %s: Define accounting accounts on your products/services. For this, use the menu entry %s. AccountancyAreaDescBind=STEP %s: Check the binding between existing %s lines and accounting account is done, so application will be able to journalize transactions in Ledger in one click. Complete missing bindings. For this, use the menu entry %s. @@ -78,6 +78,7 @@ ShowAccountingAccount=Show accounting account ShowAccountingJournal=Show accounting journal AccountAccountingSuggest=Accounting account suggested MenuDefaultAccounts=Default accounts +MenuBankAccounts=Bank accounts MenuVatAccounts=Vat accounts MenuTaxAccounts=Tax accounts MenuExpenseReportAccounts=Expense report accounts diff --git a/htdocs/langs/en_US/admin.lang b/htdocs/langs/en_US/admin.lang index f1aa542d7ae..0fe1040b389 100644 --- a/htdocs/langs/en_US/admin.lang +++ b/htdocs/langs/en_US/admin.lang @@ -1,6 +1,7 @@ # Dolibarr language file - Source file is en_US - admin Foundation=Foundation Version=Version +Publisher=Publisher VersionProgram=Version program VersionLastInstall=Initial install version VersionLastUpgrade=Latest version upgrade diff --git a/htdocs/langs/en_US/main.lang b/htdocs/langs/en_US/main.lang index e7171fb94b1..0cea69200dc 100644 --- a/htdocs/langs/en_US/main.lang +++ b/htdocs/langs/en_US/main.lang @@ -714,6 +714,7 @@ CreateDraft=Create draft SetToDraft=Back to draft ClickToEdit=Click to edit EditWithEditor=Edit with CKEditor +EditWithTextEditor=Edit with Text editor EditHTMLSource=Edit HTML Source ObjectDeleted=Object %s deleted ByCountry=By country diff --git a/htdocs/langs/en_US/projects.lang b/htdocs/langs/en_US/projects.lang index e6f38971e01..408c3db5e7a 100644 --- a/htdocs/langs/en_US/projects.lang +++ b/htdocs/langs/en_US/projects.lang @@ -213,3 +213,5 @@ AllowCommentOnTask=Allow user comments on tasks TaskCommentLinks=Comments TaskNbComments=Number of comments TaskComment=Task's comments space +CommentAdded=Comment added +CommentDeleted=Comment deleted diff --git a/htdocs/langs/fr_FR/projects.lang b/htdocs/langs/fr_FR/projects.lang index ece3272c743..154c1138ab9 100644 --- a/htdocs/langs/fr_FR/projects.lang +++ b/htdocs/langs/fr_FR/projects.lang @@ -212,3 +212,5 @@ AllowCommentOnTask=Autoriser les commentaires entre utilisateurs sur les tâches TaskCommentLinks=Commentaires TaskNbComments=Nombre de commentaires TaskComment=Tâches espace commentaires +CommentAdded=Commentaire ajouté avec succès +CommentDeleted=Commentaire supprimé avec succès diff --git a/htdocs/livraison/card.php b/htdocs/livraison/card.php index 02b126306f2..81237d39782 100644 --- a/htdocs/livraison/card.php +++ b/htdocs/livraison/card.php @@ -54,7 +54,7 @@ if (!empty($conf->incoterm->enabled)) $langs->load('incoterm'); $action=GETPOST('action', 'alpha'); $confirm=GETPOST('confirm', 'alpha'); -$backtopage=GETPOST('backtopage'); +$backtopage=GETPOST('backtopage','alpha'); // Security check $id = GETPOST('id', 'int'); diff --git a/htdocs/margin/checkMargins.php b/htdocs/margin/checkMargins.php index df44c6e6399..9b043766c78 100644 --- a/htdocs/margin/checkMargins.php +++ b/htdocs/margin/checkMargins.php @@ -38,7 +38,7 @@ $action = GETPOST('action','alpha'); $massaction = GETPOST('massaction','alpha'); $toselect = GETPOST('toselect', 'array'); $contextpage= GETPOST('contextpage','aZ')?GETPOST('contextpage','aZ'):'margindetail'; // To manage different context of search -$backtopage = GETPOST('backtopage'); +$backtopage = GETPOST('backtopage','alpha'); $optioncss = GETPOST('optioncss','alpha'); // Load variable for pagination @@ -75,8 +75,8 @@ if (GETPOST("button_search_x") || GETPOST("button_search")) { * Actions */ -if (GETPOST('cancel')) { $action='list'; $massaction=''; } -if (! GETPOST('confirmmassaction') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } +if (GETPOST('cancel','alpha')) { $action='list'; $massaction=''; } +if (! GETPOST('confirmmassaction','alpha') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } $parameters=array(); $reshook=$hookmanager->executeHooks('doActions',$parameters, $object, $action); // Note that $action and $object may have been modified by some hooks diff --git a/htdocs/master.inc.php b/htdocs/master.inc.php index a8d068cfd7d..ce3080e32e4 100644 --- a/htdocs/master.inc.php +++ b/htdocs/master.inc.php @@ -152,7 +152,7 @@ else if (! empty($_ENV["dol_entity"])) // Entity inside a CLI script { $conf->entity = $_ENV["dol_entity"]; } -else if (isset($_POST["loginfunction"]) && GETPOST("entity")) // Just after a login page +else if (isset($_POST["loginfunction"]) && GETPOST("entity",'int')) // Just after a login page { $conf->entity = GETPOST("entity",'int'); } diff --git a/htdocs/modulebuilder/template/myobject_agenda.php b/htdocs/modulebuilder/template/myobject_agenda.php index 8db9f0877c2..d6ccb79eea8 100644 --- a/htdocs/modulebuilder/template/myobject_agenda.php +++ b/htdocs/modulebuilder/template/myobject_agenda.php @@ -106,7 +106,7 @@ if ($reshook < 0) setEventMessages($hookmanager->error, $hookmanager->errors, 'e if (empty($reshook)) { // Cancel - if (GETPOST("cancel") && ! empty($backtopage)) + if (GETPOST('cancel','alpha') && ! empty($backtopage)) { header("Location: ".$backtopage); exit; diff --git a/htdocs/modulebuilder/template/myobject_list.php b/htdocs/modulebuilder/template/myobject_list.php index b89491b5d48..a605e765290 100644 --- a/htdocs/modulebuilder/template/myobject_list.php +++ b/htdocs/modulebuilder/template/myobject_list.php @@ -143,8 +143,8 @@ if (is_array($extrafields->attribute_label) && count($extrafields->attribute_lab * Put here all code to do according to value of "$action" parameter */ -if (GETPOST('cancel')) { $action='list'; $massaction=''; } -if (! GETPOST('confirmmassaction') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } +if (GETPOST('cancel','alpha')) { $action='list'; $massaction=''; } +if (! GETPOST('confirmmassaction','alpha') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } $parameters=array(); $reshook=$hookmanager->executeHooks('doActions', $parameters, $object, $action); // Note that $action and $object may have been modified by some hooks @@ -216,8 +216,8 @@ if (is_array($extrafields->attribute_label) && count($extrafields->attribute_lab $sql.= " WHERE t.entity IN (".getEntity('myobject').")"; foreach($search as $key => $val) { - $mode=(($object->isInt($object->fields[$key]) || $object->isFloat($object->fields[$key]))?1:0); - if ($search[$key] != '') $sql.=natural_search($key, $search[$key], (($key == 'status')?2:$mode)); + $mode_search=(($object->isInt($object->fields[$key]) || $object->isFloat($object->fields[$key]))?1:0); + if ($search[$key] != '') $sql.=natural_search($key, $search[$key], (($key == 'status')?2:$mode_search)); } if ($search_all) $sql.= natural_search(array_keys($fieldstosearchall), $search_all); // Add where from extra fields @@ -226,12 +226,12 @@ foreach ($search_array_options as $key => $val) $crit=$val; $tmpkey=preg_replace('/search_options_/','',$key); $typ=$extrafields->attribute_type[$tmpkey]; - $mode=0; - if (in_array($typ, array('int','double','real'))) $mode=1; // Search on a numeric - if (in_array($typ, array('sellist')) && $crit != '0' && $crit != '-1') $mode=2; // Search on a foreign key int + $mode_search=0; + if (in_array($typ, array('int','double','real'))) $mode_search=1; // Search on a numeric + if (in_array($typ, array('sellist')) && $crit != '0' && $crit != '-1') $mode_search=2; // Search on a foreign key int if ($crit != '' && (! in_array($typ, array('select','sellist')) || $crit != '0')) { - $sql .= natural_search('ef.'.$tmpkey, $crit, $mode); + $sql .= natural_search('ef.'.$tmpkey, $crit, $mode_search); } } // Add where from hooks diff --git a/htdocs/opensurvey/card.php b/htdocs/opensurvey/card.php index c634ca1ceaa..4d71efe6395 100644 --- a/htdocs/opensurvey/card.php +++ b/htdocs/opensurvey/card.php @@ -35,7 +35,7 @@ if (!$user->rights->opensurvey->read) accessforbidden(); // Initialisation des variables $action=GETPOST('action','aZ09'); -$cancel=GETPOST('cancel'); +$cancel=GETPOST('cancel','alpha'); $numsondage = ''; diff --git a/htdocs/opensurvey/results.php b/htdocs/opensurvey/results.php index 9bfb15b2c24..2ce78a2f8c7 100644 --- a/htdocs/opensurvey/results.php +++ b/htdocs/opensurvey/results.php @@ -520,7 +520,7 @@ if (GETPOST('ajoutsujet')) if (!$user->rights->opensurvey->write) accessforbidden(); print '
'; -print ''.$langs->trans("FollowingUrlAreAvailableToMakePayments").':
'; -print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnFreeAmount",$servicename).':
'; -print ''.DOL_MAIN_URL_ROOT.'/public/paybox/newpayment.php?amount=9.99&tag=your_free_tag'."
\n"; -if (! empty($conf->commande->enabled)) -{ - print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnOrder",$servicename).':
'; - print ''.DOL_MAIN_URL_ROOT.'/public/paybox/newpayment.php?source=order&ref=order_ref'."
\n"; -} -if (! empty($conf->facture->enabled)) -{ - print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnInvoice",$servicename).':
'; - print ''.DOL_MAIN_URL_ROOT.'/public/paybox/newpayment.php?source=invoice&ref=invoice_ref'."
\n"; -// print $langs->trans("SetupPayBoxToHavePaymentCreatedAutomatically",$langs->transnoentitiesnoconv("FeatureNotYetAvailable"))."
\n"; -} -if (! empty($conf->contrat->enabled)) -{ - print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnContractLine",$servicename).':
'; - print ''.DOL_MAIN_URL_ROOT.'/public/paybox/newpayment.php?source=contractline&ref=contractline_ref'."
\n"; -} -if (! empty($conf->adherent->enabled)) -{ - print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnMemberSubscription",$servicename).':
'; - print ''.DOL_MAIN_URL_ROOT.'/public/paybox/newpayment.php?source=membersubscription&ref=member_ref'."
\n"; -} - -print info_admin($langs->trans("YouCanAddTagOnUrl")); +include DOL_DOCUMENT_ROOT.'/core/tpl/onlinepaymentlinks.tpl.php'; llxFooter(); - $db->close(); diff --git a/htdocs/paypal/admin/paypal.php b/htdocs/paypal/admin/paypal.php index 0b11b34c872..3647ea7a4d5 100644 --- a/htdocs/paypal/admin/paypal.php +++ b/htdocs/paypal/admin/paypal.php @@ -26,6 +26,7 @@ require '../../main.inc.php'; require_once DOL_DOCUMENT_ROOT.'/paypal/lib/paypal.lib.php'; +require_once DOL_DOCUMENT_ROOT.'/core/lib/payments.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/class/doleditor.class.php'; @@ -58,10 +59,6 @@ if ($action == 'setvalue' && $user->admin) if (! $result > 0) $error++; $result=dolibarr_set_const($db, "ONLINE_PAYMENT_CSS_URL",GETPOST('ONLINE_PAYMENT_CSS_URL','alpha'),'chaine',0,'',$conf->entity); if (! $result > 0) $error++; - $result=dolibarr_set_const($db, "PAYPAL_SECURITY_TOKEN",GETPOST('PAYPAL_SECURITY_TOKEN','alpha'),'chaine',0,'',$conf->entity); - if (! $result > 0) $error++; - $result=dolibarr_set_const($db, "PAYPAL_SECURITY_TOKEN_UNIQUE",GETPOST('PAYPAL_SECURITY_TOKEN_UNIQUE','alpha'),'chaine',0,'',$conf->entity); - if (! $result > 0) $error++; $result=dolibarr_set_const($db, "PAYPAL_ADD_PAYMENT_URL",GETPOST('PAYPAL_ADD_PAYMENT_URL','alpha'),'chaine',0,'',$conf->entity); if (! $result > 0) $error++; $result=dolibarr_set_const($db, "ONLINE_PAYMENT_MESSAGE_FORM",GETPOST('ONLINE_PAYMENT_MESSAGE_FORM'),'chaine',0,'',$conf->entity); @@ -72,6 +69,11 @@ if ($action == 'setvalue' && $user->admin) if (! $result > 0) $error++; $result=dolibarr_set_const($db, "ONLINE_PAYMENT_SENDEMAIL",GETPOST('ONLINE_PAYMENT_SENDEMAIL'),'chaine',0,'',$conf->entity); if (! $result > 0) $error++; + // Payment token for URL + $result=dolibarr_set_const($db, "PAYMENT_SECURITY_TOKEN",GETPOST('PAYMENT_SECURITY_TOKEN','alpha'),'chaine',0,'',$conf->entity); + if (! $result > 0) $error++; + $result=dolibarr_set_const($db, "PAYMENT_SECURITY_TOKEN_UNIQUE",GETPOST('PAYMENT_SECURITY_TOKEN_UNIQUE','alpha'),'chaine',0,'',$conf->entity); + if (! $result > 0) $error++; if (! $error) { @@ -254,19 +256,18 @@ print '
'; // Help doc print ''.$langs->trans("InformationToFindParameters","Paypal").':
'; if (! empty($conf->use_javascript_ajax)) - print ''.$langs->trans("ClickHere").'...'; + print ''.$langs->trans("ClickHere").'...'; $realpaypalurl='www.paypal.com'; $sandboxpaypalurl='developer.paypal.com'; @@ -299,128 +300,24 @@ print 'Your API authentication information can be found with following steps. We '; print ''; -print '
'; - -$token=''; - - -// Url list -print ''.$langs->trans("FollowingUrlAreAvailableToMakePayments").':
'; -print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnFreeAmount",$servicename).':
'; -print ''.getPaypalPaymentUrl(1,'free')."
\n"; -if (! empty($conf->commande->enabled)) -{ - print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnOrder",$servicename).':
'; - print ''.getPaypalPaymentUrl(1,'order')."
\n"; - if (! empty($conf->global->PAYPAL_SECURITY_TOKEN) && ! empty($conf->global->PAYPAL_SECURITY_TOKEN_UNIQUE)) - { - $langs->load("orders"); - print ''; - } - print '
'; -} -if (! empty($conf->facture->enabled)) -{ - print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnInvoice",$servicename).':
'; - print ''.getPaypalPaymentUrl(1,'invoice')."
\n"; - if (! empty($conf->global->PAYPAL_SECURITY_TOKEN) && ! empty($conf->global->PAYPAL_SECURITY_TOKEN_UNIQUE)) - { - $langs->load("bills"); - print ''; - } - print '
'; -} -if (! empty($conf->contrat->enabled)) -{ - print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnContractLine",$servicename).':
'; - print ''.getPaypalPaymentUrl(1,'contractline')."
\n"; - if (! empty($conf->global->PAYPAL_SECURITY_TOKEN) && ! empty($conf->global->PAYPAL_SECURITY_TOKEN_UNIQUE)) - { - $langs->load("contract"); - print ''; - } - print '
'; -} -if (! empty($conf->adherent->enabled)) -{ - print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnMemberSubscription",$servicename).':
'; - print ''.getPaypalPaymentUrl(1,'membersubscription')."
\n"; - if (! empty($conf->global->PAYPAL_SECURITY_TOKEN) && ! empty($conf->global->PAYPAL_SECURITY_TOKEN_UNIQUE)) - { - $langs->load("members"); - print ''; - } - print '
'; -} - -print info_admin($langs->trans("YouCanAddTagOnUrl")); - if (! empty($conf->use_javascript_ajax)) { print "\n".''; } +print '
'; + +$token=''; + +include DOL_DOCUMENT_ROOT.'/core/tpl/onlinepaymentlinks.tpl.php'; + llxFooter(); $db->close(); diff --git a/htdocs/product/card.php b/htdocs/product/card.php index 53d553aca16..54afc80691f 100644 --- a/htdocs/product/card.php +++ b/htdocs/product/card.php @@ -69,7 +69,7 @@ $id=GETPOST('id', 'int'); $ref=GETPOST('ref', 'alpha'); $type=GETPOST('type','int'); $action=(GETPOST('action','alpha') ? GETPOST('action','alpha') : 'view'); -$cancel=GETPOST('cancel'); +$cancel=GETPOST('cancel','alpha'); $confirm=GETPOST('confirm','alpha'); $socid=GETPOST('socid','int'); $duration_value = GETPOST('duration_value'); @@ -358,7 +358,7 @@ if (empty($reshook)) // Update a product or service if ($action == 'update' && ($user->rights->produit->creer || $user->rights->service->creer)) { - if (GETPOST('cancel')) + if (GETPOST('cancel','alpha')) { $action = ''; } diff --git a/htdocs/product/class/product.class.php b/htdocs/product/class/product.class.php index 7aecf127fea..d3347557332 100644 --- a/htdocs/product/class/product.class.php +++ b/htdocs/product/class/product.class.php @@ -536,12 +536,12 @@ class Product extends CommonObject $sql.= ", ".$this->type; $sql.= ", ".price2num($price_ht); $sql.= ", ".price2num($price_ttc); - $sql.= ", '".$this->price_base_type."'"; + $sql.= ", '".$this->db->escape($this->price_base_type)."'"; $sql.= ", ".$this->status; $sql.= ", ".$this->status_buy; - $sql.= ", '".$this->accountancy_code_buy."'"; - $sql.= ", '".$this->accountancy_code_sell."'"; - $sql.= ", '".$this->canvas."'"; + $sql.= ", '".$this->db->escape($this->accountancy_code_buy)."'"; + $sql.= ", '".$this->db->escape($this->accountancy_code_sell)."'"; + $sql.= ", '".$this->db->escape($this->canvas)."'"; $sql.= ", ".((! isset($this->finished) || $this->finished < 0 || $this->finished == '') ? 'null' : (int) $this->finished); $sql.= ", ".((empty($this->status_batch) || $this->status_batch < 0)? '0':$this->status_batch); $sql.= ", ".(!$this->fk_unit ? 'NULL' : $this->fk_unit); @@ -853,8 +853,8 @@ class Product extends CommonObject $sql.= ", recuperableonly = " . $this->tva_npr; $sql.= ", localtax1_tx = " . $this->localtax1_tx; $sql.= ", localtax2_tx = " . $this->localtax2_tx; - $sql.= ", localtax1_type = " . ($this->localtax1_type!=''?"'".$this->localtax1_type."'":"'0'"); - $sql.= ", localtax2_type = " . ($this->localtax2_type!=''?"'".$this->localtax2_type."'":"'0'"); + $sql.= ", localtax1_type = " . ($this->localtax1_type!=''?"'".$this->db->escape($this->localtax1_type)."'":"'0'"); + $sql.= ", localtax2_type = " . ($this->localtax2_type!=''?"'".$this->db->escape($this->localtax2_type)."'":"'0'"); $sql.= ", barcode = ". (empty($this->barcode)?"null":"'".$this->db->escape($this->barcode)."'"); $sql.= ", fk_barcode_type = ". (empty($this->barcode_type)?"null":$this->db->escape($this->barcode_type)); @@ -863,19 +863,19 @@ class Product extends CommonObject $sql.= ", tobuy = " . $this->status_buy; $sql.= ", tobatch = " . ((empty($this->status_batch) || $this->status_batch < 0) ? '0' : $this->status_batch); $sql.= ", finished = " . ((! isset($this->finished) || $this->finished < 0) ? "null" : (int) $this->finished); - $sql.= ", weight = " . ($this->weight!='' ? "'".$this->weight."'" : 'null'); - $sql.= ", weight_units = " . ($this->weight_units!='' ? "'".$this->weight_units."'": 'null'); - $sql.= ", length = " . ($this->length!='' ? "'".$this->length."'" : 'null'); - $sql.= ", length_units = " . ($this->length_units!='' ? "'".$this->length_units."'" : 'null'); - $sql.= ", width= " . ($this->width!='' ? "'".$this->width."'" : 'null'); - $sql.= ", width_units = " . ($this->width_units!='' ? "'".$this->width_units."'" : 'null'); - $sql.= ", height = " . ($this->height!='' ? "'".$this->height."'" : 'null'); - $sql.= ", height_units = " . ($this->height_units!='' ? "'".$this->height_units."'" : 'null'); - $sql.= ", surface = " . ($this->surface!='' ? "'".$this->surface."'" : 'null'); - $sql.= ", surface_units = " . ($this->surface_units!='' ? "'".$this->surface_units."'" : 'null'); - $sql.= ", volume = " . ($this->volume!='' ? "'".$this->volume."'" : 'null'); - $sql.= ", volume_units = " . ($this->volume_units!='' ? "'".$this->volume_units."'" : 'null'); - $sql.= ", seuil_stock_alerte = " . ((isset($this->seuil_stock_alerte) && $this->seuil_stock_alerte != '') ? "'".$this->seuil_stock_alerte."'" : "null"); + $sql.= ", weight = " . ($this->weight!='' ? "'".$this->db->escape($this->weight)."'" : 'null'); + $sql.= ", weight_units = " . ($this->weight_units!='' ? "'".$this->db->escape($this->weight_units)."'": 'null'); + $sql.= ", length = " . ($this->length!='' ? "'".$this->db->escape($this->length)."'" : 'null'); + $sql.= ", length_units = " . ($this->length_units!='' ? "'".$this->db->escape($this->length_units)."'" : 'null'); + $sql.= ", width= " . ($this->width!='' ? "'".$this->db->escape($this->width)."'" : 'null'); + $sql.= ", width_units = " . ($this->width_units!='' ? "'".$this->db->escape($this->width_units)."'" : 'null'); + $sql.= ", height = " . ($this->height!='' ? "'".$this->db->escape($this->height)."'" : 'null'); + $sql.= ", height_units = " . ($this->height_units!='' ? "'".$this->db->escape($this->height_units)."'" : 'null'); + $sql.= ", surface = " . ($this->surface!='' ? "'".$this->db->escape($this->surface)."'" : 'null'); + $sql.= ", surface_units = " . ($this->surface_units!='' ? "'".$this->db->escape($this->surface_units)."'" : 'null'); + $sql.= ", volume = " . ($this->volume!='' ? "'".$this->db->escape($this->volume)."'" : 'null'); + $sql.= ", volume_units = " . ($this->volume_units!='' ? "'".$this->db->escape($this->volume_units)."'" : 'null'); + $sql.= ", seuil_stock_alerte = " . ((isset($this->seuil_stock_alerte) && $this->seuil_stock_alerte != '') ? "'".$this->db->escape($this->seuil_stock_alerte)."'" : "null"); $sql.= ", description = '" . $this->db->escape($this->description) ."'"; $sql.= ", url = " . ($this->url?"'".$this->db->escape($this->url)."'":'null'); $sql.= ", customcode = '" . $this->db->escape($this->customcode) ."'"; @@ -1439,8 +1439,8 @@ class Product extends CommonObject // Add new price $sql = "INSERT INTO ".MAIN_DB_PREFIX."product_price(price_level,date_price, fk_product, fk_user_author, price, price_ttc, price_base_type,tosell, tva_tx, default_vat_code, recuperableonly,"; $sql.= " localtax1_tx, localtax2_tx, localtax1_type, localtax2_type, price_min,price_min_ttc,price_by_qty,entity,fk_price_expression) "; - $sql.= " VALUES(".($level?$level:1).", '".$this->db->idate($now)."',".$this->id.",".$user->id.",".$this->price.",".$this->price_ttc.",'".$this->price_base_type."',".$this->status.",".$this->tva_tx.", ".($this->default_vat_code?("'".$this->default_vat_code."'"):"null").",".$this->tva_npr.","; - $sql.= " ".$this->localtax1_tx.", ".$this->localtax2_tx.", '".$this->localtax1_type."', '".$this->localtax2_type."', ".$this->price_min.",".$this->price_min_ttc.",".$this->price_by_qty.",".$conf->entity.",".($this->fk_price_expression > 0?$this->fk_price_expression:'null'); + $sql.= " VALUES(".($level?$level:1).", '".$this->db->idate($now)."',".$this->id.",".$user->id.",".$this->price.",".$this->price_ttc.",'".$this->db->escape($this->price_base_type)."',".$this->status.",".$this->tva_tx.", ".($this->default_vat_code?("'".$this->db->escape($this->default_vat_code)."'"):"null").",".$this->tva_npr.","; + $sql.= " ".$this->localtax1_tx.", ".$this->localtax2_tx.", '".$this->db->escape($this->localtax1_type)."', '".$this->db->escape($this->localtax2_type)."', ".$this->price_min.",".$this->price_min_ttc.",".$this->price_by_qty.",".$conf->entity.",".($this->fk_price_expression > 0?$this->fk_price_expression:'null'); $sql.= ")"; dol_syslog(get_class($this)."::_log_price", LOG_DEBUG); diff --git a/htdocs/product/class/productbatch.class.php b/htdocs/product/class/productbatch.class.php index 5ab70506693..64a43485604 100644 --- a/htdocs/product/class/productbatch.class.php +++ b/htdocs/product/class/productbatch.class.php @@ -154,7 +154,7 @@ class Productbatch extends CommonObject $sql.= " pl.sellby"; $sql.= " FROM ".MAIN_DB_PREFIX."product_batch as t INNER JOIN ".MAIN_DB_PREFIX."product_stock w on t.fk_product_stock = w.rowid"; - $sql.= " LEFT JOIN ".MAIN_DB_PREFIX."product_lot as pl on pl.fk_product = w.fk_product and pl.batch = t.batch"; + $sql.= " LEFT JOIN ".MAIN_DB_PREFIX."product_lot as pl on pl.fk_product = w.fk_product and pl.batch = t.batch"; $sql.= " WHERE t.rowid = ".$id; dol_syslog(get_class($this)."::fetch", LOG_DEBUG); @@ -205,9 +205,9 @@ class Productbatch extends CommonObject // TODO Check qty is ok for stock move. Negative may not be allowed. if ($this->qty < 0) { - + } - + // Update request $sql = "UPDATE ".MAIN_DB_PREFIX.self::$_table_element." SET"; $sql.= " fk_product_stock=".(isset($this->fk_product_stock)?$this->fk_product_stock:"null").","; @@ -435,7 +435,7 @@ class Productbatch extends CommonObject if (! empty($eatby)) array_push($where," eatby = '".$this->db->idate($eatby)."'"); // deprecated if (! empty($sellby)) array_push($where," sellby = '".$this->db->idate($sellby)."'"); // deprecated - + if (! empty($batch_number)) $sql.= " AND batch = '".$this->db->escape($batch_number)."'"; if (! empty($where)) $sql.= " AND (".implode(" OR ",$where).")"; @@ -493,7 +493,7 @@ class Productbatch extends CommonObject $sql.= " t.import_key"; if ($fk_product > 0) { - $sql.= ", pl.eatby as eatby, pl.sellby as sellby"; + $sql.= ", pl.rowid as lotid, pl.eatby as eatby, pl.sellby as sellby"; // TODO May add extrafields to ? } $sql.= " FROM ".MAIN_DB_PREFIX."product_batch as t"; @@ -517,6 +517,7 @@ class Productbatch extends CommonObject $tmp = new Productbatch($db); $tmp->id = $obj->rowid; + $tmp->lotid = $obj->lotid; $tmp->tms = $db->jdate($obj->tms); $tmp->fk_product_stock = $obj->fk_product_stock; $tmp->sellby = $db->jdate($obj->sellby ? $obj->sellby : $obj->oldsellby); diff --git a/htdocs/product/class/productcustomerprice.class.php b/htdocs/product/class/productcustomerprice.class.php index f8ca6366ddc..3b83ae6b858 100644 --- a/htdocs/product/class/productcustomerprice.class.php +++ b/htdocs/product/class/productcustomerprice.class.php @@ -161,19 +161,19 @@ class Productcustomerprice extends CommonObject $sql .= ") VALUES ("; $sql .= " " . $conf->entity . ","; $sql .= " '" . $this->db->idate(dol_now()) . "',"; - $sql .= " " . (! isset($this->fk_product) ? 'NULL' : "'" . $this->fk_product . "'") . ","; - $sql .= " " . (! isset($this->fk_soc) ? 'NULL' : "'" . $this->fk_soc . "'") . ","; - $sql .= " " . (empty($this->price) ? '0' : "'" . $this->price . "'") . ","; - $sql .= " " . (empty($this->price_ttc) ? '0' : "'" . $this->price_ttc . "'") . ","; - $sql .= " " . (empty($this->price_min) ? '0' : "'" . $this->price_min . "'") . ","; - $sql .= " " . (empty($this->price_min_ttc) ? '0' : "'" . $this->price_min_ttc . "'") . ","; + $sql .= " " . (! isset($this->fk_product) ? 'NULL' : "'" . $this->db->escape($this->fk_product) . "'") . ","; + $sql .= " " . (! isset($this->fk_soc) ? 'NULL' : "'" . $this->db->escape($this->fk_soc) . "'") . ","; + $sql .= " " . (empty($this->price) ? '0' : "'" . $this->db->escape($this->price) . "'") . ","; + $sql .= " " . (empty($this->price_ttc) ? '0' : "'" . $this->db->escape($this->price_ttc) . "'") . ","; + $sql .= " " . (empty($this->price_min) ? '0' : "'" . $this->db->escape($this->price_min) . "'") . ","; + $sql .= " " . (empty($this->price_min_ttc) ? '0' : "'" . $this->db->escape($this->price_min_ttc) . "'") . ","; $sql .= " " . (! isset($this->price_base_type) ? 'NULL' : "'" . $this->db->escape($this->price_base_type) . "'") . ","; $sql .= " ".($this->default_vat_code ? "'".$this->db->escape($this->default_vat_code)."'" : "null").","; $sql .= " " . (! isset($this->tva_tx) ? 'NULL' : (empty($this->tva_tx)?0:$this->tva_tx)) . ","; - $sql .= " " . (! isset($this->recuperableonly) ? 'NULL' : "'" . $this->recuperableonly . "'") . ","; - $sql .= " " . (empty($this->localtax1_type) ? "'0'" : "'" . $this->localtax1_type . "'") . ","; + $sql .= " " . (! isset($this->recuperableonly) ? 'NULL' : "'" . $this->db->escape($this->recuperableonly) . "'") . ","; + $sql .= " " . (empty($this->localtax1_type) ? "'0'" : "'" . $this->db->escape($this->localtax1_type) . "'") . ","; $sql .= " " . (! isset($this->localtax1_tx) ? 'NULL' : (empty($this->localtax1_tx)?0:$this->localtax1_tx)) . ","; - $sql .= " " . (empty($this->localtax2_type) ? "'0'" : "'" . $this->localtax2_type . "'") . ","; + $sql .= " " . (empty($this->localtax2_type) ? "'0'" : "'" . $this->db->escape($this->localtax2_type) . "'") . ","; $sql .= " " . (! isset($this->localtax2_tx) ? 'NULL' : (empty($this->localtax2_tx)?0:$this->localtax2_tx)) . ","; $sql .= " " . $user->id . ","; $sql .= " " . (! isset($this->import_key) ? 'NULL' : "'" . $this->db->escape($this->import_key) . "'") . ""; @@ -660,8 +660,8 @@ class Productcustomerprice extends CommonObject $sql .= " recuperableonly=" . (isset($this->recuperableonly) ? $this->recuperableonly : "null") . ","; $sql .= " localtax1_tx=" . (isset($this->localtax1_tx) ? (empty($this->localtax1_tx)?0:$this->localtax1_tx) : "null") . ","; $sql .= " localtax2_tx=" . (isset($this->localtax2_tx) ? (empty($this->localtax2_tx)?0:$this->localtax2_tx) : "null") . ","; - $sql .= " localtax1_type=" . (! empty($this->localtax1_type) ? "'".$this->localtax1_type."'": "'0'") . ","; - $sql .= " localtax2_type=" . (! empty($this->localtax2_type) ? "'".$this->localtax2_type."'": "'0'") . ","; + $sql .= " localtax1_type=" . (! empty($this->localtax1_type) ? "'".$this->db->escape($this->localtax1_type)."'": "'0'") . ","; + $sql .= " localtax2_type=" . (! empty($this->localtax2_type) ? "'".$this->db->escape($this->localtax2_type)."'": "'0'") . ","; $sql .= " fk_user=" . $user->id . ","; $sql .= " import_key=" . (isset($this->import_key) ? "'" . $this->db->escape($this->import_key) . "'" : "null") . ""; diff --git a/htdocs/product/class/propalmergepdfproduct.class.php b/htdocs/product/class/propalmergepdfproduct.class.php index 865589692fb..87fdd132878 100644 --- a/htdocs/product/class/propalmergepdfproduct.class.php +++ b/htdocs/product/class/propalmergepdfproduct.class.php @@ -33,7 +33,7 @@ class Propalmergepdfproduct extends CommonObject { var $element='propal_merge_pdf_product'; //!< Id that identify managed objects var $table_element='propal_merge_pdf_product'; //!< Name of table without prefix where object is stored - + var $fk_product; var $file_name; var $fk_user_author; @@ -41,10 +41,10 @@ class Propalmergepdfproduct extends CommonObject var $datec=''; var $tms=''; var $lang; - + var $lines=array(); - + /** @@ -72,7 +72,7 @@ class Propalmergepdfproduct extends CommonObject $error=0; // Clean parameters - + if (isset($this->fk_product)) $this->fk_product=trim($this->fk_product); if (isset($this->file_name)) $this->file_name=trim($this->file_name); if (isset($this->fk_user_author)) $this->fk_user_author=trim($this->fk_user_author); @@ -80,14 +80,14 @@ class Propalmergepdfproduct extends CommonObject if (isset($this->lang)) $this->lang=trim($this->lang); if (isset($this->import_key)) $this->import_key=trim($this->import_key); - + // Check parameters // Put here code to add control on parameters values // Insert request $sql = "INSERT INTO ".MAIN_DB_PREFIX."propal_merge_pdf_product("; - + $sql.= "fk_product,"; $sql.= "file_name,"; if ($conf->global->MAIN_MULTILANGS) { @@ -97,10 +97,10 @@ class Propalmergepdfproduct extends CommonObject $sql.= "fk_user_mod,"; $sql.= "datec"; - + $sql.= ") VALUES ("; - - $sql.= " ".(! isset($this->fk_product)?'NULL':"'".$this->fk_product."'").","; + + $sql.= " ".(! isset($this->fk_product)?'NULL':"'".$this->db->escape($this->fk_product)."'").","; $sql.= " ".(! isset($this->file_name)?'NULL':"'".$this->db->escape($this->file_name)."'").","; if ($conf->global->MAIN_MULTILANGS) { $sql.= " ".(! isset($this->lang)?'NULL':"'".$this->db->escape($this->lang)."'").","; @@ -109,7 +109,7 @@ class Propalmergepdfproduct extends CommonObject $sql.= " ".$user->id.","; $sql.= " '".$this->db->idate(dol_now())."'"; - + $sql.= ")"; $this->db->begin(); @@ -164,10 +164,10 @@ class Propalmergepdfproduct extends CommonObject function fetch($id) { global $langs,$conf; - + $sql = "SELECT"; $sql.= " t.rowid,"; - + $sql.= " t.fk_product,"; $sql.= " t.file_name,"; $sql.= " t.lang,"; @@ -177,7 +177,7 @@ class Propalmergepdfproduct extends CommonObject $sql.= " t.tms,"; $sql.= " t.import_key"; - + $sql.= " FROM ".MAIN_DB_PREFIX."propal_merge_pdf_product as t"; $sql.= " WHERE t.rowid = ".$id; @@ -190,7 +190,7 @@ class Propalmergepdfproduct extends CommonObject $obj = $this->db->fetch_object($resql); $this->id = $obj->rowid; - + $this->fk_product = $obj->fk_product; $this->file_name = $obj->file_name; if ($conf->global->MAIN_MULTILANGS) { @@ -202,7 +202,7 @@ class Propalmergepdfproduct extends CommonObject $this->tms = $this->db->jdate($obj->tms); $this->import_key = $obj->import_key; - + } $this->db->free($resql); @@ -215,7 +215,7 @@ class Propalmergepdfproduct extends CommonObject return -1; } } - + /** * Load object in memory from the database * @@ -226,10 +226,10 @@ class Propalmergepdfproduct extends CommonObject function fetch_by_product($product_id, $lang='') { global $langs,$conf; - + $sql = "SELECT"; $sql.= " t.rowid,"; - + $sql.= " t.fk_product,"; $sql.= " t.file_name,"; $sql.= " t.lang,"; @@ -238,14 +238,14 @@ class Propalmergepdfproduct extends CommonObject $sql.= " t.datec,"; $sql.= " t.tms,"; $sql.= " t.import_key"; - - + + $sql.= " FROM ".MAIN_DB_PREFIX."propal_merge_pdf_product as t"; $sql.= " WHERE t.fk_product = ".$product_id; if ($conf->global->MAIN_MULTILANGS && !empty($lang)) { $sql.= " AND t.lang = '".$lang."'"; } - + dol_syslog(get_class($this)."::".__METHOD__, LOG_DEBUG); $resql=$this->db->query($sql); if ($resql) @@ -253,11 +253,11 @@ class Propalmergepdfproduct extends CommonObject if ($this->db->num_rows($resql)) { while($obj = $this->db->fetch_object($resql)) { - + $line = new PropalmergepdfproductLine(); - + $line->id = $obj->rowid; - + $line->fk_product = $obj->fk_product; $line->file_name = $obj->file_name; if ($conf->global->MAIN_MULTILANGS) { @@ -268,21 +268,21 @@ class Propalmergepdfproduct extends CommonObject $line->datec = $this->db->jdate($obj->datec); $line->tms = $this->db->jdate($obj->tms); $line->import_key = $obj->import_key; - - + + if ($conf->global->MAIN_MULTILANGS) { $this->lines[$obj->file_name.'_'.$obj->lang]=$line; }else { $this->lines[$obj->file_name]=$line; } - - + + } - - + + } $this->db->free($resql); - + return 1; } else @@ -307,21 +307,21 @@ class Propalmergepdfproduct extends CommonObject $error=0; // Clean parameters - + if (isset($this->fk_product)) $this->fk_product=trim($this->fk_product); if (isset($this->file_name)) $this->file_name=trim($this->file_name); if (isset($this->fk_user_mod)) $this->fk_user_mod=trim($this->fk_user_mod); if (isset($this->lang)) $this->lang=trim($this->lang); - - + + // Check parameters // Put here code to add a control on parameters values // Update request $sql = "UPDATE ".MAIN_DB_PREFIX."propal_merge_pdf_product SET"; - + $sql.= " fk_product=".(isset($this->fk_product)?$this->fk_product:"null").","; $sql.= " file_name=".(isset($this->file_name)?"'".$this->db->escape($this->file_name)."'":"null").","; if ($conf->global->MAIN_MULTILANGS) { @@ -329,7 +329,7 @@ class Propalmergepdfproduct extends CommonObject } $sql.= " fk_user_mod=".$user->id; - + $sql.= " WHERE rowid=".$this->id; $this->db->begin(); @@ -430,7 +430,7 @@ class Propalmergepdfproduct extends CommonObject return 1; } } - + /** * Delete object in database * @@ -444,16 +444,16 @@ class Propalmergepdfproduct extends CommonObject { global $conf, $langs; $error=0; - + $this->db->begin(); - + if (! $error) { if (! $notrigger) { // Uncomment this and change MYOBJECT to your own tag if you // want this action calls a trigger. - + //// Call triggers //include_once DOL_DOCUMENT_ROOT . '/core/class/interfaces.class.php'; //$interface=new Interfaces($this->db); @@ -462,21 +462,21 @@ class Propalmergepdfproduct extends CommonObject //// End call triggers } } - + if (! $error) { $sql = "DELETE FROM ".MAIN_DB_PREFIX."propal_merge_pdf_product"; $sql.= " WHERE fk_product=".$product_id; - + if ($conf->global->MAIN_MULTILANGS && !empty($lang_id)) { $sql.= " AND lang='".$lang_id."'"; } - + dol_syslog(get_class($this)."::".__METHOD__, LOG_DEBUG); $resql = $this->db->query($sql); if (! $resql) { $error++; $this->errors[]="Error ".$this->db->lasterror(); } } - + // Commit or rollback if ($error) { @@ -494,7 +494,7 @@ class Propalmergepdfproduct extends CommonObject return 1; } } - + /** * Delete object in database * @@ -505,16 +505,16 @@ class Propalmergepdfproduct extends CommonObject { global $conf, $langs; $error=0; - + $this->db->begin(); - + if (! $error) { if (! $notrigger) { // Uncomment this and change MYOBJECT to your own tag if you // want this action calls a trigger. - + //// Call triggers //include_once DOL_DOCUMENT_ROOT . '/core/class/interfaces.class.php'; //$interface=new Interfaces($this->db); @@ -523,17 +523,17 @@ class Propalmergepdfproduct extends CommonObject //// End call triggers } } - + if (! $error) { $sql = "DELETE FROM ".MAIN_DB_PREFIX."propal_merge_pdf_product"; $sql.= " WHERE fk_product=".$this->fk_product." AND file_name='".$this->db->escape($this->file_name)."'"; - + dol_syslog(get_class($this)."::".__METHOD__, LOG_DEBUG); $resql = $this->db->query($sql); if (! $resql) { $error++; $this->errors[]="Error ".$this->db->lasterror(); } } - + // Commit or rollback if ($error) { @@ -617,7 +617,7 @@ class Propalmergepdfproduct extends CommonObject function initAsSpecimen() { $this->id=0; - + $this->fk_product=''; $this->file_name=''; $this->fk_user_author=''; @@ -626,7 +626,7 @@ class Propalmergepdfproduct extends CommonObject $this->tms=''; $this->import_key=''; - + } } @@ -637,7 +637,7 @@ class Propalmergepdfproduct extends CommonObject class PropalmergepdfproductLine { var $id; - + var $fk_product; var $file_name; var $lang; diff --git a/htdocs/product/inventory/list.php b/htdocs/product/inventory/list.php index 162567878d1..6f443324f6b 100644 --- a/htdocs/product/inventory/list.php +++ b/htdocs/product/inventory/list.php @@ -69,7 +69,7 @@ $toselect = GETPOST('toselect', 'array'); $contextpage= GETPOST('contextpage','aZ')?GETPOST('contextpage','aZ'):'inventorylist'; // To manage different context of search $id = GETPOST('id','int'); -$backtopage = GETPOST('backtopage'); +$backtopage = GETPOST('backtopage','alpha'); $optioncss = GETPOST('optioncss','alpha'); // Load variable for pagination @@ -143,8 +143,8 @@ if (is_array($extrafields->attribute_label) && count($extrafields->attribute_lab * Put here all code to do according to value of "$action" parameter */ -if (GETPOST('cancel')) { $action='list'; $massaction=''; } -if (! GETPOST('confirmmassaction') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } +if (GETPOST('cancel','alpha')) { $action='list'; $massaction=''; } +if (! GETPOST('confirmmassaction','alpha') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } $parameters=array(); $reshook=$hookmanager->executeHooks('doActions',$parameters,$object,$action); // Note that $action and $object may have been modified by some hooks diff --git a/htdocs/product/list.php b/htdocs/product/list.php index 4f994660052..7d2b1a22b68 100644 --- a/htdocs/product/list.php +++ b/htdocs/product/list.php @@ -193,8 +193,8 @@ if (is_array($extrafields->attribute_label) && count($extrafields->attribute_lab * Actions */ -if (GETPOST('cancel')) { $action='list'; $massaction=''; } -if (! GETPOST('confirmmassaction') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } +if (GETPOST('cancel','alpha')) { $action='list'; $massaction=''; } +if (! GETPOST('confirmmassaction','alpha') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } $parameters=array(); $reshook=$hookmanager->executeHooks('doActions',$parameters, $object, $action); // Note that $action and $object may have been modified by some hooks diff --git a/htdocs/product/reassortlot.php b/htdocs/product/reassortlot.php index 5c89aa4845f..cf4e889e89e 100644 --- a/htdocs/product/reassortlot.php +++ b/htdocs/product/reassortlot.php @@ -28,6 +28,7 @@ require '../main.inc.php'; require_once DOL_DOCUMENT_ROOT.'/product/class/product.class.php'; +require_once DOL_DOCUMENT_ROOT.'/product/stock/class/productlot.class.php'; require_once DOL_DOCUMENT_ROOT.'/core/class/html.formother.class.php'; require_once DOL_DOCUMENT_ROOT.'/categories/class/categorie.class.php'; require_once DOL_DOCUMENT_ROOT.'/product/stock/class/entrepot.class.php'; @@ -115,7 +116,7 @@ $sql.= ' p.duration, p.tosell as statut, p.tobuy, p.seuil_stock_alerte, p.desire $sql.= ' ps.fk_entrepot,'; $sql.= ' e.label as warehouse_ref, e.lieu as warehouse_lieu, e.fk_parent as warehouse_parent,'; $sql.= ' pb.batch, pb.eatby as oldeatby, pb.sellby as oldsellby,'; -$sql.= ' pl.eatby, pl.sellby,'; +$sql.= ' pl.rowid as lotid, pl.eatby, pl.sellby,'; $sql.= ' SUM(pb.qty) as stock_physique, COUNT(pb.rowid) as nbinbatchtable'; $sql.= ' FROM '.MAIN_DB_PREFIX.'product as p'; $sql.= ' LEFT JOIN '.MAIN_DB_PREFIX.'product_stock as ps on p.rowid = ps.fk_product'; // Detail for each warehouse @@ -157,7 +158,7 @@ $sql.= " p.duration, p.tosell, p.tobuy, p.seuil_stock_alerte, p.desiredstock, p. $sql.= " ps.fk_entrepot,"; $sql.= " e.label, e.lieu, e.fk_parent,"; $sql.= " pb.batch, pb.eatby, pb.sellby,"; -$sql.= " pl.eatby, pl.sellby"; +$sql.= " pl.rowid, pl.eatby, pl.sellby"; if ($toolowstock) $sql.= " HAVING SUM(".$db->ifsql('ps.reel IS NULL', '0', 'ps.reel').") < p.seuil_stock_alerte"; // Not used yet $sql.= $db->order($sortfield,$sortorder); @@ -306,6 +307,7 @@ if ($resql) print "\n"; $product_static=new Product($db); + $product_lot_static=new Productlot($db); $warehousetmp=new Entrepot($db); while ($i < min($num,$limit)) @@ -336,6 +338,13 @@ if ($resql) $product_static->type=$objp->fk_product_type; $product_static->entity=$objp->entity; + $product_lot_static->batch=$objp->batch; + $product_lot_static->product_id=$objp->rowid; + $product_lot_static->id=$objp->lotid; + $product_lot_static->eatby=$objp->eatby; + $product_lot_static->sellby=$objp->sellby; + + $warehousetmp->id=$objp->fk_entrepot; $warehousetmp->ref=$objp->warehouse_ref; $warehousetmp->label=$objp->warehouse_ref; @@ -372,7 +381,15 @@ if ($resql) print $warehousetmp->getNomUrl(1); } print ''; - print '
| '.$langs->trans("Label").' | |
| '.$langs->trans("Fieldentity").' | |
| '.$langs->trans("Fieldfk_product").' | |
| '.$langs->trans("Fieldbatch").' | |
| '.$langs->trans("Fieldfk_user_creat").' | |
| '.$langs->trans("Email").' * | |
| '.$langs->trans("Email").' * | |
| '.$langs->trans("Login").' * | |
| '.$langs->trans("Password").' * | |
| '.$langs->trans("PasswordAgain").' * | |
| '.$langs->trans("Login").' * | |
| '.$langs->trans("Password").' * | |
| '.$langs->trans("PasswordAgain").' * | |
| '.$langs->trans("DateToBirth").' | '; diff --git a/htdocs/public/payment/newpayment.php b/htdocs/public/payment/newpayment.php index 1a1d36f9fb1..72ad0390cce 100644 --- a/htdocs/public/payment/newpayment.php +++ b/htdocs/public/payment/newpayment.php @@ -1164,14 +1164,29 @@ if ($source == 'membersubscription') print ' |
| '.$langs->trans("Amount"); if (empty($amount)) { - print ' ('.$langs->trans("ToComplete"); + if (empty($conf->global->MEMBER_NEWFORM_AMOUNT)) print ' ('.$langs->trans("ToComplete"); if (! empty($conf->global->MEMBER_EXT_URL_SUBSCRIPTION_INFO)) print ' - '.$langs->trans("SeeHere").''; - print ')'; + if (empty($conf->global->MEMBER_NEWFORM_AMOUNT)) print ')'; } print ' | '; if (empty($amount) || ! is_numeric($amount)) { - $valtoshow=GETPOST("newamount",'int'); + $valtoshow=GETPOST("newamount",'int'); + // force default subscription amount to value defined into constant... + if (! empty($conf->global->MEMBER_NEWFORM_EDITAMOUNT)) { + if (! empty($conf->global->MEMBER_NEWFORM_AMOUNT)) { + $valtoshow = $conf->global->MEMBER_NEWFORM_AMOUNT; + } + } + else { + if (! empty($conf->global->MEMBER_NEWFORM_AMOUNT)) { + $amount = $conf->global->MEMBER_NEWFORM_AMOUNT; + } + } + } + if (empty($amount) || ! is_numeric($amount)) + { + //$valtoshow=GETPOST("newamount",'int'); if (! empty($conf->global->MEMBER_MIN_AMOUNT) && $valtoshow) $valtoshow=max($conf->global->MEMBER_MIN_AMOUNT,$valtoshow); print ''; print ''; diff --git a/htdocs/resource/class/dolresource.class.php b/htdocs/resource/class/dolresource.class.php index 10485dda4be..6dc093f6142 100644 --- a/htdocs/resource/class/dolresource.class.php +++ b/htdocs/resource/class/dolresource.class.php @@ -33,7 +33,7 @@ class Dolresource extends CommonObject public $element='dolresource'; //!< Id that identify managed objects public $table_element='resource'; //!< Name of table without prefix where object is stored public $picto = 'resource'; - + public $resource_id; public $resource_type; public $element_id; @@ -843,7 +843,7 @@ class Dolresource extends CommonObject // Update request $sql = "UPDATE ".MAIN_DB_PREFIX."element_resources SET"; $sql.= " resource_id=".(isset($this->resource_id)?"'".$this->db->escape($this->resource_id)."'":"null").","; - $sql.= " resource_type=".(isset($this->resource_type)?"'".$this->resource_type."'":"null").","; + $sql.= " resource_type=".(isset($this->resource_type)?"'".$this->db->escape($this->resource_type)."'":"null").","; $sql.= " element_id=".(isset($this->element_id)?$this->element_id:"null").","; $sql.= " element_type=".(isset($this->element_type)?"'".$this->db->escape($this->element_type)."'":"null").","; $sql.= " busy=".(isset($this->busy)?$this->busy:"null").","; @@ -1019,8 +1019,8 @@ class Dolresource extends CommonObject $result.=$link.$this->ref.$linkend; return $result; } - - + + /** * Retourne le libelle du status d'un user (actif, inactif) * @@ -1031,7 +1031,7 @@ class Dolresource extends CommonObject { return $this->LibStatut($this->status,$mode); } - + /** * Return the status * @@ -1042,7 +1042,7 @@ class Dolresource extends CommonObject static function LibStatut($status,$mode=0) { global $langs; - + return ''; - } + } } diff --git a/htdocs/resource/element_resource.php b/htdocs/resource/element_resource.php index a886dcf475b..9c89b516eff 100644 --- a/htdocs/resource/element_resource.php +++ b/htdocs/resource/element_resource.php @@ -108,7 +108,7 @@ if ($action == 'add_element_resource' && ! $cancel) } // Update ressource -if ($action == 'update_linked_resource' && $user->rights->resource->write && !GETPOST('cancel') ) +if ($action == 'update_linked_resource' && $user->rights->resource->write && !GETPOST('cancel','alpha') ) { $res = $object->fetch_element_resource($lineid); if($res) diff --git a/htdocs/societe/agenda.php b/htdocs/societe/agenda.php index 497b9593142..0dea66946ec 100644 --- a/htdocs/societe/agenda.php +++ b/htdocs/societe/agenda.php @@ -76,7 +76,7 @@ if ($reshook < 0) setEventMessages($hookmanager->error, $hookmanager->errors, 'e if (empty($reshook)) { // Cancel - if (GETPOST("cancel") && ! empty($backtopage)) + if (GETPOST('cancel','alpha') && ! empty($backtopage)) { header("Location: ".$backtopage); exit; diff --git a/htdocs/societe/card.php b/htdocs/societe/card.php index bc51fb39375..45101a79d45 100644 --- a/htdocs/societe/card.php +++ b/htdocs/societe/card.php @@ -56,7 +56,7 @@ if (! empty($conf->notification->enabled)) $langs->load("mails"); $mesg=''; $error=0; $errors=array(); $action = (GETPOST('action','aZ09') ? GETPOST('action','aZ09') : 'view'); -$cancel = GETPOST('cancel'); +$cancel = GETPOST('cancel','alpha'); $backtopage = GETPOST('backtopage','alpha'); $confirm = GETPOST('confirm'); $socid = GETPOST('socid','int'); @@ -421,7 +421,7 @@ if (empty($reshook)) else if (! empty($_FILES['photo']['name'])) $object->logo = dol_sanitizeFileName($_FILES['photo']['name']); // Check parameters - if (! GETPOST("cancel")) + if (! GETPOST('cancel','alpha')) { if (! empty($object->email) && ! isValidEMail($object->email)) { @@ -580,7 +580,7 @@ if (empty($reshook)) if ($action == 'update') { - if (GETPOST("cancel")) + if (GETPOST('cancel','alpha')) { if (! empty($backtopage)) { diff --git a/htdocs/societe/class/societe.class.php b/htdocs/societe/class/societe.class.php index d702e4beb14..8fa7081acad 100644 --- a/htdocs/societe/class/societe.class.php +++ b/htdocs/societe/class/societe.class.php @@ -859,13 +859,13 @@ class Societe extends CommonObject $sql .= ",idprof5 = '". $this->db->escape($this->idprof5) ."'"; $sql .= ",idprof6 = '". $this->db->escape($this->idprof6) ."'"; - $sql .= ",tva_assuj = ".($this->tva_assuj!=''?"'".$this->tva_assuj."'":"null"); + $sql .= ",tva_assuj = ".($this->tva_assuj!=''?"'".$this->db->escape($this->tva_assuj)."'":"null"); $sql .= ",tva_intra = '" . $this->db->escape($this->tva_intra) ."'"; $sql .= ",status = " .$this->status; // Local taxes - $sql .= ",localtax1_assuj = ".($this->localtax1_assuj!=''?"'".$this->localtax1_assuj."'":"null"); - $sql .= ",localtax2_assuj = ".($this->localtax2_assuj!=''?"'".$this->localtax2_assuj."'":"null"); + $sql .= ",localtax1_assuj = ".($this->localtax1_assuj!=''?"'".$this->db->escape($this->localtax1_assuj)."'":"null"); + $sql .= ",localtax2_assuj = ".($this->localtax2_assuj!=''?"'".$this->db->escape($this->localtax2_assuj)."'":"null"); if($this->localtax1_assuj==1) { if($this->localtax1_value!='') @@ -1565,7 +1565,7 @@ class Societe extends CommonObject // Positionne remise courante $sql = "UPDATE ".MAIN_DB_PREFIX."societe "; $sql.= " SET remise_client = '".$this->db->escape($remise)."'"; - $sql.= " WHERE rowid = " . $this->id .";"; + $sql.= " WHERE rowid = " . $this->id; $resql=$this->db->query($sql); if (! $resql) { @@ -1698,7 +1698,7 @@ class Societe extends CommonObject else $sql.= " WHERE entity in (0, ".$conf->entity.")"; - $sql.= " AND u.rowid = sc.fk_user AND sc.fk_soc =".$this->id; + $sql.= " AND u.rowid = sc.fk_user AND sc.fk_soc = ".$this->id; $resql = $this->db->query($sql); if ($resql) @@ -1751,7 +1751,7 @@ class Societe extends CommonObject $sql = "INSERT INTO ".MAIN_DB_PREFIX."societe_prices"; $sql .= " (datec, fk_soc, price_level, fk_user_author)"; - $sql .= " VALUES ('".$this->db->idate($now)."',".$this->id.",'".$this->db->escape($price_level)."',".$user->id.")"; + $sql .= " VALUES ('".$this->db->idate($now)."', ".$this->id.", '".$this->db->escape($price_level)."', ".$user->id.")"; if (! $this->db->query($sql)) { @@ -2947,17 +2947,17 @@ class Societe extends CommonObject } /** - * Charge la liste des categories fournisseurs + * Insert link supplier - category * * @param int $categorie_id Id of category * @return int 0 if success, <> 0 if error */ function AddFournisseurInCategory($categorie_id) { - if ($categorie_id > 0) + if ($categorie_id > 0 && $this->id > 0) { $sql = "INSERT INTO ".MAIN_DB_PREFIX."categorie_fournisseur (fk_categorie, fk_soc) "; - $sql.= " VALUES ('".$categorie_id."','".$this->id."');"; + $sql.= " VALUES (".$categorie_id.", ".$this->id.")"; if ($resql=$this->db->query($sql)) return 0; } diff --git a/htdocs/societe/list.php b/htdocs/societe/list.php index 02b717feb9b..e23a457cea5 100644 --- a/htdocs/societe/list.php +++ b/htdocs/societe/list.php @@ -208,8 +208,8 @@ $object = new Societe($db); * Actions */ -if (GETPOST('cancel')) { $action='list'; $massaction=''; } -if (! GETPOST('confirmmassaction') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } +if (GETPOST('cancel','alpha')) { $action='list'; $massaction=''; } +if (! GETPOST('confirmmassaction','alpha') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } $parameters=array(); $reshook=$hookmanager->executeHooks('doActions',$parameters, $object, $action); // Note that $action and $object may have been modified by some hooks diff --git a/htdocs/stripe/admin/stripe.php b/htdocs/stripe/admin/stripe.php index 4abf52fe0e0..de3c4db8987 100644 --- a/htdocs/stripe/admin/stripe.php +++ b/htdocs/stripe/admin/stripe.php @@ -67,6 +67,11 @@ if ($action == 'setvalue' && $user->admin) if (! $result > 0) $error++; $result=dolibarr_set_const($db, "ONLINE_PAYMENT_SENDEMAIL",GETPOST('ONLINE_PAYMENT_SENDEMAIL'),'chaine',0,'',$conf->entity); if (! $result > 0) $error++; + // Payment token for URL + $result=dolibarr_set_const($db, "PAYMENT_SECURITY_TOKEN",GETPOST('PAYMENT_SECURITY_TOKEN','alpha'),'chaine',0,'',$conf->entity); + if (! $result > 0) $error++; + $result=dolibarr_set_const($db, "PAYMENT_SECURITY_TOKEN_UNIQUE",GETPOST('PAYMENT_SECURITY_TOKEN_UNIQUE','alpha'),'chaine',0,'',$conf->entity); + if (! $result > 0) $error++; if (! $error) { @@ -220,6 +225,19 @@ print ' |
| '; +print $langs->trans("SecurityToken").' | '; +print ''; +if (! empty($conf->use_javascript_ajax)) + print ' '.img_picto($langs->trans('Generate'), 'refresh', 'id="generate_token" class="linkobject"'); +print ' |
| '; +print $langs->trans("SecurityTokenIsUnique").' | '; +print $form->selectyesno("PAYMENT_SECURITY_TOKEN_UNIQUE",(empty($conf->global->PAYMENT_SECURITY_TOKEN)?0:$conf->global->PAYMENT_SECURITY_TOKEN_UNIQUE),1); +print ' |
'; $token=''; - -// Url list -print ''.$langs->trans("FollowingUrlAreAvailableToMakePayments").':
'; -print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnFreeAmount",$servicename).':
'; -print ''.getStripePaymentUrl(1,'free')."
\n"; -if (! empty($conf->commande->enabled)) -{ - print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnOrder",$servicename).':
'; - print ''.getStripePaymentUrl(1,'order')."
\n"; - if (! empty($conf->global->STRIPE_SECURITY_TOKEN) && ! empty($conf->global->STRIPE_SECURITY_TOKEN_UNIQUE)) - { - $langs->load("orders"); - print ''; - } - print '
'; -} -if (! empty($conf->facture->enabled)) -{ - print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnInvoice",$servicename).':
'; - print ''.getStripePaymentUrl(1,'invoice')."
\n"; - if (! empty($conf->global->STRIPE_SECURITY_TOKEN) && ! empty($conf->global->STRIPE_SECURITY_TOKEN_UNIQUE)) - { - $langs->load("bills"); - print ''; - } - print '
'; -} -if (! empty($conf->contrat->enabled)) -{ - print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnContractLine",$servicename).':
'; - print ''.getStripePaymentUrl(1,'contractline')."
\n"; - if (! empty($conf->global->STRIPE_SECURITY_TOKEN) && ! empty($conf->global->STRIPE_SECURITY_TOKEN_UNIQUE)) - { - $langs->load("contract"); - print ''; - } - print '
'; -} -if (! empty($conf->adherent->enabled)) -{ - print img_picto('','object_globe.png').' '.$langs->trans("ToOfferALinkForOnlinePaymentOnMemberSubscription",$servicename).':
'; - print ''.getStripePaymentUrl(1,'membersubscription')."
\n"; - if (! empty($conf->global->STRIPE_SECURITY_TOKEN) && ! empty($conf->global->STRIPE_SECURITY_TOKEN_UNIQUE)) - { - $langs->load("members"); - print ''; - } - print '
'; -} - -print info_admin($langs->trans("YouCanAddTagOnUrl")); +include DOL_DOCUMENT_ROOT.'/core/tpl/onlinepaymentlinks.tpl.php'; if (! empty($conf->use_javascript_ajax)) { print "\n".''; } diff --git a/htdocs/supplier_proposal/card.php b/htdocs/supplier_proposal/card.php index 04d0a09a804..fda4eea65ea 100644 --- a/htdocs/supplier_proposal/card.php +++ b/htdocs/supplier_proposal/card.php @@ -434,7 +434,7 @@ if (empty($reshook)) } // Reopen proposal - else if ($action == 'confirm_reopen' && $user->rights->supplier_proposal->cloturer && ! GETPOST('cancel')) { + else if ($action == 'confirm_reopen' && $user->rights->supplier_proposal->cloturer && ! GETPOST('cancel','alpha')) { // prevent browser refresh from reopening proposal several times if ($object->statut == SupplierProposal::STATUS_SIGNED || $object->statut == SupplierProposal::STATUS_NOTSIGNED || $object->statut == SupplierProposal::STATUS_CLOSE) { $object->reopen($user, SupplierProposal::STATUS_VALIDATED); @@ -442,7 +442,7 @@ if (empty($reshook)) } // Close proposal - else if ($action == 'close' && $user->rights->supplier_proposal->cloturer && ! GETPOST('cancel')) { + else if ($action == 'close' && $user->rights->supplier_proposal->cloturer && ! GETPOST('cancel','alpha')) { // prevent browser refresh from reopening proposal several times if ($object->statut == SupplierProposal::STATUS_SIGNED) { $object->setStatut(SupplierProposal::STATUS_CLOSE); @@ -450,7 +450,7 @@ if (empty($reshook)) } // Set accepted/refused - else if ($action == 'setstatut' && $user->rights->supplier_proposal->cloturer && ! GETPOST('cancel')) { + else if ($action == 'setstatut' && $user->rights->supplier_proposal->cloturer && ! GETPOST('cancel','alpha')) { if (! GETPOST('statut')) { setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentities("CloseAs")), null, 'errors'); $action = 'statut'; @@ -871,7 +871,7 @@ if (empty($reshook)) } } - else if ($action == 'updateligne' && $user->rights->supplier_proposal->creer && GETPOST('cancel') == $langs->trans('Cancel')) { + else if ($action == 'updateligne' && $user->rights->supplier_proposal->creer && GETPOST('cancel','alpha') == $langs->trans('Cancel')) { header('Location: ' . $_SERVER['PHP_SELF'] . '?id=' . $object->id); // Pour reaffichage de la fiche en cours d'edition exit(); } diff --git a/htdocs/supplier_proposal/class/supplier_proposal.class.php b/htdocs/supplier_proposal/class/supplier_proposal.class.php index 142fcc413e5..b6166124af0 100644 --- a/htdocs/supplier_proposal/class/supplier_proposal.class.php +++ b/htdocs/supplier_proposal/class/supplier_proposal.class.php @@ -2829,27 +2829,27 @@ class SupplierProposalLine extends CommonObjectLine $sql.= ' ref_fourn,'; $sql.= ' fk_multicurrency, multicurrency_code, multicurrency_subprice, multicurrency_total_ht, multicurrency_total_tva, multicurrency_total_ttc, fk_unit)'; $sql.= " VALUES (".$this->fk_supplier_proposal.","; - $sql.= " ".($this->fk_parent_line>0?"'".$this->fk_parent_line."'":"null").","; + $sql.= " ".($this->fk_parent_line>0?"'".$this->db->escape($this->fk_parent_line)."'":"null").","; $sql.= " ".(! empty($this->label)?"'".$this->db->escape($this->label)."'":"null").","; $sql.= " '".$this->db->escape($this->desc)."',"; - $sql.= " ".($this->fk_product?"'".$this->fk_product."'":"null").","; - $sql.= " '".$this->product_type."',"; - $sql.= " ".($this->fk_remise_except?"'".$this->fk_remise_except."'":"null").","; + $sql.= " ".($this->fk_product?"'".$this->db->escape($this->fk_product)."'":"null").","; + $sql.= " '".$this->db->escape($this->product_type)."',"; + $sql.= " ".($this->fk_remise_except?"'".$this->db->escape($this->fk_remise_except)."'":"null").","; $sql.= " ".price2num($this->qty).","; $sql.= " ".price2num($this->tva_tx).","; $sql.= " ".price2num($this->localtax1_tx).","; $sql.= " ".price2num($this->localtax2_tx).","; - $sql.= " '".$this->localtax1_type."',"; - $sql.= " '".$this->localtax2_type."',"; + $sql.= " '".$this->db->escape($this->localtax1_type)."',"; + $sql.= " '".$this->db->escape($this->localtax2_type)."',"; $sql.= " ".(!empty($this->subprice)?price2num($this->subprice):"null").","; $sql.= " ".price2num($this->remise_percent).","; - $sql.= " ".(isset($this->info_bits)?"'".$this->info_bits."'":"null").","; + $sql.= " ".(isset($this->info_bits)?"'".$this->db->escape($this->info_bits)."'":"null").","; $sql.= " ".price2num($this->total_ht).","; $sql.= " ".price2num($this->total_tva).","; $sql.= " ".price2num($this->total_localtax1).","; $sql.= " ".price2num($this->total_localtax2).","; $sql.= " ".price2num($this->total_ttc).","; - $sql.= " ".(!empty($this->fk_fournprice)?"'".$this->fk_fournprice."'":"null").","; + $sql.= " ".(!empty($this->fk_fournprice)?"'".$this->db->escape($this->fk_fournprice)."'":"null").","; $sql.= " ".(isset($this->pa_ht)?"'".price2num($this->pa_ht)."'":"null").","; $sql.= ' '.$this->special_code.','; $sql.= ' '.$this->rang.','; @@ -3025,7 +3025,7 @@ class SupplierProposalLine extends CommonObjectLine $sql.= " , total_localtax1=".price2num($this->total_localtax1).""; $sql.= " , total_localtax2=".price2num($this->total_localtax2).""; } - $sql.= " , fk_product_fournisseur_price=".(! empty($this->fk_fournprice)?"'".$this->fk_fournprice."'":"null"); + $sql.= " , fk_product_fournisseur_price=".(! empty($this->fk_fournprice)?"'".$this->db->escape($this->fk_fournprice)."'":"null"); $sql.= " , buy_price_ht=".price2num($this->pa_ht); if (strlen($this->special_code)) $sql.= " , special_code=".$this->special_code; $sql.= " , fk_parent_line=".($this->fk_parent_line>0?$this->fk_parent_line:"null"); diff --git a/htdocs/supplier_proposal/list.php b/htdocs/supplier_proposal/list.php index f92c0e6305d..96d1079b92a 100644 --- a/htdocs/supplier_proposal/list.php +++ b/htdocs/supplier_proposal/list.php @@ -168,8 +168,8 @@ if (is_array($extrafields->attribute_label) && count($extrafields->attribute_lab * Actions */ -if (GETPOST('cancel')) { $action='list'; $massaction=''; } -if (! GETPOST('confirmmassaction') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } +if (GETPOST('cancel','alpha')) { $action='list'; $massaction=''; } +if (! GETPOST('confirmmassaction','alpha') && $massaction != 'presend' && $massaction != 'confirm_presend') { $massaction=''; } $parameters=array('socid'=>$socid); $reshook=$hookmanager->executeHooks('doActions',$parameters,$object,$action); // Note that $action and $object may have been modified by some hooks @@ -420,7 +420,7 @@ if ($resql) { $langs->load("mails"); - if (! GETPOST('cancel')) + if (! GETPOST('cancel','alpha')) { $objecttmp=new SupplierProposal($db); $listofselectedid=array(); diff --git a/htdocs/theme/eldy/style.css.php b/htdocs/theme/eldy/style.css.php index f89dc060489..3d58211fbde 100644 --- a/htdocs/theme/eldy/style.css.php +++ b/htdocs/theme/eldy/style.css.php @@ -3818,16 +3818,45 @@ pre#editfilecontentaceeditorid { #comment div { box-sizing:border-box; } - #comment .comment { border-radius:7px; - padding:7px 10px; margin-bottom:10px; + overflow:hidden; +} +#comment .comment-table { + display:table; + height:100%; +} +#comment .comment-cell { + display:table-cell; } #comment .comment-info { font-size:0.8em; - color:#555; - margin-top:5px; + border-right:1px solid #dedede; + margin-right:10px; + width:160px; + text-align:center; + background:rgba(255,255,255,0.5); + vertical-align:middle; + padding:10px 2px; +} +#comment .comment-info a { + color:inherit; +} +#comment .comment-right { + vertical-align:top; +} +#comment .comment-description { + padding:10px; + vertical-align:top; +} +#comment .comment-delete { + width: 100px; + text-align:center; + vertical-align:middle; +} +#comment .comment-delete:hover { + background:rgba(250,20,20,0.8); } #comment textarea { width: 100%; diff --git a/htdocs/user/card.php b/htdocs/user/card.php index 0eac875046b..a495290f47a 100644 --- a/htdocs/user/card.php +++ b/htdocs/user/card.php @@ -55,7 +55,7 @@ $mode = GETPOST('mode','alpha'); $confirm = GETPOST('confirm','alpha'); $subaction = GETPOST('subaction','alpha'); $group = GETPOST("group","int",3); -$cancel = GETPOST('cancel'); +$cancel = GETPOST('cancel','alpha'); // Users/Groups management only in master entity if transverse mode if (($action == 'create' || $action == 'adduserldap') && ! empty($conf->multicompany->enabled) && $conf->entity > 1 && $conf->global->MULTICOMPANY_TRANSVERSE_MODE) diff --git a/htdocs/user/class/usergroup.class.php b/htdocs/user/class/usergroup.class.php index 5240605c25c..1dac2e1672b 100644 --- a/htdocs/user/class/usergroup.class.php +++ b/htdocs/user/class/usergroup.class.php @@ -75,7 +75,7 @@ class UserGroup extends CommonObject * @param string $groupname name du groupe a charger * @return int <0 if KO, >0 if OK */ - function fetch($id='', $groupname='') + function fetch($id='', $groupname='', $load_members = true) { global $conf; @@ -107,7 +107,8 @@ class UserGroup extends CommonObject $this->datec = $obj->datec; $this->datem = $obj->datem; - $this->members=$this->listUsersForGroup(); + if($load_members) + $this->members=$this->listUsersForGroup(); // Retreive all extrafield for group @@ -138,7 +139,7 @@ class UserGroup extends CommonObject * @param int $userid User id to search * @return array Array of groups objects */ - function listGroupsForUser($userid) + function listGroupsForUser($userid, $load_members = true) { global $conf, $user; @@ -168,7 +169,7 @@ class UserGroup extends CommonObject if (! array_key_exists($obj->rowid, $ret)) { $newgroup=new UserGroup($this->db); - $newgroup->fetch($obj->rowid); + $newgroup->fetch($obj->rowid, '', $load_members); $ret[$obj->rowid]=$newgroup; } diff --git a/htdocs/user/clicktodial.php b/htdocs/user/clicktodial.php index 2ba3c67d0b4..64919029536 100644 --- a/htdocs/user/clicktodial.php +++ b/htdocs/user/clicktodial.php @@ -53,7 +53,7 @@ $reshook=$hookmanager->executeHooks('doActions',$parameters,$object,$action); if ($reshook < 0) setEventMessages($hookmanager->error, $hookmanager->errors, 'errors'); if (empty($reshook)) { - if ($action == 'update' && !GETPOST('cancel')) { + if ($action == 'update' && !GETPOST('cancel','alpha')) { $edituser = new User($db); $edituser->fetch($id); diff --git a/htdocs/user/group/index.php b/htdocs/user/group/index.php index 9624e462a71..f4b962fb86f 100644 --- a/htdocs/user/group/index.php +++ b/htdocs/user/group/index.php @@ -68,8 +68,8 @@ $fieldstosearchall = array( * Actions */ -if (GETPOST('cancel')) { $action='list'; $massaction=''; } -if (! GETPOST('confirmmassaction') && $massaction != 'presend' && $massaction != 'confirm_presend' && $massaction != 'confirm_createbills') { $massaction=''; } +if (GETPOST('cancel','alpha')) { $action='list'; $massaction=''; } +if (! GETPOST('confirmmassaction','alpha') && $massaction != 'presend' && $massaction != 'confirm_presend' && $massaction != 'confirm_createbills') { $massaction=''; } $parameters=array(); $reshook=$hookmanager->executeHooks('doActions',$parameters); // Note that $action and $object may have been modified by some hooks diff --git a/htdocs/user/index.php b/htdocs/user/index.php index f9989827021..04bbbcf8b81 100644 --- a/htdocs/user/index.php +++ b/htdocs/user/index.php @@ -135,8 +135,8 @@ if ($mode == 'employee') $search_employee=1; * Actions */ -if (GETPOST('cancel')) { $action='list'; $massaction=''; } -if (! GETPOST('confirmmassaction') && $massaction != 'presend' && $massaction != 'confirm_presend' && $massaction != 'confirm_createbills') { $massaction=''; } +if (GETPOST('cancel','alpha')) { $action='list'; $massaction=''; } +if (! GETPOST('confirmmassaction','alpha') && $massaction != 'presend' && $massaction != 'confirm_presend' && $massaction != 'confirm_createbills') { $massaction=''; } $parameters=array(); $reshook=$hookmanager->executeHooks('doActions',$parameters); // Note that $action and $object may have been modified by some hooks diff --git a/htdocs/user/passwordforgotten.php b/htdocs/user/passwordforgotten.php index 9c2aabd3654..43cb5097bba 100644 --- a/htdocs/user/passwordforgotten.php +++ b/htdocs/user/passwordforgotten.php @@ -48,19 +48,19 @@ $action=GETPOST('action', 'alpha'); $mode=$dolibarr_main_authentication; if (! $mode) $mode='http'; -$username = GETPOST('username'); -$passwordhash = GETPOST('passwordhash'); -$conf->entity = (GETPOST('entity') ? GETPOST('entity') : 1); +$username = GETPOST('username','alpha'); +$passwordhash = GETPOST('passwordhash','alpha'); +$conf->entity = (GETPOST('entity','int') ? GETPOST('entity','int') : 1); // Instantiate hooks of thirdparty module only if not already define $hookmanager->initHooks(array('passwordforgottenpage')); -if (GETPOST('dol_hide_leftmenu') || ! empty($_SESSION['dol_hide_leftmenu'])) $conf->dol_hide_leftmenu=1; -if (GETPOST('dol_hide_topmenu') || ! empty($_SESSION['dol_hide_topmenu'])) $conf->dol_hide_topmenu=1; -if (GETPOST('dol_optimize_smallscreen') || ! empty($_SESSION['dol_optimize_smallscreen'])) $conf->dol_optimize_smallscreen=1; -if (GETPOST('dol_no_mouse_hover') || ! empty($_SESSION['dol_no_mouse_hover'])) $conf->dol_no_mouse_hover=1; -if (GETPOST('dol_use_jmobile') || ! empty($_SESSION['dol_use_jmobile'])) $conf->dol_use_jmobile=1; +if (GETPOST('dol_hide_leftmenu','alpha') || ! empty($_SESSION['dol_hide_leftmenu'])) $conf->dol_hide_leftmenu=1; +if (GETPOST('dol_hide_topmenu','alpha') || ! empty($_SESSION['dol_hide_topmenu'])) $conf->dol_hide_topmenu=1; +if (GETPOST('dol_optimize_smallscreen','alpha') || ! empty($_SESSION['dol_optimize_smallscreen'])) $conf->dol_optimize_smallscreen=1; +if (GETPOST('dol_no_mouse_hover','alpha') || ! empty($_SESSION['dol_no_mouse_hover'])) $conf->dol_no_mouse_hover=1; +if (GETPOST('dol_use_jmobile','alpha') || ! empty($_SESSION['dol_use_jmobile'])) $conf->dol_use_jmobile=1; /** diff --git a/htdocs/variants/combinations.php b/htdocs/variants/combinations.php index 0ec1bf07b68..f5feba2e606 100644 --- a/htdocs/variants/combinations.php +++ b/htdocs/variants/combinations.php @@ -41,7 +41,7 @@ $massaction=GETPOST('massaction','alpha'); $show_files=GETPOST('show_files','int'); $confirm=GETPOST('confirm','alpha'); $toselect = GETPOST('toselect', 'array'); -$cancel = GETPOST('cancel'); +$cancel = GETPOST('cancel','alpha'); // Security check $fieldvalue = (! empty($id) ? $id : $ref); diff --git a/htdocs/websites/class/website.class.php b/htdocs/websites/class/website.class.php index 2fd86208934..8a1b30d936d 100644 --- a/htdocs/websites/class/website.class.php +++ b/htdocs/websites/class/website.class.php @@ -140,7 +140,7 @@ class Website extends CommonObject $sql .= ' '.(! isset($this->description)?'NULL':"'".$this->db->escape($this->description)."'").','; $sql .= ' '.(! isset($this->status)?'NULL':$this->status).','; $sql .= ' '.(! isset($this->fk_default_home)?'NULL':$this->fk_default_home).','; - $sql .= ' '.(! isset($this->virtualhost)?'NULL':"'".$this->virtualhost)."',"; + $sql .= ' '.(! isset($this->virtualhost)?'NULL':"'".$this->db->escape($this->virtualhost)."'").","; $sql .= ' '.(! isset($this->fk_user_create)?$user->id:$this->fk_user_create).','; $sql .= ' '.(! isset($this->date_creation) || dol_strlen($this->date_creation)==0?'NULL':"'".$this->db->idate($this->date_creation)."'").","; $sql .= ' '.(! isset($this->date_modification) || dol_strlen($this->date_modification)==0?'NULL':"'".$this->db->idate($this->date_creation)."'"); diff --git a/scripts/emailings/mailing-send.php b/scripts/emailings/mailing-send.php index 6465e765cfe..0de6ca4f5fd 100755 --- a/scripts/emailings/mailing-send.php +++ b/scripts/emailings/mailing-send.php @@ -64,7 +64,7 @@ print "***** ".$script_file." (".$version.") pid=".dol_getmypid()." *****\n"; if ($conf->global->MAILING_LIMIT_SENDBYCLI == '-1') { - + } $user = new User($db); @@ -98,7 +98,7 @@ if ($resql) $emailing = new Mailing($db); $emailing->fetch($obj->rowid); - + $id = $emailing->id; $subject = $emailing->sujet; $message = $emailing->body; @@ -120,7 +120,7 @@ if ($resql) { $sql2.= " LIMIT ".$conf->global->MAILING_LIMIT_SENDBYCLI; } - + $resql2=$db->query($sql2); if ($resql2) { @@ -145,6 +145,7 @@ if ($resql) $i = 0; while ($i < $num2) { + // Here code is common with same loop ino card.php $res=1; $now=dol_now(); @@ -178,13 +179,43 @@ if ($resql) '__CHECK_READ__' => '
'; + } print $langs->trans('User').' : '.$userstatic->getNomUrl().'
'; print $langs->trans('Date').' : '.dol_print_date($comment->datec,'dayhoursec'); + print '
'.$langs->trans('Delete').''; + print ''; + print img_picto('', 'delete.png'); + print ''; } - print '