diff --git a/htdocs/contact/ajax/contact.php b/htdocs/contact/ajax/contact.php index 52d7eea5d9f..ef0b50411b4 100644 --- a/htdocs/contact/ajax/contact.php +++ b/htdocs/contact/ajax/contact.php @@ -128,7 +128,10 @@ if (!empty($action) && $action == 'fetch' && !empty($id)) { $prefix = getDolGlobalString('CONTACT_DONOTSEARCH_ANYWHERE') ? '' : '%'; // Can use index if CONTACT_DONOTSEARCH_ANYWHERE is on - $filter = "(lastname:like:'".$prefix.$searchkey."%') OR (firstname:like:'".$prefix.$searchkey."'%)"; + $filter = "(lastname:like:'".$prefix.$searchkey."%') OR (firstname:like:'".$prefix.$searchkey."%')"; + if ($showsoc) { + $filter .= " OR (s.nom:like:'".$prefix.$searchkey."%')"; + } // FIXME // If CONTACT_USE_SEARCH_TO_SELECT is set, check that nb of chars in $filter is >= to avoid DOS attack diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php index 6cda449d604..15c02064301 100644 --- a/htdocs/core/class/html.form.class.php +++ b/htdocs/core/class/html.form.class.php @@ -1411,7 +1411,7 @@ class Form * @param string $filter Optional filters criteras. WARNING: To avoid SQL injection, only few chars [.a-z0-9 =<>()] are allowed here. Example: ((s.client:IN:1,3) AND (s.status:=:1)). Do not use a filter coming from input of users. * @return int|string Return integer <0 if KO, HTML with select string if OK. */ - public function select_contact($socid, $selected = '', $htmlname = 'contactid', $showempty = 0, $exclude = '', $limitto = '', $showfunction = 0, $morecss = '', $nokeyifsocid = false, $showsoc = 0, $forcecombo = 0, $events = array(), $moreparam = '', $htmlid = '', $selected_input_value = '', $filter = '') + public function select_contact($socid, $selected = '', $htmlname = 'contactid', $showempty = 0, $exclude = '', $limitto = '', $showfunction = 0, $morecss = '', $nokeyifsocid = true, $showsoc = 0, $forcecombo = 0, $events = array(), $moreparam = '', $htmlid = '', $selected_input_value = '', $filter = '') { // phpcs:enable diff --git a/htdocs/core/class/html.formticket.class.php b/htdocs/core/class/html.formticket.class.php index 3f12c44b269..0f547980be2 100644 --- a/htdocs/core/class/html.formticket.class.php +++ b/htdocs/core/class/html.formticket.class.php @@ -661,8 +661,8 @@ class FormTicket // If no socid, set to -1 to avoid full contacts list $selectedCompany = ($this->withfromsocid > 0) ? $this->withfromsocid : -1; print img_picto('', 'contact', 'class="paddingright"'); - // @phan-suppress-next-line PhanPluginSuspiciousParamOrder - print $form->selectcontacts($selectedCompany, $this->withfromcontactid, 'contactid', 3, '', '', 0, 'minwidth200'); + print $form->select_contact($selectedCompany, $this->withfromcontactid, 'contactid', 3, '', '', 1, 'maxwidth300 widthcentpercentminusx', true); + print ' '; $formcompany->selectTypeContact($ticketstatic, '', 'type', 'external', '', 0, 'maginleftonly'); print ''; diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 96b05a9e283..ea0a35ccc25 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -13338,8 +13338,10 @@ function dolForgeCriteriaCallback($matches) $operator = $realOperator[$operator]; } - $tmpescaped = $tmp[2]; + + //print "Case: ".$operator." ".$operand." ".$tmpescaped."\n"; + $regbis = array(); if ($operator == 'IN' || $operator == 'NOT IN') { // IN is allowed for list of ID or code only @@ -13360,7 +13362,7 @@ function dolForgeCriteriaCallback($matches) $tmpescaped = $tmpescaped2; } elseif ($operator == 'LIKE' || $operator == 'NOT LIKE') { - if (preg_match('/^\'(.*)\'$/', $tmpescaped, $regbis)) { + if (preg_match('/^\'([^\']*)\'$/', $tmpescaped, $regbis)) { $tmpescaped = $regbis[1]; } //$tmpescaped = "'".$db->escape($db->escapeforlike($regbis[1]))."'"; diff --git a/htdocs/core/tpl/contacts.tpl.php b/htdocs/core/tpl/contacts.tpl.php index d05831af439..af82ebebdd2 100644 --- a/htdocs/core/tpl/contacts.tpl.php +++ b/htdocs/core/tpl/contacts.tpl.php @@ -168,7 +168,10 @@ if ($permission) {
selectcontacts(($selectedCompany > 0 ? $selectedCompany : -1), '', 'contactid', 3, '', '', 1, 'minwidth100imp widthcentpercentminusxx maxwidth400'); + print img_object('', 'contact', 'class="pictofixedwidth"'); + //print $form->selectcontacts(($selectedCompany > 0 ? $selectedCompany : -1), '', 'contactid', 3, '', '', 1, 'minwidth100imp widthcentpercentminusxx maxwidth400'); + print $form->select_contact(($selectedCompany > 0 ? $selectedCompany : -1), '', 'contactid', 3, '', '', 1, 'minwidth100imp maxwidth400 widthcentpercentminusx', true); + $nbofcontacts = $form->num; $newcardbutton = ''; diff --git a/htdocs/exports/class/export.class.php b/htdocs/exports/class/export.class.php index aa0c267f166..c90d354bcc2 100644 --- a/htdocs/exports/class/export.class.php +++ b/htdocs/exports/class/export.class.php @@ -478,7 +478,8 @@ class Export if ($InfoFieldList[1] == 'select_company') { $szFilterField .= $form->select_company('', $NameField, '', 1, 0, 0, [], 0, 'maxwidth200'); } elseif ($InfoFieldList[1] == 'selectcontacts') { - $szFilterField .= $form->selectcontacts(0, '', $NameField, ' ', '', '', 0, 'maxwidth200'); + //$szFilterField .= $form->selectcontacts(0, '', $NameField, ' ', '', '', 0, 'maxwidth200'); + $szFilterField .= $form->select_contact(0, '', $NameField, ' ', '', '', 0, 'minwidth100imp maxwidth200', true); } elseif ($InfoFieldList[1] == 'select_dolusers') { $szFilterField .= $form->select_dolusers('', $NameField, 1, null, 0, '', '', '', 0, 0, "", 0, "", "maxwidth200"); } diff --git a/htdocs/projet/tasks/contact.php b/htdocs/projet/tasks/contact.php index 77402f0e98c..f8152f3013a 100644 --- a/htdocs/projet/tasks/contact.php +++ b/htdocs/projet/tasks/contact.php @@ -433,7 +433,8 @@ if ($id > 0 || !empty($ref)) { print ''; $contactofproject = $projectstatic->getListContactId('external'); - print $form->selectcontacts($selectedCompany, '', 'contactid', 0, '', $contactofproject, 0, '', false, 0, 0); + //print $form->selectcontacts($selectedCompany, '', 'contactid', 0, '', $contactofproject, 0, '', false, 0, 0); + print $form->select_contact($selectedCompany, '', 'contactid', 0, '', $contactofproject, 0, 'maxwidth300 widthcentpercentminusx', true); $nbofcontacts = $form->num; print ''; print ''; diff --git a/htdocs/public/ticket/view.php b/htdocs/public/ticket/view.php index 53ca6a07823..7be70ec70ee 100644 --- a/htdocs/public/ticket/view.php +++ b/htdocs/public/ticket/view.php @@ -361,7 +361,8 @@ if ($action == "view_ticket" || $action == "presend" || $action == "close" || $a print ''; print ''; print ''.$langs->trans("AddContributor").''; - print $form->selectcontacts($object->dao->fk_soc, '', 'contactid', 3, '', '', 1, 'minwidth100imp widthcentpercentminusxx maxwidth400'); + //print $form->selectcontacts($object->dao->fk_soc, '', 'contactid', 3, '', '', 1, 'minwidth100imp widthcentpercentminusxx maxwidth400'); + print $form->select_contact($object->dao->fk_soc, '', 'contactid', 3, '', '', 1, 'minwidth100imp widthcentpercentminusxx maxwidth400', true); print ''; print ''; } diff --git a/htdocs/user/card.php b/htdocs/user/card.php index 350d34f210f..cef1c610e39 100644 --- a/htdocs/user/card.php +++ b/htdocs/user/card.php @@ -2418,25 +2418,33 @@ if ($action == 'create' || $action == 'adduserldap') { if ($object->socid > 0 && !($object->contact_id > 0)) { // external user but no link to a contact print img_picto('', 'company').$form->select_company($object->socid, 'socid', '', ' ', 0, 0, null, 0, 'maxwidth300'); - print img_picto('', 'contact').$form->selectcontacts(0, 0, 'contactid', 1, '', '', 1, 'maxwidth300', false, 1); + print img_picto('', 'contact'); + //print $form->selectcontacts(0, 0, 'contactid', 1, '', '', 1, 'maxwidth300', false, 1); + print $form->select_contact(0, 0, 'contactid', 1, '', '', 1, 'minwidth100imp widthcentpercentminusxx maxwidth300', true, 1); if ($object->ldap_sid) { print ' ('.$langs->trans("DomainUser").')'; } } elseif ($object->socid > 0 && $object->contact_id > 0) { // external user with a link to a contact print img_picto('', 'company').$form->select_company($object->socid, 'socid', '', ' ', 0, 0, null, 0, 'maxwidth300'); // We keep thirdparty empty, contact is already set - print img_picto('', 'contact').$form->selectcontacts(0, $object->contact_id, 'contactid', 1, '', '', 1, 'maxwidth300', false, 1); + print img_picto('', 'contact'); + //print $form->selectcontacts(0, $object->contact_id, 'contactid', 1, '', '', 1, 'maxwidth300', false, 1); + print $form->select_contact(0, $object->contact_id, 'contactid', 1, '', '', 1, 'minwidth100imp widthcentpercentminusxx maxwidth300', true, 1); if ($object->ldap_sid) { print ' ('.$langs->trans("DomainUser").')'; } } elseif (!($object->socid > 0) && $object->contact_id > 0) { // internal user with a link to a contact print img_picto('', 'company').$form->select_company(0, 'socid', '', ' ', 0, 0, null, 0, 'maxwidth300'); // We keep thirdparty empty, contact is already set - print img_picto('', 'contact').$form->selectcontacts(0, $object->contact_id, 'contactid', 1, '', '', 1, 'maxwidth300', false, 1); + print img_picto('', 'contact'); + //print $form->selectcontacts(0, $object->contact_id, 'contactid', 1, '', '', 1, 'maxwidth300', false, 1); + print $form->select_contact(0, $object->contact_id, 'contactid', 1, '', '', 1, 'minwidth100imp widthcentpercentminusxx maxwidth300', true, 1); if ($object->ldap_sid) { print ' ('.$langs->trans("DomainUser").')'; } } else { // $object->socid is not > 0 here print img_picto('', 'company').$form->select_company(0, 'socid', '', ' ', 0, 0, null, 0, 'maxwidth300'); // We keep thirdparty empty, contact is already set - print img_picto('', 'contact').$form->selectcontacts(0, 0, 'contactid', 1, '', '', 1, 'maxwidth300', false, 1); + print img_picto('', 'contact'); + //print $form->selectcontacts(0, 0, 'contactid', 1, '', '', 1, 'maxwidth300', false, 1); + print $form->select_contact(0, 0, 'contactid', 1, '', '', 1, 'minwidth100imp widthcentpercentminusxx maxwidth300', true, 1); } } print ''; diff --git a/test/phpunit/FunctionsLibTest.php b/test/phpunit/FunctionsLibTest.php index b68ae5ab6d5..6a458699773 100644 --- a/test/phpunit/FunctionsLibTest.php +++ b/test/phpunit/FunctionsLibTest.php @@ -216,6 +216,11 @@ class FunctionsLibTest extends CommonClassTest { global $conf, $langs, $db; + // Test using like + $filter = "(lastname:like:'%aaa%') OR (firstname:like:'%bbb%')"; + $sql = forgeSQLFromUniversalSearchCriteria($filter); + $this->assertEquals(" AND ((lastname LIKE '%aaa%') OR (firstname LIKE '%bbb%'))", $sql); + // Test on NOW $filter = "(client:!=:8) AND (datefin:>=:'__NOW__')"; $sql = forgeSQLFromUniversalSearchCriteria($filter); @@ -241,7 +246,6 @@ class FunctionsLibTest extends CommonClassTest $sql = forgeSQLFromUniversalSearchCriteria($filter); $this->assertEquals(" AND ((t.fieldstring = 'aaa ttt'))", $sql); - // Check that parenthesis are NOT allowed inside the last operand. Very important. $filter = "(t.fieldint:=:(1,2))"; $sql = forgeSQLFromUniversalSearchCriteria($filter);