Fix: Plantage si parenth�ses dans cr�ation facture fournisseur.

Qual: Mise en transaction de la cr�ation d'un facture fournisseur

htdocs/fourn/facture/fiche.php

@@ -143,20 +143,30 @@ if ($_POST["action"] == 'add' && $user->rights->fournisseur->facture->creer)
                 if (strlen($_POST[$label]) > 0 && !empty($_POST[$amount]))
                 {
                     $atleastoneline=1;
-                    $facfou->addline($_POST["$label"], $_POST["$amount"], $_POST["$tauxtva"], $_POST["$qty"], 1);
+                    $ret=$facfou->addline($_POST["$label"], $_POST["$amount"], $_POST["$tauxtva"], $_POST["$qty"], 1);
+                    if ($ret < 0) $nberror++;
                 }
                 else if (strlen($_POST[$label]) > 0 && empty($_POST[$amount]))
                 {
                     $ht = $_POST[$amountttc] / (1 + ($_POST[$tauxtva] / 100));
                     $atleastoneline=1;
-                    $facfou->addline($_POST[$label], $ht, $_POST[$tauxtva], $_POST[$qty], 1);
+                    $ret=$facfou->addline($_POST[$label], $ht, $_POST[$tauxtva], $_POST[$qty], 1);
+                    if ($ret < 0) $nberror++;
                 }
             }
-
+            if ($nberror)
+            {
+                $db->rollback();
+                $mesg='<div class="error">'.$facfou->error.'</div>';
+                $_GET["action"]='create';
+            }
+            else 
+            {
                 $db->commit();
                 header("Location: fiche.php?facid=$facid");
                 exit;
             }
+        }
         else
         {
             $db->rollback();

htdocs/fourn/fournisseur.facture.class.php

@@ -90,24 +90,25 @@ class FactureFournisseur
         global $langs;
     
         $socid = $this->socidp;
-    $number = $this->number;
+        $number = sanitize_string(strtoupper($this->number));
         $amount = $this->amount;
         $remise = $this->remise;
     
-    if (! $remise)
-    {
-        $remise = 0 ;
-    }
     
+        $this->db->begin();
+    
+    
+        if (! $remise) $remise = 0 ;
         $totalht = ($amount - $remise);
         $tva = tva($totalht);
         $total = $totalht + $tva;
     
         $sql = "INSERT INTO ".MAIN_DB_PREFIX."facture_fourn (facnumber, libelle, fk_soc, datec, datef, note, fk_user_author) ";
-    $sql .= " VALUES ('".$this->number."','".$this->libelle."',";
+        $sql .= " VALUES ('".$number."','".addslashes($this->libelle)."',";
-    $sql .= $this->socid.", now(),".$this->db->idate($this->date).",'".$this->note."', ".$user->id.");";
+        $sql .= $this->socid.", now(),".$this->db->idate($this->date).",'".addslashes($this->note)."', ".$user->id.");";
     
-    if ( $this->db->query($sql) )
+        $resql=$this->db->query($sql);
+        if ($resql)
         {
             $this->id = $this->db->last_insert_id(MAIN_DB_PREFIX."facture_fourn");
     
@@ -116,7 +117,7 @@ class FactureFournisseur
     
                 $sql = "INSERT INTO ".MAIN_DB_PREFIX."facture_fourn_det (fk_facture_fourn)";
                 $sql .= " VALUES ($this->id);";
-            if ($this->db->query($sql) )
+                if ($this->db->query($sql))
                 {
                     $idligne = $this->db->last_insert_id(MAIN_DB_PREFIX."facture_fourn_det");
     
@@ -128,28 +129,34 @@ class FactureFournisseur
                 }
             }
     
-        /*
+            // Mise <20> jour prix
-        * Mise <20> jour prix
+            if ($this->updateprice($this->id) > 0)
-        */
+            {
-
+                $this->db->commit();
-        $this->updateprice($this->id);
-
                 return $this->id;
             }
+            else {
+                $this->error=$langs->trans("FailedToUpdatePrice");
+                $this->db->rollback();
+                return -3;
+            }        
+        }
         else
         {
             if ($this->db->errno() == DB_ERROR_RECORD_ALREADY_EXISTS)
             {
                 $this->error=$langs->trans("ErrorBillRefAlreadyExists");
+                $this->db->rollback();
                 return -1;
             }
             else
             {
-            dolibarr_print_error($this->db);
+                $this->error=$this->db->error();
+                $this->db->rollback();
                 return -2;
             }
         }
-}
+    }
 
   /**
    *    \brief      Recup<75>re l'objet facture et ses lignes de factures
@@ -323,7 +330,7 @@ class FactureFournisseur
    * \param     puht            prix unitaire
    * \param     tauxtva         taux tva
    * \param     qty             quantit<69>
-   * \return    int     0 si erreur
+   * \return    int             <0 si ko, >0 si ok
    */
   function updateline($id, $label, $puht, $tauxtva, $qty=1)
   {
@@ -337,23 +344,26 @@ class FactureFournisseur
         $totalttc = $totalht + $tva;
     
         $sql = "UPDATE ".MAIN_DB_PREFIX."facture_fourn_det ";
-	$sql .= "SET description ='".$label."'";
+        $sql .= "SET description ='".addslashes($label)."'";
         $sql .= ", pu_ht = "  .ereg_replace(",",".",$puht);
         $sql .= ", qty ="     .ereg_replace(",",".",$qty);
         $sql .= ", total_ht=" .ereg_replace(",",".",$totalht);
         $sql .= ", tva="      .ereg_replace(",",".",$tva);
         $sql .= ", tva_taux=" .ereg_replace(",",".",$tauxtva);
         $sql .= ", total_ttc=".ereg_replace(",",".",$totalttc);
-	
         $sql .= " WHERE rowid = ".$id;
     
-	if (! $this->db->query($sql) )
+        $resql=$this->db->query($sql);
+        if ($resql)
         {
-	    dolibarr_print_error($this->db);
-	  }
-
             // Mise a jour prix facture
-	$this->updateprice($this->id);
+            return $this->updateprice($this->id);
+        }
+        else
+        {
+            $this->error=$this->db->error();
+            return -1;
+        }
     }
   }
 
@@ -381,6 +391,7 @@ class FactureFournisseur
    /**
     *    \brief      Mise <20> jour des sommes de la facture
     *    \param      facid       id de la facture a modifier
+    *    \return     int         <0 si ko, >0 si ok
     */
     function updateprice($facid)
     {
@@ -420,10 +431,20 @@ class FactureFournisseur
             $sql .= " WHERE rowid = $facid ;";
     
             $result = $this->db->query($sql);
+            if ($result) 
+            {
+                return 1;
+            }
+            else
+            {
+                $this->error=$this->db->error();
+                return -2;
+            }
         }
         else
         {
             dolibarr_print_error($this->db);
+            return -1;
         }
     }
   

htdocs/lib/functions.inc.php

@@ -78,6 +78,11 @@ function check_mail ($mail)
     }
 }
 
+/**
+        \brief          Nettoie chaine de caract<63>re des accents
+        \param          str             Chaine a nettoyer
+        \return         string          Chaine nettoy<6F>
+*/
 function unaccent($str)
 {
   $acc = array("<EFBFBD>","<EFBFBD>","<EFBFBD>","<EFBFBD>","<EFBFBD>","<EFBFBD>","<EFBFBD>","<EFBFBD>","<EFBFBD>","<EFBFBD>","<EFBFBD>","'");
@@ -86,6 +91,18 @@ function unaccent($str)
   return str_replace($acc, $uac, $str);
 }
 
+/**
+        \brief          Nettoie chaine de caract<63>re de caract<63>res sp<73>ciaux
+        \param          str             Chaine a nettoyer
+        \return         string          Chaine nettoy<6F>
+*/
+function sanitize_string($str)
+{
+    $forbidden_chars=array("'","/","\\",":","*","?","\"","<",">","|","[","]",",",";","="); 
+    return str_replace($forbidden_chars,"_",$str);
+}
+
+
 /**
    \brief       Envoi des messages dolibarr dans syslog ou dans un fichier
                 Pour syslog:    facility d<>fini par SYSLOG_FACILITY