Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-12-05 17:18:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

FIX SQL syntax error when editing extrafields

Browse Source 
Conflicts:
	htdocs/core/lib/security.lib.php
This commit is contained in:
Laurent Destailleur
2020-06-29 13:48:00 +02:00
parent 8bb11039dc
commit 5b3670f300
5 changed files with 32 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
htdocs/core/db/mysqli.class.php
View File

@@ -806,7 +806,7 @@ class DoliDBMysqli extends DoliDB
$sql .= $field_desc['type'];
if (preg_match("/^[^\s]/i", $field_desc['value']))
{
if (!in_array($field_desc['type'], array('date', 'datetime')))
if (!in_array($field_desc['type'], array('date', 'datetime')) && $field_desc['value'])
{
$sql .= "(".$field_desc['value'].")";
}
@@ -853,7 +853,7 @@ class DoliDBMysqli extends DoliDB
// phpcs:enable
$sql = "ALTER TABLE ".$table;
$sql .= " MODIFY COLUMN ".$field_name." ".$field_desc['type'];
if ($field_desc['type'] == 'double' || $field_desc['type'] == 'tinyint' || $field_desc['type'] == 'int' || $field_desc['type'] == 'varchar') {
if (in_array($field_desc['type'], array('double', 'tinyint', 'int', 'varchar')) && $field_desc['value']) {
$sql .= "(".$field_desc['value'].")";
}
if ($field_desc['null'] == 'not null' || $field_desc['null'] == 'NOT NULL')

13
htdocs/core/db/pgsql.class.php
View File

@@ -1126,11 +1126,12 @@ class DoliDBPgsql extends DoliDB
// ex. : $field_desc = array('type'=>'int','value'=>'11','null'=>'not null','extra'=> 'auto_increment');
$sql = "ALTER TABLE ".$table." ADD ".$field_name." ";
$sql .= $field_desc['type'];
if (preg_match("/^[^\s]/i", $field_desc['value']))
if (!in_array($field_desc['type'], array('int', 'date', 'datetime')))
{
$sql .= "(".$field_desc['value'].")";
}
if (preg_match("/^[^\s]/i", $field_desc['value'])) {
if (!in_array($field_desc['type'], array('int', 'date', 'datetime')) && $field_desc['value'])
{
$sql .= "(".$field_desc['value'].")";
}
}
if (preg_match("/^[^\s]/i", $field_desc['attribute']))
$sql .= " ".$field_desc['attribute'];
if (preg_match("/^[^\s]/i", $field_desc['null']))
@@ -1167,7 +1168,7 @@ class DoliDBPgsql extends DoliDB
// phpcs:enable
$sql = "ALTER TABLE ".$table;
$sql .= " MODIFY COLUMN ".$field_name." ".$field_desc['type'];
if ($field_desc['type'] == 'double' || $field_desc['type'] == 'tinyint' || $field_desc['type'] == 'int' || $field_desc['type'] == 'varchar') {
if (in_array($field_desc['type'], array('double', 'tinyint', 'int', 'varchar')) && $field_desc['value']) {
$sql .= "(".$field_desc['value'].")";
}

65
htdocs/core/lib/security.lib.php
View File

@@ -223,52 +223,39 @@ function restrictedArea($user, $features, $objectid = 0, $tableandshare = '', $f
// Check read permission from module
$readok = 1; $nbko = 0;
foreach ($featuresarray as $feature) // first we check nb of test ko
{
foreach ($featuresarray as $feature) { // first we check nb of test ko
$featureforlistofmodule = $feature;
if ($featureforlistofmodule == 'produit') $featureforlistofmodule = 'product';
if (!empty($user->socid) && !empty($conf->global->MAIN_MODULES_FOR_EXTERNAL) && !in_array($featureforlistofmodule, $listofmodules)) // If limits on modules for external users, module must be into list of modules for external users
{
if (!empty($user->socid) && !empty($conf->global->MAIN_MODULES_FOR_EXTERNAL) && !in_array($featureforlistofmodule, $listofmodules)) { // If limits on modules for external users, module must be into list of modules for external users
$readok = 0; $nbko++;
continue;
}
if ($feature == 'societe') {
if (!$user->rights->societe->lire && !$user->rights->fournisseur->lire) { $readok = 0; $nbko++; }
}
elseif ($feature == 'contact') {
} elseif ($feature == 'contact') {
if (!$user->rights->societe->contact->lire) { $readok = 0; $nbko++; }
}
elseif ($feature == 'produit|service') {
} elseif ($feature == 'produit|service') {
if (!$user->rights->produit->lire && !$user->rights->service->lire) { $readok = 0; $nbko++; }
}
elseif ($feature == 'prelevement') {
} elseif ($feature == 'prelevement') {
if (!$user->rights->prelevement->bons->lire) { $readok = 0; $nbko++; }
}
elseif ($feature == 'cheque') {
} elseif ($feature == 'cheque') {
if (!$user->rights->banque->cheque) { $readok = 0; $nbko++; }
}
elseif ($feature == 'projet') {
} elseif ($feature == 'projet') {
if (!$user->rights->projet->lire && !$user->rights->projet->all->lire) { $readok = 0; $nbko++; }
}
elseif (!empty($feature2)) // This is for permissions on 2 levels
{
} elseif (!empty($feature2)) { // This is for permissions on 2 levels
$tmpreadok = 1;
foreach ($feature2 as $subfeature)
{
foreach ($feature2 as $subfeature) {
if ($subfeature == 'user' && $user->id == $objectid) continue; // A user can always read its own card
if (!empty($subfeature) && empty($user->rights->$feature->$subfeature->lire) && empty($user->rights->$feature->$subfeature->read)) { $tmpreadok = 0; }
elseif (empty($subfeature) && empty($user->rights->$feature->lire) && empty($user->rights->$feature->read)) { $tmpreadok = 0; }
else { $tmpreadok = 1; break; } // Break is to bypass second test if the first is ok
}
if (!$tmpreadok) // We found a test on feature that is ko
{
if (!$tmpreadok) { // We found a test on feature that is ko
$readok = 0; // All tests are ko (we manage here the and, the or will be managed later using $nbko).
$nbko++;
}
}
elseif (!empty($feature) && ($feature != 'user' && $feature != 'usergroup')) // This is permissions on 1 level
{
} elseif (!empty($feature) && ($feature != 'user' && $feature != 'usergroup')) { // This is permissions on 1 level
if (empty($user->rights->$feature->lire)
&& empty($user->rights->$feature->read)
&& empty($user->rights->$feature->run)) { $readok = 0; $nbko++; }
@@ -292,29 +279,21 @@ function restrictedArea($user, $features, $objectid = 0, $tableandshare = '', $f
{
if ($feature == 'contact') {
if (!$user->rights->societe->contact->creer) { $createok = 0; $nbko++; }
}
elseif ($feature == 'produit|service') {
} elseif ($feature == 'produit|service') {
if (!$user->rights->produit->creer && !$user->rights->service->creer) { $createok = 0; $nbko++; }
}
elseif ($feature == 'prelevement') {
} elseif ($feature == 'prelevement') {
if (!$user->rights->prelevement->bons->creer) { $createok = 0; $nbko++; }
}
elseif ($feature == 'commande_fournisseur') {
} elseif ($feature == 'commande_fournisseur') {
if (!$user->rights->fournisseur->commande->creer) { $createok = 0; $nbko++; }
}
elseif ($feature == 'banque') {
} elseif ($feature == 'banque') {
if (!$user->rights->banque->modifier) { $createok = 0; $nbko++; }
}
elseif ($feature == 'cheque') {
} elseif ($feature == 'cheque') {
if (!$user->rights->banque->cheque) { $createok = 0; $nbko++; }
}
elseif ($feature == 'ecm') {
} elseif ($feature == 'ecm') {
if (!$user->rights->ecm->upload) { $createok = 0; $nbko++; }
}
elseif (!empty($feature2)) // This is for permissions on one level
{
foreach ($feature2 as $subfeature)
{
elseif (!empty($feature2)) { // This is for permissions on one level
foreach ($feature2 as $subfeature) {
if ($subfeature == 'user' && $user->id == $objectid && $user->rights->user->self->creer) continue; // User can edit its own card
if ($subfeature == 'user' && $user->id == $objectid && $user->rights->user->self->password) continue; // User can edit its own password
@@ -329,10 +308,8 @@ function restrictedArea($user, $features, $objectid = 0, $tableandshare = '', $f
break;
}
}
}
elseif (!empty($feature)) // This is for permissions on 2 levels ('creer' or 'write')
{
//print '<br>feature='.$feature.' creer='.$user->rights->$feature->creer.' write='.$user->rights->$feature->write;
} elseif (!empty($feature)) { // This is for permissions on 2 levels ('creer' or 'write')
//print '<br>feature='.$feature.' creer='.$user->rights->$feature->creer.' write='.$user->rights->$feature->write; exit;
if (empty($user->rights->$feature->creer)
&& empty($user->rights->$feature->write)
&& empty($user->rights->$feature->create)) {

2
htdocs/core/modules/modDebugBar.class.php
View File

@@ -54,7 +54,7 @@ class modDebugBar extends DolibarrModules
// Possible values for version are: 'development', 'experimental', 'dolibarr' or version
$this->version = 'dolibarr';
$this->const_name = 'MAIN_MODULE_'.strtoupper($this->name);
$this->picto = 'technic';
$this->picto = 'bug';
$this->module_parts = array('moduleforexternal' => 0);

2
htdocs/core/modules/modSyslog.class.php
View File

@@ -58,7 +58,7 @@ class modSyslog extends DolibarrModules
// Key used in llx_const table to save module status enabled/disabled (where MYMODULE is value of property name of module in uppercase)
$this->const_name = 'MAIN_MODULE_'.strtoupper($this->name);
// Name of image file used for this module.
$this->picto = 'technic';
$this->picto = 'bug';
// Data directories to create when module is enabled
$this->dirs = array();