Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-12-14 13:31:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add more robust php unit to detect not escaped sql. Fix not escaped sql

Browse Source
This commit is contained in:
Laurent Destailleur
2017-09-15 15:41:07 +02:00
parent 77056d9adb
commit 5e34b121dd
63 changed files with 420 additions and 438 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
htdocs/product/class/product.class.php
View File

@@ -536,12 +536,12 @@ class Product extends CommonObject
$sql.= ", ".$this->type;
$sql.= ", ".price2num($price_ht);
$sql.= ", ".price2num($price_ttc);
$sql.= ", '".$this->price_base_type."'";
$sql.= ", '".$this->db->escape($this->price_base_type)."'";
$sql.= ", ".$this->status;
$sql.= ", ".$this->status_buy;
$sql.= ", '".$this->accountancy_code_buy."'";
$sql.= ", '".$this->accountancy_code_sell."'";
$sql.= ", '".$this->canvas."'";
$sql.= ", '".$this->db->escape($this->accountancy_code_buy)."'";
$sql.= ", '".$this->db->escape($this->accountancy_code_sell)."'";
$sql.= ", '".$this->db->escape($this->canvas)."'";
$sql.= ", ".((! isset($this->finished) || $this->finished < 0 || $this->finished == '') ? 'null' : (int) $this->finished);
$sql.= ", ".((empty($this->status_batch) || $this->status_batch < 0)? '0':$this->status_batch);
$sql.= ", ".(!$this->fk_unit ? 'NULL' : $this->fk_unit);
@@ -853,8 +853,8 @@ class Product extends CommonObject
$sql.= ", recuperableonly = " . $this->tva_npr;
$sql.= ", localtax1_tx = " . $this->localtax1_tx;
$sql.= ", localtax2_tx = " . $this->localtax2_tx;
$sql.= ", localtax1_type = " . ($this->localtax1_type!=''?"'".$this->localtax1_type."'":"'0'");
$sql.= ", localtax2_type = " . ($this->localtax2_type!=''?"'".$this->localtax2_type."'":"'0'");
$sql.= ", localtax1_type = " . ($this->localtax1_type!=''?"'".$this->db->escape($this->localtax1_type)."'":"'0'");
$sql.= ", localtax2_type = " . ($this->localtax2_type!=''?"'".$this->db->escape($this->localtax2_type)."'":"'0'");
$sql.= ", barcode = ". (empty($this->barcode)?"null":"'".$this->db->escape($this->barcode)."'");
$sql.= ", fk_barcode_type = ". (empty($this->barcode_type)?"null":$this->db->escape($this->barcode_type));
@@ -863,19 +863,19 @@ class Product extends CommonObject
$sql.= ", tobuy = " . $this->status_buy;
$sql.= ", tobatch = " . ((empty($this->status_batch) || $this->status_batch < 0) ? '0' : $this->status_batch);
$sql.= ", finished = " . ((! isset($this->finished) || $this->finished < 0) ? "null" : (int) $this->finished);
$sql.= ", weight = " . ($this->weight!='' ? "'".$this->weight."'" : 'null');
$sql.= ", weight_units = " . ($this->weight_units!='' ? "'".$this->weight_units."'": 'null');
$sql.= ", length = " . ($this->length!='' ? "'".$this->length."'" : 'null');
$sql.= ", length_units = " . ($this->length_units!='' ? "'".$this->length_units."'" : 'null');
$sql.= ", width= " . ($this->width!='' ? "'".$this->width."'" : 'null');
$sql.= ", width_units = " . ($this->width_units!='' ? "'".$this->width_units."'" : 'null');
$sql.= ", height = " . ($this->height!='' ? "'".$this->height."'" : 'null');
$sql.= ", height_units = " . ($this->height_units!='' ? "'".$this->height_units."'" : 'null');
$sql.= ", surface = " . ($this->surface!='' ? "'".$this->surface."'" : 'null');
$sql.= ", surface_units = " . ($this->surface_units!='' ? "'".$this->surface_units."'" : 'null');
$sql.= ", volume = " . ($this->volume!='' ? "'".$this->volume."'" : 'null');
$sql.= ", volume_units = " . ($this->volume_units!='' ? "'".$this->volume_units."'" : 'null');
$sql.= ", seuil_stock_alerte = " . ((isset($this->seuil_stock_alerte) && $this->seuil_stock_alerte != '') ? "'".$this->seuil_stock_alerte."'" : "null");
$sql.= ", weight = " . ($this->weight!='' ? "'".$this->db->escape($this->weight)."'" : 'null');
$sql.= ", weight_units = " . ($this->weight_units!='' ? "'".$this->db->escape($this->weight_units)."'": 'null');
$sql.= ", length = " . ($this->length!='' ? "'".$this->db->escape($this->length)."'" : 'null');
$sql.= ", length_units = " . ($this->length_units!='' ? "'".$this->db->escape($this->length_units)."'" : 'null');
$sql.= ", width= " . ($this->width!='' ? "'".$this->db->escape($this->width)."'" : 'null');
$sql.= ", width_units = " . ($this->width_units!='' ? "'".$this->db->escape($this->width_units)."'" : 'null');
$sql.= ", height = " . ($this->height!='' ? "'".$this->db->escape($this->height)."'" : 'null');
$sql.= ", height_units = " . ($this->height_units!='' ? "'".$this->db->escape($this->height_units)."'" : 'null');
$sql.= ", surface = " . ($this->surface!='' ? "'".$this->db->escape($this->surface)."'" : 'null');
$sql.= ", surface_units = " . ($this->surface_units!='' ? "'".$this->db->escape($this->surface_units)."'" : 'null');
$sql.= ", volume = " . ($this->volume!='' ? "'".$this->db->escape($this->volume)."'" : 'null');
$sql.= ", volume_units = " . ($this->volume_units!='' ? "'".$this->db->escape($this->volume_units)."'" : 'null');
$sql.= ", seuil_stock_alerte = " . ((isset($this->seuil_stock_alerte) && $this->seuil_stock_alerte != '') ? "'".$this->db->escape($this->seuil_stock_alerte)."'" : "null");
$sql.= ", description = '" . $this->db->escape($this->description) ."'";
$sql.= ", url = " . ($this->url?"'".$this->db->escape($this->url)."'":'null');
$sql.= ", customcode = '" . $this->db->escape($this->customcode) ."'";
@@ -1439,8 +1439,8 @@ class Product extends CommonObject
// Add new price
$sql = "INSERT INTO ".MAIN_DB_PREFIX."product_price(price_level,date_price, fk_product, fk_user_author, price, price_ttc, price_base_type,tosell, tva_tx, default_vat_code, recuperableonly,";
$sql.= " localtax1_tx, localtax2_tx, localtax1_type, localtax2_type, price_min,price_min_ttc,price_by_qty,entity,fk_price_expression) ";
$sql.= " VALUES(".($level?$level:1).", '".$this->db->idate($now)."',".$this->id.",".$user->id.",".$this->price.",".$this->price_ttc.",'".$this->price_base_type."',".$this->status.",".$this->tva_tx.", ".($this->default_vat_code?("'".$this->default_vat_code."'"):"null").",".$this->tva_npr.",";
$sql.= " ".$this->localtax1_tx.", ".$this->localtax2_tx.", '".$this->localtax1_type."', '".$this->localtax2_type."', ".$this->price_min.",".$this->price_min_ttc.",".$this->price_by_qty.",".$conf->entity.",".($this->fk_price_expression > 0?$this->fk_price_expression:'null');
$sql.= " VALUES(".($level?$level:1).", '".$this->db->idate($now)."',".$this->id.",".$user->id.",".$this->price.",".$this->price_ttc.",'".$this->db->escape($this->price_base_type)."',".$this->status.",".$this->tva_tx.", ".($this->default_vat_code?("'".$this->db->escape($this->default_vat_code)."'"):"null").",".$this->tva_npr.",";
$sql.= " ".$this->localtax1_tx.", ".$this->localtax2_tx.", '".$this->db->escape($this->localtax1_type)."', '".$this->db->escape($this->localtax2_type)."', ".$this->price_min.",".$this->price_min_ttc.",".$this->price_by_qty.",".$conf->entity.",".($this->fk_price_expression > 0?$this->fk_price_expression:'null');
$sql.= ")";
dol_syslog(get_class($this)."::_log_price", LOG_DEBUG);

22
htdocs/product/class/productcustomerprice.class.php
View File

@@ -161,19 +161,19 @@ class Productcustomerprice extends CommonObject
$sql .= ") VALUES (";
$sql .= " " . $conf->entity . ",";
$sql .= " '" . $this->db->idate(dol_now()) . "',";
$sql .= " " . (! isset($this->fk_product) ? 'NULL' : "'" . $this->fk_product . "'") . ",";
$sql .= " " . (! isset($this->fk_soc) ? 'NULL' : "'" . $this->fk_soc . "'") . ",";
$sql .= " " . (empty($this->price) ? '0' : "'" . $this->price . "'") . ",";
$sql .= " " . (empty($this->price_ttc) ? '0' : "'" . $this->price_ttc . "'") . ",";
$sql .= " " . (empty($this->price_min) ? '0' : "'" . $this->price_min . "'") . ",";
$sql .= " " . (empty($this->price_min_ttc) ? '0' : "'" . $this->price_min_ttc . "'") . ",";
$sql .= " " . (! isset($this->fk_product) ? 'NULL' : "'" . $this->db->escape($this->fk_product) . "'") . ",";
$sql .= " " . (! isset($this->fk_soc) ? 'NULL' : "'" . $this->db->escape($this->fk_soc) . "'") . ",";
$sql .= " " . (empty($this->price) ? '0' : "'" . $this->db->escape($this->price) . "'") . ",";
$sql .= " " . (empty($this->price_ttc) ? '0' : "'" . $this->db->escape($this->price_ttc) . "'") . ",";
$sql .= " " . (empty($this->price_min) ? '0' : "'" . $this->db->escape($this->price_min) . "'") . ",";
$sql .= " " . (empty($this->price_min_ttc) ? '0' : "'" . $this->db->escape($this->price_min_ttc) . "'") . ",";
$sql .= " " . (! isset($this->price_base_type) ? 'NULL' : "'" . $this->db->escape($this->price_base_type) . "'") . ",";
$sql .= " ".($this->default_vat_code ? "'".$this->db->escape($this->default_vat_code)."'" : "null").",";
$sql .= " " . (! isset($this->tva_tx) ? 'NULL' : (empty($this->tva_tx)?0:$this->tva_tx)) . ",";
$sql .= " " . (! isset($this->recuperableonly) ? 'NULL' : "'" . $this->recuperableonly . "'") . ",";
$sql .= " " . (empty($this->localtax1_type) ? "'0'" : "'" . $this->localtax1_type . "'") . ",";
$sql .= " " . (! isset($this->recuperableonly) ? 'NULL' : "'" . $this->db->escape($this->recuperableonly) . "'") . ",";
$sql .= " " . (empty($this->localtax1_type) ? "'0'" : "'" . $this->db->escape($this->localtax1_type) . "'") . ",";
$sql .= " " . (! isset($this->localtax1_tx) ? 'NULL' : (empty($this->localtax1_tx)?0:$this->localtax1_tx)) . ",";
$sql .= " " . (empty($this->localtax2_type) ? "'0'" : "'" . $this->localtax2_type . "'") . ",";
$sql .= " " . (empty($this->localtax2_type) ? "'0'" : "'" . $this->db->escape($this->localtax2_type) . "'") . ",";
$sql .= " " . (! isset($this->localtax2_tx) ? 'NULL' : (empty($this->localtax2_tx)?0:$this->localtax2_tx)) . ",";
$sql .= " " . $user->id . ",";
$sql .= " " . (! isset($this->import_key) ? 'NULL' : "'" . $this->db->escape($this->import_key) . "'") . "";
@@ -660,8 +660,8 @@ class Productcustomerprice extends CommonObject
$sql .= " recuperableonly=" . (isset($this->recuperableonly) ? $this->recuperableonly : "null") . ",";
$sql .= " localtax1_tx=" . (isset($this->localtax1_tx) ? (empty($this->localtax1_tx)?0:$this->localtax1_tx) : "null") . ",";
$sql .= " localtax2_tx=" . (isset($this->localtax2_tx) ? (empty($this->localtax2_tx)?0:$this->localtax2_tx) : "null") . ",";
$sql .= " localtax1_type=" . (! empty($this->localtax1_type) ? "'".$this->localtax1_type."'": "'0'") . ",";
$sql .= " localtax2_type=" . (! empty($this->localtax2_type) ? "'".$this->localtax2_type."'": "'0'") . ",";
$sql .= " localtax1_type=" . (! empty($this->localtax1_type) ? "'".$this->db->escape($this->localtax1_type)."'": "'0'") . ",";
$sql .= " localtax2_type=" . (! empty($this->localtax2_type) ? "'".$this->db->escape($this->localtax2_type)."'": "'0'") . ",";
$sql .= " fk_user=" . $user->id . ",";
$sql .= " import_key=" . (isset($this->import_key) ? "'" . $this->db->escape($this->import_key) . "'" : "null") . "";

108
htdocs/product/class/propalmergepdfproduct.class.php
View File

@@ -33,7 +33,7 @@ class Propalmergepdfproduct extends CommonObject
{
var $element='propal_merge_pdf_product'; //!< Id that identify managed objects
var $table_element='propal_merge_pdf_product'; //!< Name of table without prefix where object is stored
var $fk_product;
var $file_name;
var $fk_user_author;
@@ -41,10 +41,10 @@ class Propalmergepdfproduct extends CommonObject
var $datec='';
var $tms='';
var $lang;
var $lines=array();
/**
@@ -72,7 +72,7 @@ class Propalmergepdfproduct extends CommonObject
$error=0;
// Clean parameters
if (isset($this->fk_product)) $this->fk_product=trim($this->fk_product);
if (isset($this->file_name)) $this->file_name=trim($this->file_name);
if (isset($this->fk_user_author)) $this->fk_user_author=trim($this->fk_user_author);
@@ -80,14 +80,14 @@ class Propalmergepdfproduct extends CommonObject
if (isset($this->lang)) $this->lang=trim($this->lang);
if (isset($this->import_key)) $this->import_key=trim($this->import_key);
// Check parameters
// Put here code to add control on parameters values
// Insert request
$sql = "INSERT INTO ".MAIN_DB_PREFIX."propal_merge_pdf_product(";
$sql.= "fk_product,";
$sql.= "file_name,";
if ($conf->global->MAIN_MULTILANGS) {
@@ -97,10 +97,10 @@ class Propalmergepdfproduct extends CommonObject
$sql.= "fk_user_mod,";
$sql.= "datec";
$sql.= ") VALUES (";
$sql.= " ".(! isset($this->fk_product)?'NULL':"'".$this->fk_product."'").",";
$sql.= " ".(! isset($this->fk_product)?'NULL':"'".$this->db->escape($this->fk_product)."'").",";
$sql.= " ".(! isset($this->file_name)?'NULL':"'".$this->db->escape($this->file_name)."'").",";
if ($conf->global->MAIN_MULTILANGS) {
$sql.= " ".(! isset($this->lang)?'NULL':"'".$this->db->escape($this->lang)."'").",";
@@ -109,7 +109,7 @@ class Propalmergepdfproduct extends CommonObject
$sql.= " ".$user->id.",";
$sql.= " '".$this->db->idate(dol_now())."'";
$sql.= ")";
$this->db->begin();
@@ -164,10 +164,10 @@ class Propalmergepdfproduct extends CommonObject
function fetch($id)
{
global $langs,$conf;
$sql = "SELECT";
$sql.= " t.rowid,";
$sql.= " t.fk_product,";
$sql.= " t.file_name,";
$sql.= " t.lang,";
@@ -177,7 +177,7 @@ class Propalmergepdfproduct extends CommonObject
$sql.= " t.tms,";
$sql.= " t.import_key";
$sql.= " FROM ".MAIN_DB_PREFIX."propal_merge_pdf_product as t";
$sql.= " WHERE t.rowid = ".$id;
@@ -190,7 +190,7 @@ class Propalmergepdfproduct extends CommonObject
$obj = $this->db->fetch_object($resql);
$this->id = $obj->rowid;
$this->fk_product = $obj->fk_product;
$this->file_name = $obj->file_name;
if ($conf->global->MAIN_MULTILANGS) {
@@ -202,7 +202,7 @@ class Propalmergepdfproduct extends CommonObject
$this->tms = $this->db->jdate($obj->tms);
$this->import_key = $obj->import_key;
}
$this->db->free($resql);
@@ -215,7 +215,7 @@ class Propalmergepdfproduct extends CommonObject
return -1;
}
}
/**
* Load object in memory from the database
*
@@ -226,10 +226,10 @@ class Propalmergepdfproduct extends CommonObject
function fetch_by_product($product_id, $lang='')
{
global $langs,$conf;
$sql = "SELECT";
$sql.= " t.rowid,";
$sql.= " t.fk_product,";
$sql.= " t.file_name,";
$sql.= " t.lang,";
@@ -238,14 +238,14 @@ class Propalmergepdfproduct extends CommonObject
$sql.= " t.datec,";
$sql.= " t.tms,";
$sql.= " t.import_key";
$sql.= " FROM ".MAIN_DB_PREFIX."propal_merge_pdf_product as t";
$sql.= " WHERE t.fk_product = ".$product_id;
if ($conf->global->MAIN_MULTILANGS && !empty($lang)) {
$sql.= " AND t.lang = '".$lang."'";
}
dol_syslog(get_class($this)."::".__METHOD__, LOG_DEBUG);
$resql=$this->db->query($sql);
if ($resql)
@@ -253,11 +253,11 @@ class Propalmergepdfproduct extends CommonObject
if ($this->db->num_rows($resql))
{
while($obj = $this->db->fetch_object($resql)) {
$line = new PropalmergepdfproductLine();
$line->id = $obj->rowid;
$line->fk_product = $obj->fk_product;
$line->file_name = $obj->file_name;
if ($conf->global->MAIN_MULTILANGS) {
@@ -268,21 +268,21 @@ class Propalmergepdfproduct extends CommonObject
$line->datec = $this->db->jdate($obj->datec);
$line->tms = $this->db->jdate($obj->tms);
$line->import_key = $obj->import_key;
if ($conf->global->MAIN_MULTILANGS) {
$this->lines[$obj->file_name.'_'.$obj->lang]=$line;
}else {
$this->lines[$obj->file_name]=$line;
}
}
}
$this->db->free($resql);
return 1;
}
else
@@ -307,21 +307,21 @@ class Propalmergepdfproduct extends CommonObject
$error=0;
// Clean parameters
if (isset($this->fk_product)) $this->fk_product=trim($this->fk_product);
if (isset($this->file_name)) $this->file_name=trim($this->file_name);
if (isset($this->fk_user_mod)) $this->fk_user_mod=trim($this->fk_user_mod);
if (isset($this->lang)) $this->lang=trim($this->lang);
// Check parameters
// Put here code to add a control on parameters values
// Update request
$sql = "UPDATE ".MAIN_DB_PREFIX."propal_merge_pdf_product SET";
$sql.= " fk_product=".(isset($this->fk_product)?$this->fk_product:"null").",";
$sql.= " file_name=".(isset($this->file_name)?"'".$this->db->escape($this->file_name)."'":"null").",";
if ($conf->global->MAIN_MULTILANGS) {
@@ -329,7 +329,7 @@ class Propalmergepdfproduct extends CommonObject
}
$sql.= " fk_user_mod=".$user->id;
$sql.= " WHERE rowid=".$this->id;
$this->db->begin();
@@ -430,7 +430,7 @@ class Propalmergepdfproduct extends CommonObject
return 1;
}
}
/**
* Delete object in database
*
@@ -444,16 +444,16 @@ class Propalmergepdfproduct extends CommonObject
{
global $conf, $langs;
$error=0;
$this->db->begin();
if (! $error)
{
if (! $notrigger)
{
// Uncomment this and change MYOBJECT to your own tag if you
// want this action calls a trigger.
//// Call triggers
//include_once DOL_DOCUMENT_ROOT . '/core/class/interfaces.class.php';
//$interface=new Interfaces($this->db);
@@ -462,21 +462,21 @@ class Propalmergepdfproduct extends CommonObject
//// End call triggers
}
}
if (! $error)
{
$sql = "DELETE FROM ".MAIN_DB_PREFIX."propal_merge_pdf_product";
$sql.= " WHERE fk_product=".$product_id;
if ($conf->global->MAIN_MULTILANGS && !empty($lang_id)) {
$sql.= " AND lang='".$lang_id."'";
}
dol_syslog(get_class($this)."::".__METHOD__, LOG_DEBUG);
$resql = $this->db->query($sql);
if (! $resql) { $error++; $this->errors[]="Error ".$this->db->lasterror(); }
}
// Commit or rollback
if ($error)
{
@@ -494,7 +494,7 @@ class Propalmergepdfproduct extends CommonObject
return 1;
}
}
/**
* Delete object in database
*
@@ -505,16 +505,16 @@ class Propalmergepdfproduct extends CommonObject
{
global $conf, $langs;
$error=0;
$this->db->begin();
if (! $error)
{
if (! $notrigger)
{
// Uncomment this and change MYOBJECT to your own tag if you
// want this action calls a trigger.
//// Call triggers
//include_once DOL_DOCUMENT_ROOT . '/core/class/interfaces.class.php';
//$interface=new Interfaces($this->db);
@@ -523,17 +523,17 @@ class Propalmergepdfproduct extends CommonObject
//// End call triggers
}
}
if (! $error)
{
$sql = "DELETE FROM ".MAIN_DB_PREFIX."propal_merge_pdf_product";
$sql.= " WHERE fk_product=".$this->fk_product." AND file_name='".$this->db->escape($this->file_name)."'";
dol_syslog(get_class($this)."::".__METHOD__, LOG_DEBUG);
$resql = $this->db->query($sql);
if (! $resql) { $error++; $this->errors[]="Error ".$this->db->lasterror(); }
}
// Commit or rollback
if ($error)
{
@@ -617,7 +617,7 @@ class Propalmergepdfproduct extends CommonObject
function initAsSpecimen()
{
$this->id=0;
$this->fk_product='';
$this->file_name='';
$this->fk_user_author='';
@@ -626,7 +626,7 @@ class Propalmergepdfproduct extends CommonObject
$this->tms='';
$this->import_key='';
}
}
@@ -637,7 +637,7 @@ class Propalmergepdfproduct extends CommonObject
class PropalmergepdfproductLine
{
var $id;
var $fk_product;
var $file_name;
var $lang;