Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-12-06 01:28:19 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix to exclude possible sql injection

Browse Source
This commit is contained in:
Laurent Destailleur
2020-09-25 17:11:54 +02:00
parent 0d797a793a
commit 1b83b55995
4 changed files with 132 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

139
htdocs/admin/emailcollector_list.php
View File

@@ -31,10 +31,7 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/company.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/company.lib.php';
dol_include_once('/emailcollector/class/emailcollector.class.php'); dol_include_once('/emailcollector/class/emailcollector.class.php');
if (!$user->admin) accessforbidden(); // Load translation files required by page
if (empty($conf->emailcollector->enabled)) accessforbidden();
// Load traductions files required by page
$langs->loadLangs(array("admin", "other")); $langs->loadLangs(array("admin", "other"));
$action = GETPOST('action', 'aZ09') ?GETPOST('action', 'aZ09') : 'view'; // The action 'add', 'create', 'edit', 'update', 'view', ... $action = GETPOST('action', 'aZ09') ?GETPOST('action', 'aZ09') : 'view'; // The action 'add', 'create', 'edit', 'update', 'view', ...
@@ -54,7 +51,7 @@ $limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'aZ09comma'); $sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma'); $sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int'); $page = GETPOSTISSET('pageplusone') ? (GETPOST('pageplusone') - 1) : GETPOST("page", 'int');
if (empty($page) || $page == -1 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha') || (empty($toselect) && $massaction === '0')) { $page = 0; } // If $page is not defined, or '' or -1 or if we click on clear filters or if we select empty mass action if (empty($page) || $page < 0 || GETPOST('button_search', 'alpha') || GETPOST('button_removefilter', 'alpha') || (empty($toselect) && $massaction === '0')) { $page = 0; } // If $page is not defined, or '' or -1 or if we click on clear filters or if we select empty mass action
$offset = $limit * $page; $offset = $limit * $page;
$pageprev = $page - 1; $pageprev = $page - 1;
$pagenext = $page + 1; $pagenext = $page + 1;
@@ -86,11 +83,11 @@ if ($user->socid > 0) // Protection if external user
//$result = restrictedArea($user, 'emailcollector', $id, ''); //$result = restrictedArea($user, 'emailcollector', $id, '');
// Initialize array of search criterias // Initialize array of search criterias
$search_all = GETPOST("search_all", 'alpha'); $search_all = GETPOST("search_all", 'alphanohtml');
$search = array(); $search = array();
foreach ($object->fields as $key => $val) foreach ($object->fields as $key => $val)
{ {
if (GETPOST('search_'.$key, 'alpha')) $search[$key] = GETPOST('search_'.$key, 'alpha'); if (GETPOST('search_'.$key, 'alpha') !== '') $search[$key] = GETPOST('search_'.$key, 'alpha');
} }
// List of fields to search into when doing a "search in all" // List of fields to search into when doing a "search in all"
@@ -100,25 +97,47 @@ foreach ($object->fields as $key => $val)
if ($val['searchall']) $fieldstosearchall['t.'.$key] = $val['label']; if ($val['searchall']) $fieldstosearchall['t.'.$key] = $val['label'];
} }
// Definition of fields for list // Definition of array of fields for columns
$arrayfields = array(); $arrayfields = array();
foreach ($object->fields as $key => $val) foreach ($object->fields as $key => $val)
{ {
// If $val['visible']==0, then we never show the field // If $val['visible']==0, then we never show the field
if (!empty($val['visible'])) $arrayfields['t.'.$key] = array('label'=>$val['label'], 'checked'=>(($val['visible'] < 0) ? 0 : 1), 'enabled'=>$val['enabled'], 'position'=>$val['position']); if (!empty($val['visible'])) {
$visible = dol_eval($val['visible'], 1);
$arrayfields['t.'.$key] = array(
'label'=>$val['label'],
'checked'=>(($visible < 0) ? 0 : 1),
'enabled'=>($visible != 3 && dol_eval($val['enabled'], 1)),
'position'=>$val['position']
);
}
} }
// Extra fields // Extra fields
if (is_array($extrafields->attributes[$object->table_element]['label']) && count($extrafields->attributes[$object->table_element]['label']) > 0) if (is_array($extrafields->attributes[$object->table_element]['label']) && count($extrafields->attributes[$object->table_element]['label']) > 0)
{ {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val)
{ {
if (!empty($extrafields->attributes[$object->table_element]['list'][$key])) if (!empty($extrafields->attributes[$object->table_element]['list'][$key])) {
$arrayfields["ef.".$key] = array('label'=>$extrafields->attributes[$object->table_element]['label'][$key], 'checked'=>(($extrafields->attributes[$object->table_element]['list'][$key] < 0) ? 0 : 1), 'position'=>$extrafields->attributes[$object->table_element]['pos'][$key], 'enabled'=>(abs($extrafields->attributes[$object->table_element]['list'][$key]) != 3 && $extrafields->attributes[$object->table_element]['perms'][$key])); $arrayfields["ef.".$key] = array(
'label'=>$extrafields->attributes[$object->table_element]['label'][$key],
'checked'=>(($extrafields->attributes[$object->table_element]['list'][$key] < 0) ? 0 : 1),
'position'=>$extrafields->attributes[$object->table_element]['pos'][$key],
'enabled'=>(abs($extrafields->attributes[$object->table_element]['list'][$key]) != 3 && $extrafields->attributes[$object->table_element]['perms'][$key]),
'langfile'=>$extrafields->attributes[$object->table_element]['langfile'][$key]
);
}
} }
} }
$object->fields = dol_sort_array($object->fields, 'position'); $object->fields = dol_sort_array($object->fields, 'position');
$arrayfields = dol_sort_array($arrayfields, 'position'); $arrayfields = dol_sort_array($arrayfields, 'position');
$permissiontoread = $user->rights->emailcollector->read;
$permissiontoadd = $user->rights->emailcollector->write;
$permissiontodelete = $user->rights->emailcollector->delete;
if (!$user->admin) accessforbidden();
if (empty($conf->emailcollector->enabled)) accessforbidden('Module not enabled');
/* /*
@@ -182,13 +201,14 @@ foreach ($object->fields as $key => $val)
$sql .= 't.'.$key.', '; $sql .= 't.'.$key.', ';
} }
// Add fields from extrafields // Add fields from extrafields
if (!empty($extrafields->attributes[$object->table_element]['label'])) if (!empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key.' as options_'.$key.', ' : ''); foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key.' as options_'.$key.', ' : '');
}
// Add fields from hooks // Add fields from hooks
$parameters = array(); $parameters = array();
$reshook = $hookmanager->executeHooks('printFieldListSelect', $parameters, $object); // Note that $action and $object may have been modified by hook $reshook = $hookmanager->executeHooks('printFieldListSelect', $parameters, $object); // Note that $action and $object may have been modified by hook
$sql .= $hookmanager->resPrint; $sql .= preg_replace('/^,/', '', $hookmanager->resPrint);
$sql = preg_replace('/, $/', '', $sql); $sql = preg_replace('/,\s*$/', '', $sql);
$sql .= " FROM ".MAIN_DB_PREFIX.$object->table_element." as t"; $sql .= " FROM ".MAIN_DB_PREFIX.$object->table_element." as t";
if (is_array($extrafields->attributes[$object->table_element]['label']) && count($extrafields->attributes[$object->table_element]['label'])) $sql .= " LEFT JOIN ".MAIN_DB_PREFIX.$object->table_element."_extrafields as ef on (t.rowid = ef.fk_object)"; if (is_array($extrafields->attributes[$object->table_element]['label']) && count($extrafields->attributes[$object->table_element]['label'])) $sql .= " LEFT JOIN ".MAIN_DB_PREFIX.$object->table_element."_extrafields as ef on (t.rowid = ef.fk_object)";
if ($object->ismultientitymanaged == 1) $sql .= " WHERE t.entity IN (".getEntity($object->element).")"; if ($object->ismultientitymanaged == 1) $sql .= " WHERE t.entity IN (".getEntity($object->element).")";
@@ -197,6 +217,10 @@ foreach ($search as $key => $val)
{ {
if ($key == 'status' && $search[$key] == -1) continue; if ($key == 'status' && $search[$key] == -1) continue;
$mode_search = (($object->isInt($object->fields[$key]) || $object->isFloat($object->fields[$key])) ? 1 : 0); $mode_search = (($object->isInt($object->fields[$key]) || $object->isFloat($object->fields[$key])) ? 1 : 0);
if (strpos($object->fields[$key]['type'], 'integer:') === 0) {
if ($search[$key] == '-1') $search[$key] = '';
$mode_search = 2;
}
if ($search[$key] != '') $sql .= natural_search($key, $search[$key], (($key == 'status') ? 2 : $mode_search)); if ($search[$key] != '') $sql .= natural_search($key, $search[$key], (($key == 'status') ? 2 : $mode_search));
} }
if ($search_all) $sql .= natural_search(array_keys($fieldstosearchall), $search_all); if ($search_all) $sql .= natural_search(array_keys($fieldstosearchall), $search_all);
@@ -208,7 +232,7 @@ $reshook = $hookmanager->executeHooks('printFieldListWhere', $parameters, $objec
$sql .= $hookmanager->resPrint; $sql .= $hookmanager->resPrint;
/* If a group by is required /* If a group by is required
$sql.= " GROUP BY " $sql.= " GROUP BY ";
foreach ($object->fields as $key => $val) foreach ($object->fields as $key => $val)
{ {
$sql.='t.'.$key.', '; $sql.='t.'.$key.', ';
@@ -216,6 +240,7 @@ foreach ($object->fields as $key => $val)
// Add fields from extrafields // Add fields from extrafields
if (! empty($extrafields->attributes[$object->table_element]['label'])) { if (! empty($extrafields->attributes[$object->table_element]['label'])) {
foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) $sql.=($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key.', ' : ''); foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) $sql.=($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? "ef.".$key.', ' : '');
}
// Add where from hooks // Add where from hooks
$parameters=array(); $parameters=array();
$reshook=$hookmanager->executeHooks('printFieldListGroupBy',$parameters); // Note that $action and $object may have been modified by hook $reshook=$hookmanager->executeHooks('printFieldListGroupBy',$parameters); // Note that $action and $object may have been modified by hook
@@ -238,11 +263,11 @@ if (empty($conf->global->MAIN_DISABLE_FULL_SCANLIST))
} }
} }
// if total of record found is smaller than limit, no need to do paging and to restart another select with limits set. // if total of record found is smaller than limit, no need to do paging and to restart another select with limits set.
if (is_numeric($nbtotalofrecords) && $limit > $nbtotalofrecords) if (is_numeric($nbtotalofrecords) && ($limit > $nbtotalofrecords || empty($limit)))
{ {
$num = $nbtotalofrecords; $num = $nbtotalofrecords;
} else { } else {
$sql .= $db->plimit($limit + 1, $offset); if ($limit) $sql .= $db->plimit($limit + 1, $offset);
$resql = $db->query($sql); $resql = $db->query($sql);
if (!$resql) if (!$resql)
@@ -255,7 +280,7 @@ if (is_numeric($nbtotalofrecords) && $limit > $nbtotalofrecords)
} }
// Direct jump if only one record found // Direct jump if only one record found
if ($num == 1 && !empty($conf->global->MAIN_SEARCH_DIRECT_OPEN_IF_ONLY_ONE) && $search_all) if ($num == 1 && !empty($conf->global->MAIN_SEARCH_DIRECT_OPEN_IF_ONLY_ONE) && $search_all && !$page)
{ {
$obj = $db->fetch_object($resql); $obj = $db->fetch_object($resql);
$id = $obj->rowid; $id = $obj->rowid;
@@ -291,7 +316,8 @@ if (!empty($contextpage) && $contextpage != $_SERVER["PHP_SELF"]) $param .= '&co
if ($limit > 0 && $limit != $conf->liste_limit) $param .= '&limit='.urlencode($limit); if ($limit > 0 && $limit != $conf->liste_limit) $param .= '&limit='.urlencode($limit);
foreach ($search as $key => $val) foreach ($search as $key => $val)
{ {
$param .= '&search_'.$key.'='.urlencode($search[$key]); if (is_array($search[$key]) && count($search[$key])) foreach ($search[$key] as $skey) $param .= '&search_'.$key.'[]='.urlencode($skey);
else $param .= '&search_'.$key.'='.urlencode($search[$key]);
} }
if ($optioncss != '') $param .= '&optioncss='.urlencode($optioncss); if ($optioncss != '') $param .= '&optioncss='.urlencode($optioncss);
// Add $param from extra fields // Add $param from extra fields
@@ -302,7 +328,7 @@ $arrayofmassactions = array(
//'presend'=>$langs->trans("SendByMail"), //'presend'=>$langs->trans("SendByMail"),
//'builddoc'=>$langs->trans("PDFMerge"), //'builddoc'=>$langs->trans("PDFMerge"),
); );
if ($user->rights->emailcollector->delete) $arrayofmassactions['predelete'] = '<span class="fa fa-trash paddingrightonly"></span>'.$langs->trans("Delete"); if ($permissiontodelete) $arrayofmassactions['predelete'] = '<span class="fa fa-trash paddingrightonly"></span>'.$langs->trans("Delete");
if (GETPOST('nomassaction', 'int') || in_array($massaction, array('presend', 'predelete'))) $arrayofmassactions = array(); if (GETPOST('nomassaction', 'int') || in_array($massaction, array('presend', 'predelete'))) $arrayofmassactions = array();
$massactionbutton = $form->selectMassAction('', $arrayofmassactions); $massactionbutton = $form->selectMassAction('', $arrayofmassactions);
@@ -318,13 +344,9 @@ print '<input type="hidden" name="contextpage" value="'.$contextpage.'">';
$linkback = '<a href="'.DOL_URL_ROOT.'/admin/modules.php?restore_lastsearch_values=1">'.$langs->trans("BackToModuleList").'</a>'; $linkback = '<a href="'.DOL_URL_ROOT.'/admin/modules.php?restore_lastsearch_values=1">'.$langs->trans("BackToModuleList").'</a>';
$newcardbutton = ''; $newcardbutton = dolGetButtonTitle($langs->trans('New'), '', 'fa fa-plus-circle', 'emailcollector_card.php?action=create&backtopage='.urlencode($_SERVER['PHP_SELF']), '', $permissiontoadd);
//if ($user->rights->emailcollector->creer)
//{
$newcardbutton .= dolGetButtonTitle($langs->trans('New'), '', 'fa fa-plus-circle', 'emailcollector_card.php?action=create&backtopage='.urlencode($_SERVER['PHP_SELF']));
//}
print_barre_liste($title, $page, $_SERVER["PHP_SELF"], $param, $sortfield, $sortorder, $massactionbutton, $num, $nbtotalofrecords, 'email', 0, $newcardbutton.' '.$linkback, '', $limit); print_barre_liste($title, $page, $_SERVER["PHP_SELF"], $param, $sortfield, $sortorder, $massactionbutton, $num, $nbtotalofrecords, 'email', 0, $newcardbutton.' '.$linkback, '', $limit, 0, 0, 1);
// Add code for pre mass action (confirmation or email presend form) // Add code for pre mass action (confirmation or email presend form)
/*$topicmail=""; /*$topicmail="";
@@ -355,7 +377,7 @@ $selectedfields = $form->multiSelectArrayWithCheckbox('selectedfields', $arrayfi
$selectedfields .= (count($arrayofmassactions) ? $form->showCheckAddButtons('checkforselect', 1) : ''); $selectedfields .= (count($arrayofmassactions) ? $form->showCheckAddButtons('checkforselect', 1) : '');
print '<div class="div-table-responsive">'; // You can use div-table-responsive-no-min if you dont need reserved height for your table print '<div class="div-table-responsive">'; // You can use div-table-responsive-no-min if you dont need reserved height for your table
print '<table class="tagtable liste'.($moreforfilter ? " listwithfilterbefore" : "").'">'."\n"; print '<table class="tagtable nobottomiftotal liste'.($moreforfilter ? " listwithfilterbefore" : "").'">'."\n";
// Fields title search // Fields title search
@@ -363,11 +385,20 @@ print '<table class="tagtable liste'.($moreforfilter ? " listwithfilterbefore" :
print '<tr class="liste_titre">'; print '<tr class="liste_titre">';
foreach ($object->fields as $key => $val) foreach ($object->fields as $key => $val)
{ {
$cssforfield = ''; $cssforfield = (empty($val['css']) ? '' : $val['css']);
if (in_array($val['type'], array('date', 'datetime', 'timestamp'))) $cssforfield .= ($cssforfield ? ' ' : '').'center';
if (in_array($val['type'], array('timestamp'))) $cssforfield .= ($cssforfield ? ' ' : '').'nowrap';
if ($key == 'status') $cssforfield .= ($cssforfield ? ' ' : '').'center'; if ($key == 'status') $cssforfield .= ($cssforfield ? ' ' : '').'center';
if (!empty($arrayfields['t.'.$key]['checked'])) print '<td class="liste_titre'.($cssforfield ? ' '.$cssforfield : '').'"><input type="text" class="flat maxwidth75" name="search_'.$key.'" value="'.dol_escape_htmltag($search[$key]).'"></td>'; elseif (in_array($val['type'], array('date', 'datetime', 'timestamp'))) $cssforfield .= ($cssforfield ? ' ' : '').'center';
elseif (in_array($val['type'], array('timestamp'))) $cssforfield .= ($cssforfield ? ' ' : '').'nowrap';
elseif (in_array($val['type'], array('double(24,8)', 'double(6,3)', 'integer', 'real', 'price')) && $val['label'] != 'TechnicalID') $cssforfield .= ($cssforfield ? ' ' : '').'right';
if (!empty($arrayfields['t.'.$key]['checked']))
{
print '<td class="liste_titre'.($cssforfield ? ' '.$cssforfield : '').'">';
if (is_array($val['arrayofkeyval'])) print $form->selectarray('search_'.$key, $val['arrayofkeyval'], $search[$key], $val['notnull'], 0, 0, '', 1, 0, 0, '', 'maxwidth75');
elseif (strpos($val['type'], 'integer:') === 0) {
print $object->showInputField($val, $key, $search[$key], '', '', 'search_', 'maxwidth150', 1);
} elseif (!preg_match('/^(date|timestamp)/', $val['type'])) print '<input type="text" class="flat maxwidth75" name="search_'.$key.'" value="'.dol_escape_htmltag($search[$key]).'">';
print '</td>';
}
} }
// Extra fields // Extra fields
include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_input.tpl.php'; include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_input.tpl.php';
@@ -389,10 +420,11 @@ print '</tr>'."\n";
print '<tr class="liste_titre">'; print '<tr class="liste_titre">';
foreach ($object->fields as $key => $val) foreach ($object->fields as $key => $val)
{ {
$cssforfield = ''; $cssforfield = (empty($val['css']) ? '' : $val['css']);
if (in_array($val['type'], array('date', 'datetime', 'timestamp'))) $cssforfield .= ($cssforfield ? ' ' : '').'center';
if (in_array($val['type'], array('timestamp'))) $cssforfield .= ($cssforfield ? ' ' : '').'nowrap';
if ($key == 'status') $cssforfield .= ($cssforfield ? ' ' : '').'center'; if ($key == 'status') $cssforfield .= ($cssforfield ? ' ' : '').'center';
elseif (in_array($val['type'], array('date', 'datetime', 'timestamp'))) $cssforfield .= ($cssforfield ? ' ' : '').'center';
elseif (in_array($val['type'], array('timestamp'))) $cssforfield .= ($cssforfield ? ' ' : '').'nowrap';
elseif (in_array($val['type'], array('double(24,8)', 'double(6,3)', 'integer', 'real', 'price')) && $val['label'] != 'TechnicalID') $cssforfield .= ($cssforfield ? ' ' : '').'right';
if (!empty($arrayfields['t.'.$key]['checked'])) if (!empty($arrayfields['t.'.$key]['checked']))
{ {
print getTitleFieldOfList($arrayfields['t.'.$key]['label'], 0, $_SERVER['PHP_SELF'], 't.'.$key, '', $param, ($cssforfield ? 'class="'.$cssforfield.'"' : ''), $sortfield, $sortorder, ($cssforfield ? $cssforfield.' ' : ''))."\n"; print getTitleFieldOfList($arrayfields['t.'.$key]['label'], 0, $_SERVER['PHP_SELF'], 't.'.$key, '', $param, ($cssforfield ? 'class="'.$cssforfield.'"' : ''), $sortfield, $sortorder, ($cssforfield ? $cssforfield.' ' : ''))."\n";
@@ -404,6 +436,7 @@ include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_title.tpl.php';
$parameters = array('arrayfields'=>$arrayfields, 'param'=>$param, 'sortfield'=>$sortfield, 'sortorder'=>$sortorder); $parameters = array('arrayfields'=>$arrayfields, 'param'=>$param, 'sortfield'=>$sortfield, 'sortorder'=>$sortorder);
$reshook = $hookmanager->executeHooks('printFieldListTitle', $parameters, $object); // Note that $action and $object may have been modified by hook $reshook = $hookmanager->executeHooks('printFieldListTitle', $parameters, $object); // Note that $action and $object may have been modified by hook
print $hookmanager->resPrint; print $hookmanager->resPrint;
// Action column
print getTitleFieldOfList($selectedfields, 0, $_SERVER["PHP_SELF"], '', '', '', '', $sortfield, $sortorder, 'center maxwidthsearch ')."\n"; print getTitleFieldOfList($selectedfields, 0, $_SERVER["PHP_SELF"], '', '', '', '', $sortfield, $sortorder, 'center maxwidthsearch ')."\n";
print '</tr>'."\n"; print '</tr>'."\n";
@@ -423,52 +456,46 @@ if (is_array($extrafields->attributes[$object->table_element]['computed']) && co
// -------------------------------------------------------------------- // --------------------------------------------------------------------
$i = 0; $i = 0;
$totalarray = array(); $totalarray = array();
while ($i < min($num, $limit)) while ($i < ($limit ? min($num, $limit) : $num))
{ {
$obj = $db->fetch_object($resql); $obj = $db->fetch_object($resql);
if (empty($obj)) break; // Should not happen if (empty($obj)) break; // Should not happen
// Store properties in $object // Store properties in $object
$object->id = $obj->rowid; $object->setVarsFromFetchObj($obj);
foreach ($object->fields as $key => $val)
{
if (property_exists($obj, $key)) $object->$key = $obj->$key;
}
// Show here line of result // Show here line of result
print '<tr class="oddeven">'; print '<tr class="oddeven">';
foreach ($object->fields as $key => $val) foreach ($object->fields as $key => $val)
{ {
$cssforfield = ''; $cssforfield = (empty($val['css']) ? '' : $val['css']);
if (in_array($val['type'], array('date', 'datetime', 'timestamp'))) $cssforfield .= ($cssforfield ? ' ' : '').'center'; if (in_array($val['type'], array('date', 'datetime', 'timestamp'))) $cssforfield .= ($cssforfield ? ' ' : '').'center';
elseif ($key == 'status') $cssforfield .= ($cssforfield ? ' ' : '').'center'; elseif ($key == 'status') $cssforfield .= ($cssforfield ? ' ' : '').'center';
if (in_array($val['type'], array('timestamp'))) $cssforfield .= ($cssforfield ? ' ' : '').'nowrap'; if (in_array($val['type'], array('timestamp'))) $cssforfield .= ($cssforfield ? ' ' : '').'nowrap';
elseif ($key == 'ref') $cssforfield .= ($cssforfield ? ' ' : '').'nowrap'; elseif ($key == 'ref') $cssforfield .= ($cssforfield ? ' ' : '').'nowrap';
if (in_array($val['type'], array('double(24,8)', 'double(6,3)', 'integer', 'real', 'price')) && !in_array($key, array('rowid', 'status'))) $cssforfield .= ($cssforfield ? ' ' : '').'right';
//if (in_array($key, array('fk_soc', 'fk_user', 'fk_warehouse'))) $cssforfield = 'tdoverflowmax100';
if (!empty($arrayfields['t.'.$key]['checked'])) if (!empty($arrayfields['t.'.$key]['checked']))
{ {
print '<td'; print '<td'.($cssforfield ? ' class="'.$cssforfield.'"' : '').'>';
if ($cssforfield || $val['css']) print ' class="'; if ($key == 'status') print $object->getLibStatut(5);
print $cssforfield; else print $object->showOutputField($val, $key, $object->$key, '');
if ($cssforfield && $val['css']) print ' ';
print $val['css'];
if ($cssforfield || $val['css']) print '"';
print '>';
print $object->showOutputField($val, $key, $obj->$key, '');
print '</td>'; print '</td>';
if (!$i) $totalarray['nbfield']++; if (!$i) $totalarray['nbfield']++;
if (!empty($val['isameasure'])) if (!empty($val['isameasure']))
{ {
if (!$i) $totalarray['pos'][$totalarray['nbfield']] = 't.'.$key; if (!$i) $totalarray['pos'][$totalarray['nbfield']] = 't.'.$key;
$totalarray['val']['t.'.$key] += $obj->$key; $totalarray['val']['t.'.$key] += $object->$key;
} }
} }
} }
// Extra fields // Extra fields
include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_print_fields.tpl.php'; include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_print_fields.tpl.php';
// Fields from hook // Fields from hook
$parameters = array('arrayfields'=>$arrayfields, 'obj'=>$obj, 'i'=>$i, 'totalarray'=>&$totalarray); $parameters = array('arrayfields'=>$arrayfields, 'object'=>$object, 'obj'=>$obj, 'i'=>$i, 'totalarray'=>&$totalarray);
$reshook = $hookmanager->executeHooks('printFieldListValue', $parameters, $object); // Note that $action and $object may have been modified by hook $reshook = $hookmanager->executeHooks('printFieldListValue', $parameters, $object); // Note that $action and $object may have been modified by hook
print $hookmanager->resPrint; print $hookmanager->resPrint;
// Action column // Action column
@@ -476,13 +503,13 @@ while ($i < min($num, $limit))
if ($massactionbutton || $massaction) // If we are in select mode (massactionbutton defined) or if we have already selected and sent an action ($massaction) defined if ($massactionbutton || $massaction) // If we are in select mode (massactionbutton defined) or if we have already selected and sent an action ($massaction) defined
{ {
$selected = 0; $selected = 0;
if (in_array($obj->rowid, $arrayofselected)) $selected = 1; if (in_array($object->id, $arrayofselected)) $selected = 1;
print '<input id="cb'.$obj->rowid.'" class="flat checkforselect" type="checkbox" name="toselect[]" value="'.$obj->rowid.'"'.($selected ? ' checked="checked"' : '').'>'; print '<input id="cb'.$object->id.'" class="flat checkforselect" type="checkbox" name="toselect[]" value="'.$object->id.'"'.($selected ? ' checked="checked"' : '').'>';
} }
print '</td>'; print '</td>';
if (!$i) $totalarray['nbfield']++; if (!$i) $totalarray['nbfield']++;
print '</tr>'; print '</tr>'."\n";
$i++; $i++;
} }
@@ -524,8 +551,8 @@ if (in_array('builddoc', $arrayofmassactions) && ($nbtotalofrecords === '' || $n
$urlsource .= str_replace('&amp;', '&', $param); $urlsource .= str_replace('&amp;', '&', $param);
$filedir = $diroutputmassaction; $filedir = $diroutputmassaction;
$genallowed = $user->rights->emailcollector->read; $genallowed = $permissiontoread;
$delallowed = $user->rights->emailcollector->create; $delallowed = $permissiontoadd;
print $formfile->showdocuments('massfilesarea_emailcollector', '', $filedir, $urlsource, 0, $delallowed, '', 1, 1, 0, 48, 1, $param, $title, '', '', '', null, $hidegeneratedfilelistifempty); print $formfile->showdocuments('massfilesarea_emailcollector', '', $filedir, $urlsource, 0, $delallowed, '', 1, 1, 0, 48, 1, $param, $title, '', '', '', null, $hidegeneratedfilelistifempty);
} }

34
htdocs/core/lib/functions.lib.php
View File

@@ -7735,7 +7735,7 @@ function dol_getmypid()
* If param $mode is 2, can contains a list of int id separated by comma like "1,3,4" * If param $mode is 2, can contains a list of int id separated by comma like "1,3,4"
* If param $mode is 3, can contains a list of string separated by comma like "a,b,c" * If param $mode is 3, can contains a list of string separated by comma like "a,b,c"
* @param integer $mode 0=value is list of keyword strings, 1=value is a numeric test (Example ">5.5 <10"), 2=value is a list of ID separated with comma (Example '1,3,4') * @param integer $mode 0=value is list of keyword strings, 1=value is a numeric test (Example ">5.5 <10"), 2=value is a list of ID separated with comma (Example '1,3,4')
* 3=value is list of string separated with comma (Example 'text 1,text 2'), 4=value is a list of ID separated with comma (Example '1,3,4') for search into a multiselect string ('1,2') * 3=value is list of string separated with comma (Example 'text 1,text 2'), 4=value is a list of ID separated with comma (Example '2,7') to be used to search into a multiselect string '1,2,3,4'
* @param integer $nofirstand 1=Do not output the first 'AND' * @param integer $nofirstand 1=Do not output the first 'AND'
* @return string $res The statement to append to the SQL query * @return string $res The statement to append to the SQL query
*/ */
@@ -7760,22 +7760,22 @@ function natural_search($fields, $value, $mode = 0, $nofirstand = 0)
$res = ''; $res = '';
if (!is_array($fields)) $fields = array($fields); if (!is_array($fields)) $fields = array($fields);
$nboffields = count($fields);
$end2 = count($crits);
$j = 0; $j = 0;
foreach ($crits as $crit) foreach ($crits as $crit)
{ {
$i = 0; $i2 = 0; $i = 0; $i2 = 0;
$newres = ''; $newres = '';
foreach ($fields as $field) foreach ($fields as $field)
{ {
$crit = trim($crit);
if ($mode == 1) if ($mode == 1)
{ {
$operator = '='; $operator = '=';
$newcrit = preg_replace('/([<>=]+)/', '', trim($crit)); $newcrit = preg_replace('/([<>=]+)/', '', $crit);
$reg = array(); $reg = array();
preg_match('/([<>=]+)/', trim($crit), $reg); preg_match('/([<>=]+)/', $crit, $reg);
if ($reg[1]) if ($reg[1])
{ {
$operator = $reg[1]; $operator = $reg[1];
@@ -7785,7 +7785,7 @@ function natural_search($fields, $value, $mode = 0, $nofirstand = 0)
$numnewcrit = price2num($newcrit); $numnewcrit = price2num($newcrit);
if (is_numeric($numnewcrit)) if (is_numeric($numnewcrit))
{ {
$newres .= ($i2 > 0 ? ' OR ' : '').$field.' '.$operator.' '.$numnewcrit; $newres .= ($i2 > 0 ? ' OR ' : '').$field.' '.$operator.' '.$db->sanitize($numnewcrit); // should be a numeric
} else { } else {
$newres .= ($i2 > 0 ? ' OR ' : '').'1 = 2'; // force false $newres .= ($i2 > 0 ? ' OR ' : '').'1 = 2'; // force false
} }
@@ -7793,41 +7793,45 @@ function natural_search($fields, $value, $mode = 0, $nofirstand = 0)
} }
} elseif ($mode == 2 || $mode == -2) } elseif ($mode == 2 || $mode == -2)
{ {
$newres .= ($i2 > 0 ? ' OR ' : '').$field." ".($mode == -2 ? 'NOT ' : '')."IN (".$db->escape(trim($crit)).")"; $crit = preg_replace('/[^0-9,]/', '', $crit); // ID are always integer
$newres .= ($i2 > 0 ? ' OR ' : '').$field." ".($mode == -2 ? 'NOT ' : '');
$newres .= $crit ? "IN (".$db->sanitize($db->escape($crit)).")" : "IN (0)";
if ($mode == -2) $newres .= ' OR '.$field.' IS NULL'; if ($mode == -2) $newres .= ' OR '.$field.' IS NULL';
$i2++; // a criteria was added to string $i2++; // a criteria was added to string
} elseif ($mode == 3 || $mode == -3) } elseif ($mode == 3 || $mode == -3)
{ {
$tmparray = explode(',', trim($crit)); $tmparray = explode(',', $crit);
if (count($tmparray)) if (count($tmparray))
{ {
$listofcodes = ''; $listofcodes = '';
foreach ($tmparray as $val) foreach ($tmparray as $val)
{ {
$val = trim($val);
if ($val) if ($val)
{ {
$listofcodes .= ($listofcodes ? ',' : ''); $listofcodes .= ($listofcodes ? ',' : '');
$listofcodes .= "'".$db->escape(trim($val))."'"; $listofcodes .= "'".$db->escape($val)."'";
} }
} }
$newres .= ($i2 > 0 ? ' OR ' : '').$field." ".($mode == -3 ? 'NOT ' : '')."IN (".$listofcodes.")"; $newres .= ($i2 > 0 ? ' OR ' : '').$field." ".($mode == -3 ? 'NOT ' : '')."IN (".$db->sanitize($listofcodes).")";
$i2++; // a criteria was added to string $i2++; // a criteria was added to string
} }
if ($mode == -3) $newres .= ' OR '.$field.' IS NULL'; if ($mode == -3) $newres .= ' OR '.$field.' IS NULL';
} elseif ($mode == 4) } elseif ($mode == 4)
{ {
$tmparray = explode(',', trim($crit)); $tmparray = explode(',', $crit);
if (count($tmparray)) if (count($tmparray))
{ {
$listofcodes = ''; $listofcodes = '';
foreach ($tmparray as $val) foreach ($tmparray as $val)
{ {
$val = trim($val);
if ($val) if ($val)
{ {
$newres .= ($i2 > 0 ? ' OR (' : '(').$field.' LIKE \''.$db->escape(trim($val)).',%\''; $newres .= ($i2 > 0 ? ' OR (' : '(').$field.' LIKE \''.$db->escape($val).',%\'';
$newres .= ' OR '.$field.' = \''.$db->escape(trim($val)).'\''; $newres .= ' OR '.$field.' = \''.$db->escape($val).'\'';
$newres .= ' OR '.$field.' LIKE \'%,'.$db->escape(trim($val)).'\''; $newres .= ' OR '.$field.' LIKE \'%,'.$db->escape($val).'\'';
$newres .= ' OR '.$field.' LIKE \'%,'.$db->escape(trim($val)).',%\''; $newres .= ' OR '.$field.' LIKE \'%,'.$db->escape($val).',%\'';
$newres .= ')'; $newres .= ')';
$i2++; $i2++;
} }

10
htdocs/fourn/facture/list.php
View File

@@ -166,11 +166,11 @@ $arrayfields = array(
'country.code_iso'=>array('label'=>$langs->trans("Country"), 'checked'=>0), 'country.code_iso'=>array('label'=>$langs->trans("Country"), 'checked'=>0),
'typent.code'=>array('label'=>$langs->trans("ThirdPartyType"), 'checked'=>$checkedtypetiers), 'typent.code'=>array('label'=>$langs->trans("ThirdPartyType"), 'checked'=>$checkedtypetiers),
'f.fk_mode_reglement'=>array('label'=>$langs->trans("PaymentMode"), 'checked'=>1), 'f.fk_mode_reglement'=>array('label'=>$langs->trans("PaymentMode"), 'checked'=>1),
'f.total_ht'=>array('label'=>$langs->trans("AmountHT"), 'checked'=>1), 'f.total_ht'=>array('label'=>$langs->trans("AmountHT"), 'checked'=>1, 'position'=>105),
'f.total_vat'=>array('label'=>$langs->trans("AmountVAT"), 'checked'=>0), 'f.total_vat'=>array('label'=>$langs->trans("AmountVAT"), 'checked'=>0, 'position'=>110),
'f.total_localtax1'=>array('label'=>$langs->transcountry("AmountLT1", $mysoc->country_code), 'checked'=>0, 'enabled'=>$mysoc->localtax1_assuj == "1"), 'f.total_localtax1'=>array('label'=>$langs->transcountry("AmountLT1", $mysoc->country_code), 'checked'=>0, 'enabled'=>$mysoc->localtax1_assuj == "1", 'position'=>95),
'f.total_localtax2'=>array('label'=>$langs->transcountry("AmountLT2", $mysoc->country_code), 'checked'=>0, 'enabled'=>$mysoc->localtax2_assuj == "1"), 'f.total_localtax2'=>array('label'=>$langs->transcountry("AmountLT2", $mysoc->country_code), 'checked'=>0, 'enabled'=>$mysoc->localtax2_assuj == "1", 'position'=>100),
'f.total_ttc'=>array('label'=>$langs->trans("AmountTTC"), 'checked'=>0), 'f.total_ttc'=>array('label'=>$langs->trans("AmountTTC"), 'checked'=>0, 'position'=>115),
'u.login'=>array('label'=>"Author", 'checked'=>1), 'u.login'=>array('label'=>"Author", 'checked'=>1),
'dynamount_payed'=>array('label'=>$langs->trans("Payed"), 'checked'=>0), 'dynamount_payed'=>array('label'=>$langs->trans("Payed"), 'checked'=>0),
'rtp'=>array('label'=>$langs->trans("Rest"), 'checked'=>0), 'rtp'=>array('label'=>$langs->trans("Rest"), 'checked'=>0),

17
htdocs/societe/class/societe.class.php
View File

@@ -777,7 +777,7 @@ class Societe extends CommonObject
* $this->code_client = -1 and $this->code_fournisseur = -1 means automatic assignement. * $this->code_client = -1 and $this->code_fournisseur = -1 means automatic assignement.
* *
* @param User $user Object of user that ask creation * @param User $user Object of user that ask creation
* @return int >= 0 if OK, < 0 if KO * @return int >=0 if OK, <0 if KO
*/ */
public function create(User $user) public function create(User $user)
{ {
@@ -969,7 +969,10 @@ class Societe extends CommonObject
} elseif ($rescode == -4) } elseif ($rescode == -4)
{ {
$this->errors[] = 'ErrorPrefixRequired'; $this->errors[] = 'ErrorPrefixRequired';
} else {
$this->errors[] = 'ErrorUnknownOnCustomerCodeCheck';
} }
$result = -3; $result = -3;
} }
} }
@@ -988,9 +991,11 @@ class Societe extends CommonObject
} elseif ($rescode == -3) } elseif ($rescode == -3)
{ {
$this->errors[] = 'ErrorSupplierCodeAlreadyUsed'; $this->errors[] = 'ErrorSupplierCodeAlreadyUsed';
} elseif ($rescode == -5) } elseif ($rescode == -4)
{ {
$this->errors[] = 'ErrorPrefixRequired'; $this->errors[] = 'ErrorPrefixRequired';
} else {
$this->errors[] = 'ErrorUnknownOnSupplierCodeCheck';
} }
$result = -3; $result = -3;
} }
@@ -2989,6 +2994,10 @@ class Societe extends CommonObject
dol_syslog(get_class($this)."::check_codeclient code_client=".$this->code_client." module=".$module); dol_syslog(get_class($this)."::check_codeclient code_client=".$this->code_client." module=".$module);
$result = $mod->verif($this->db, $this->code_client, $this, 0); $result = $mod->verif($this->db, $this->code_client, $this, 0);
if ($result) { // If error
$this->error = $mod->error;
$this->errors = $mod->errors;
}
return $result; return $result;
} else { } else {
return 0; return 0;
@@ -3024,6 +3033,10 @@ class Societe extends CommonObject
dol_syslog(get_class($this)."::check_codefournisseur code_fournisseur=".$this->code_fournisseur." module=".$module); dol_syslog(get_class($this)."::check_codefournisseur code_fournisseur=".$this->code_fournisseur." module=".$module);
$result = $mod->verif($this->db, $this->code_fournisseur, $this, 1); $result = $mod->verif($this->db, $this->code_fournisseur, $this, 1);
if ($result) { // If error
$this->error = $mod->error;
$this->errors = $mod->errors;
}
return $result; return $result;
} else { } else {
return 0; return 0;