From 1a9e98cda9563b42f1f7e7d1faf215d165ff34bb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Doursenaud?= Date: Fri, 8 Aug 2014 19:30:21 +0200 Subject: [PATCH 01/18] Fix categories bug When using the string type, $typeid == 1 matched all strings making other conditions ineffective. --- htdocs/categories/class/categorie.class.php | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/htdocs/categories/class/categorie.class.php b/htdocs/categories/class/categorie.class.php index b7e2ed030ab..1788f2e1ac6 100644 --- a/htdocs/categories/class/categorie.class.php +++ b/htdocs/categories/class/categorie.class.php @@ -1123,11 +1123,11 @@ class Categorie $cats = array(); $table=''; $type=''; - if ($typeid == 0 || $typeid == 'product') { $typeid=0; $table='product'; $type='product'; } - else if ($typeid == 1 || $typeid == 'supplier') { $typeid=1; $table='societe'; $type='fournisseur'; } - else if ($typeid == 2 || $typeid == 'customer') { $typeid=2; $table='societe'; $type='societe'; } - else if ($typeid == 3 || $typeid == 'member') { $typeid=3; $table='member'; $type='member'; } - else if ($typeid == 4 || $typeid == 'contact') { $typeid=4; $table='socpeople'; $type='contact'; } + if ($typeid === 0 || $typeid == 'product') { $typeid=0; $table='product'; $type='product'; } + else if ($typeid === 1 || $typeid == 'supplier') { $typeid=1; $table='societe'; $type='fournisseur'; } + else if ($typeid === 2 || $typeid == 'customer') { $typeid=2; $table='societe'; $type='societe'; } + else if ($typeid === 3 || $typeid == 'member') { $typeid=3; $table='member'; $type='member'; } + else if ($typeid === 4 || $typeid == 'contact') { $typeid=4; $table='socpeople'; $type='contact'; } $sql = "SELECT ct.fk_categorie, c.label"; $sql.= " FROM ".MAIN_DB_PREFIX."categorie_".$type." as ct, ".MAIN_DB_PREFIX."categorie as c"; From 739d309a0d3e38becd20c28bf07e41078fcf49c7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Doursenaud?= Date: Thu, 14 Aug 2014 08:46:51 +0200 Subject: [PATCH 02/18] Updated category fix Categories ID can be passed as strings PSR code formatting --- htdocs/categories/class/categorie.class.php | 29 ++++++++++++++++----- 1 file changed, 23 insertions(+), 6 deletions(-) diff --git a/htdocs/categories/class/categorie.class.php b/htdocs/categories/class/categorie.class.php index 1788f2e1ac6..60b738ea8ba 100644 --- a/htdocs/categories/class/categorie.class.php +++ b/htdocs/categories/class/categorie.class.php @@ -1122,12 +1122,29 @@ class Categorie { $cats = array(); - $table=''; $type=''; - if ($typeid === 0 || $typeid == 'product') { $typeid=0; $table='product'; $type='product'; } - else if ($typeid === 1 || $typeid == 'supplier') { $typeid=1; $table='societe'; $type='fournisseur'; } - else if ($typeid === 2 || $typeid == 'customer') { $typeid=2; $table='societe'; $type='societe'; } - else if ($typeid === 3 || $typeid == 'member') { $typeid=3; $table='member'; $type='member'; } - else if ($typeid === 4 || $typeid == 'contact') { $typeid=4; $table='socpeople'; $type='contact'; } + $table = ''; + $type = ''; + if ($typeid === 0 || $typeid === '0' || $typeid == 'product') { + $typeid = 0; + $table = 'product'; + $type = 'product'; + } else if ($typeid === 1 || $typeid === '1' || $typeid == 'supplier') { + $typeid = 1; + $table = 'societe'; + $type = 'fournisseur'; + } else if ($typeid === 2 || $typeid === '2' || $typeid == 'customer') { + $typeid = 2; + $table = 'societe'; + $type = 'societe'; + } else if ($typeid === 3 || $typeid === '3' || $typeid == 'member') { + $typeid = 3; + $table = 'member'; + $type = 'member'; + } else if ($typeid === 4 || $typeid === '4' || $typeid == 'contact') { + $typeid = 4; + $table = 'socpeople'; + $type = 'contact'; + } $sql = "SELECT ct.fk_categorie, c.label"; $sql.= " FROM ".MAIN_DB_PREFIX."categorie_".$type." as ct, ".MAIN_DB_PREFIX."categorie as c"; From bff33166a59bf5e4ba20b9bdbd274a44f36b4741 Mon Sep 17 00:00:00 2001 From: Florian HENRY Date: Mon, 1 Sep 2014 11:49:44 +0200 Subject: [PATCH 03/18] Fix missing $user in create method --- htdocs/categories/fiche.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/categories/fiche.php b/htdocs/categories/fiche.php index d43c4df9a3d..58b4696c305 100644 --- a/htdocs/categories/fiche.php +++ b/htdocs/categories/fiche.php @@ -132,7 +132,7 @@ if ($action == 'add' && $user->rights->categorie->creer) // Create category in database if (! $error) { - $result = $object->create(); + $result = $object->create($user); if ($result > 0) { $action = 'confirmed'; From 67b308cb2549550777d76551800db94c4cf2b3d0 Mon Sep 17 00:00:00 2001 From: Florian HENRY Date: Tue, 2 Sep 2014 11:14:41 +0200 Subject: [PATCH 04/18] Fix: list event view lost type event filter --- ChangeLog | 1 + htdocs/comm/action/listactions.php | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 80696a3d7a6..9a40ed7e9ab 100644 --- a/ChangeLog +++ b/ChangeLog @@ -22,6 +22,7 @@ Fix: Missing include files.lib.php in some pages to use dol_delete_recursive. Fix: [ bug #1558 ] Product/service edit page title shows new Ref instead of old ref. Fix: [ bug #1553 ] Saving User displays setup removes menu. Fix: [ bug #1544 ] Can remove date from invoice +Fix: list event view lost type event filter ***** ChangeLog for 3.5.4 compared to 3.5.3 ***** Fix: Hide title of event when agenda module disabled. diff --git a/htdocs/comm/action/listactions.php b/htdocs/comm/action/listactions.php index ebe68fa3328..8b945a16670 100644 --- a/htdocs/comm/action/listactions.php +++ b/htdocs/comm/action/listactions.php @@ -211,7 +211,7 @@ if ($resql) $head = calendars_prepare_head(''); dol_fiche_head($head, 'card', $langs->trans('Events'), 0, 'list'); - print_actions_filter($form,$canedit,$status,$year,$month,$day,$showbirthday,$filtera,$filtert,$filterd,$pid,$socid,-1); + print_actions_filter($form,$canedit,$status,$year,$month,$day,$showbirthday,$filtera,$filtert,$filterd,$pid,$socid,-1,$actioncode); dol_fiche_end(); // Add link to show birthdays From 911aca399ddad5ecc9ebe7100eff5f89d31687f4 Mon Sep 17 00:00:00 2001 From: Florian HENRY Date: Tue, 2 Sep 2014 11:30:35 +0200 Subject: [PATCH 05/18] save code event --- ChangeLog | 1 + htdocs/comm/action/class/actioncomm.class.php | 1 + 2 files changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 9a40ed7e9ab..3b4def098c1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -23,6 +23,7 @@ Fix: [ bug #1558 ] Product/service edit page title shows new Ref instead of old Fix: [ bug #1553 ] Saving User displays setup removes menu. Fix: [ bug #1544 ] Can remove date from invoice Fix: list event view lost type event filter +Fix: Add code save on create event ***** ChangeLog for 3.5.4 compared to 3.5.3 ***** Fix: Hide title of event when agenda module disabled. diff --git a/htdocs/comm/action/class/actioncomm.class.php b/htdocs/comm/action/class/actioncomm.class.php index 10082062d06..b51b33e5b66 100644 --- a/htdocs/comm/action/class/actioncomm.class.php +++ b/htdocs/comm/action/class/actioncomm.class.php @@ -140,6 +140,7 @@ class ActionComm extends CommonObject if ($result > 0) { $this->type_id=$cactioncomm->id; + $this->code=$cactioncomm->code; } else if ($result == 0) { From b536c8a10c0d5267af13c8ffb3bd31aae558c1d5 Mon Sep 17 00:00:00 2001 From: Florian HENRY Date: Wed, 3 Sep 2014 10:24:41 +0200 Subject: [PATCH 06/18] Add missing image into amarok theme --- htdocs/theme/amarok/img/object_address.png | Bin 0 -> 1645 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 htdocs/theme/amarok/img/object_address.png diff --git a/htdocs/theme/amarok/img/object_address.png b/htdocs/theme/amarok/img/object_address.png new file mode 100644 index 0000000000000000000000000000000000000000..b20734da69abc6d778f525e70f27b74ff67f07b2 GIT binary patch literal 1645 zcmeAS@N?(olHy`uVBq!ia0vp^d?3uh1|;P@bT0xa$r9IylHmNblJdl&R0hYC{G?O` z&)mfH)S%SFl*+=BsWuD@%u1Od5hW46K32*3xq68pHF_1f1wh>l3^w)^1&PVosU-?Y zsp*+{wo31J?^jaDOtDo8H}y5}EpSfF$n>ZxN)4{^3rViZPPR-@vbR&PsjvbXkegbP zs8ErclUHn2VXFi-*9yo63F|80+w{G(j&jGsVin(!#{m#Ms!(3>eCWu7(z-t_H3y=FVo0#>N(I zu5K{BF8Rr&xv6<2Fuf@Vy(T#If|5dR0nlcb)S}F?)D*X({9FaFm#s2!yTuTvc~HG6 zxZPreQ?EYIG5Vm0MT%&c5HR(CnDAr^vC~<85XU69X7Cd4X;>gR0ytSq1*{xsaZf(*JU)$epxBk@4taY=a%(v#0`9*3$ z!^DZl11yCde6%&T>bM&BDRZ~@XEyAdKr3aV2vu01r zCW$#chmRlSyp*!L90qnwzY4`FVdQ&MBb@0E{els{jB1 literal 0 HcmV?d00001 From 522b5a91bc8d9b7a87bbf2269384725b29d3202a Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sat, 6 Sep 2014 00:21:09 +0200 Subject: [PATCH 07/18] Fix: Filter on direction of payment mode was not working. Conflicts: htdocs/core/class/html.form.class.php htdocs/fourn/facture/fiche.php --- htdocs/compta/facture.php | 6 +++--- htdocs/core/class/html.form.class.php | 15 ++++++++------- htdocs/fourn/facture/fiche.php | 8 ++++---- 3 files changed, 15 insertions(+), 14 deletions(-) diff --git a/htdocs/compta/facture.php b/htdocs/compta/facture.php index e0590d422fd..b17b59cf704 100644 --- a/htdocs/compta/facture.php +++ b/htdocs/compta/facture.php @@ -2352,7 +2352,7 @@ if ($action == 'create') // Payment mode print ''.$langs->trans('PaymentMode').''; - $form->select_types_paiements(isset($_POST['mode_reglement_id'])?$_POST['mode_reglement_id']:$mode_reglement_id,'mode_reglement_id'); + $form->select_types_paiements(isset($_POST['mode_reglement_id'])?$_POST['mode_reglement_id']:$mode_reglement_id, 'mode_reglement_id', 'CRDT'); print ''; // Project @@ -3356,11 +3356,11 @@ else if ($id > 0 || ! empty($ref)) print ''; if ($action == 'editmode') { - $form->form_modes_reglement($_SERVER['PHP_SELF'].'?facid='.$object->id,$object->mode_reglement_id,'mode_reglement_id'); + $form->form_modes_reglement($_SERVER['PHP_SELF'].'?facid='.$object->id, $object->mode_reglement_id, 'mode_reglement_id', 'CRDT'); } else { - $form->form_modes_reglement($_SERVER['PHP_SELF'].'?facid='.$object->id,$object->mode_reglement_id,'none'); + $form->form_modes_reglement($_SERVER['PHP_SELF'].'?facid='.$object->id, $object->mode_reglement_id, 'none', 'CRDT'); } print ''; diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php index b596ba911ae..f55eb81cdcc 100644 --- a/htdocs/core/class/html.form.class.php +++ b/htdocs/core/class/html.form.class.php @@ -2275,8 +2275,8 @@ class Form dol_syslog(get_class($this)."::select_type_paiements ".$selected.", ".$htmlname.", ".$filtertype.", ".$format,LOG_DEBUG); $filterarray=array(); - if ($filtertype == 'CRDT') $filterarray=array(0,2); - elseif ($filtertype == 'DBIT') $filterarray=array(1,2); + if ($filtertype == 'CRDT') $filterarray=array(0,2,3); + elseif ($filtertype == 'DBIT') $filterarray=array(1,2,3); elseif ($filtertype != '' && $filtertype != '-1') $filterarray=explode(',',$filtertype); $this->load_cache_types_paiements(); @@ -3000,12 +3000,13 @@ class Form /** * Affiche formulaire de selection des modes de reglement * - * @param string $page Page - * @param int $selected Id mode pre-selectionne - * @param string $htmlname Name of select html field + * @param string $page Page + * @param int $selected Id mode pre-selectionne + * @param string $htmlname Name of select html field + * @param string $filtertype To filter on field type in llx_c_paiement (array('code'=>xx,'label'=>zz)) * @return void */ - function form_modes_reglement($page, $selected='', $htmlname='mode_reglement_id') + function form_modes_reglement($page, $selected='', $htmlname='mode_reglement_id', $filtertype='') { global $langs; if ($htmlname != "none") @@ -3015,7 +3016,7 @@ class Form print ''; print ''; print ''; print ''; print '
'; - $this->select_types_paiements($selected,$htmlname); + $this->select_types_paiements($selected,$htmlname,$filtertype); print '
'; diff --git a/htdocs/fourn/facture/fiche.php b/htdocs/fourn/facture/fiche.php index 086d44254c8..1c86cfa6d7f 100644 --- a/htdocs/fourn/facture/fiche.php +++ b/htdocs/fourn/facture/fiche.php @@ -1279,12 +1279,12 @@ if ($action == 'create') // Payment term print ''.$langs->trans('PaymentConditionsShort').''; - $form->select_conditions_paiements(isset($_POST['cond_reglement_id'])?$_POST['cond_reglement_id']:$cond_reglement_id,'cond_reglement_id'); + $form->select_conditions_paiements(isset($_POST['cond_reglement_id'])?$_POST['cond_reglement_id']:$cond_reglement_id, 'cond_reglement_id'); print ''; // Payment mode print ''.$langs->trans('PaymentMode').''; - $form->select_types_paiements(isset($_POST['mode_reglement_id'])?$_POST['mode_reglement_id']:$mode_reglement_id,'mode_reglement_id'); + $form->select_types_paiements(isset($_POST['mode_reglement_id'])?$_POST['mode_reglement_id']:$mode_reglement_id, 'mode_reglement_id', 'DBIT'); print ''; // Public note @@ -1732,11 +1732,11 @@ else print ''; if ($action == 'editmode') { - $form->form_modes_reglement($_SERVER['PHP_SELF'].'?id='.$object->id,$object->mode_reglement_id,'mode_reglement_id'); + $form->form_modes_reglement($_SERVER['PHP_SELF'].'?id='.$object->id, $object->mode_reglement_id, 'mode_reglement_id', 'DBIT'); } else { - $form->form_modes_reglement($_SERVER['PHP_SELF'].'?id='.$object->id,$object->mode_reglement_id,'none'); + $form->form_modes_reglement($_SERVER['PHP_SELF'].'?id='.$object->id, $object->mode_reglement_id, 'none', 'DBIT'); } print ''; From 8dd935821455b81a9f40d806d5f1930f7ab9c2a9 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sat, 13 Sep 2014 19:04:25 +0200 Subject: [PATCH 08/18] Fix: SQL injection --- ChangeLog | 7 ++++--- htdocs/adherents/class/adherent.class.php | 2 +- htdocs/adherents/liste.php | 10 +++++----- htdocs/cashdesk/index.php | 3 ++- htdocs/comm/propal/class/propal.class.php | 2 +- htdocs/commande/info.php | 6 +++--- htdocs/commande/orderstoinvoice.php | 6 +++--- htdocs/compta/bank/bankid_fr.php | 2 +- .../prelevement/class/bonprelevement.class.php | 2 +- htdocs/compta/prelevement/liste.php | 10 +++++----- htdocs/compta/prelevement/rejets.php | 3 ++- htdocs/compta/recap-compta.php | 2 +- htdocs/contact/info.php | 10 +++++----- htdocs/contrat/class/contrat.class.php | 4 ++-- htdocs/contrat/info.php | 6 +++--- htdocs/core/class/commonobject.class.php | 2 +- .../fourn/class/fournisseur.commande.class.php | 2 +- htdocs/holiday/index.php | 6 +++--- htdocs/opensurvey/list.php | 6 +++--- htdocs/product/index.php | 12 ++++++------ htdocs/product/stats/contrat.php | 6 +++--- htdocs/product/stock/liste.php | 16 ++++++++-------- htdocs/product/stock/massstockmove.php | 6 +++--- htdocs/product/stock/replenishorders.php | 13 ++++--------- htdocs/projet/class/project.class.php | 2 +- htdocs/projet/class/task.class.php | 2 +- htdocs/projet/contact.php | 4 ++-- htdocs/projet/tasks/index.php | 6 +++--- 28 files changed, 78 insertions(+), 80 deletions(-) diff --git a/ChangeLog b/ChangeLog index 3b4def098c1..04e63ec1c8e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -21,9 +21,10 @@ Fix: When disabled, all fields to add time into task line must be disabled. Fix: Missing include files.lib.php in some pages to use dol_delete_recursive. Fix: [ bug #1558 ] Product/service edit page title shows new Ref instead of old ref. Fix: [ bug #1553 ] Saving User displays setup removes menu. -Fix: [ bug #1544 ] Can remove date from invoice -Fix: list event view lost type event filter -Fix: Add code save on create event +Fix: [ bug #1544 ] Can remove date from invoice. +Fix: list event view lost type event filter. +Fix: Add code save on create event. +Fix: SQL injection. ***** ChangeLog for 3.5.4 compared to 3.5.3 ***** Fix: Hide title of event when agenda module disabled. diff --git a/htdocs/adherents/class/adherent.class.php b/htdocs/adherents/class/adherent.class.php index f82f3005514..bf0360c11ce 100644 --- a/htdocs/adherents/class/adherent.class.php +++ b/htdocs/adherents/class/adherent.class.php @@ -1072,7 +1072,7 @@ class Adherent extends CommonObject if ($rowid) $sql.= " AND d.rowid=".$rowid; elseif ($ref || $fk_soc) { $sql.= " AND d.entity IN (".getEntity().")"; - if ($ref) $sql.= " AND d.rowid='".$ref."'"; + if ($ref) $sql.= " AND d.rowid='".$this->db->escape($ref)."'"; elseif ($fk_soc) $sql.= " AND d.fk_soc='".$fk_soc."'"; } elseif ($ref_ext) diff --git a/htdocs/adherents/liste.php b/htdocs/adherents/liste.php index 3a34403425f..1d80c82a713 100644 --- a/htdocs/adherents/liste.php +++ b/htdocs/adherents/liste.php @@ -118,24 +118,24 @@ if ($type > 0) } if (isset($_GET["statut"]) || isset($_POST["statut"])) { - $sql.=" AND d.statut in (".$statut.")"; // Peut valoir un nombre ou liste de nombre separes par virgules + $sql.=" AND d.statut in (".$db->escape($statut).")"; // Peut valoir un nombre ou liste de nombre separes par virgules } if ($search_ref) { - if (is_numeric($search_ref)) $sql.= " AND (d.rowid = ".$search_ref.")"; + if (is_numeric($search_ref)) $sql.= " AND (d.rowid = ".$db->escape($search_ref).")"; else $sql.=" AND 1 = 2"; // Always wrong } if ($search_lastname) { - $sql.= " AND (d.firstname LIKE '%".$search_lastname."%' OR d.lastname LIKE '%".$search_lastname."%')"; + $sql.= " AND (d.firstname LIKE '%".$db->escape($search_lastname)."%' OR d.lastname LIKE '%".$db->escape($search_lastname)."%')"; } if ($search_login) { - $sql.= " AND d.login LIKE '%".$search_login."%'"; + $sql.= " AND d.login LIKE '%".$db->escape($search_logi)."%'"; } if ($search_email) { - $sql.= " AND (d.email LIKE '%".$search_email."%')"; + $sql.= " AND (d.email LIKE '%".$db->escape($search_email)."%')"; } if ($filter == 'uptodate') { diff --git a/htdocs/cashdesk/index.php b/htdocs/cashdesk/index.php index fe4171de72e..25aa73211d2 100644 --- a/htdocs/cashdesk/index.php +++ b/htdocs/cashdesk/index.php @@ -39,6 +39,7 @@ if ( $_SESSION['uid'] > 0 ) } $usertxt=GETPOST('user','',1); +$err=GETPOST("err"); /* @@ -64,7 +65,7 @@ top_htmlhead('','',0,0,'',$arrayofcss);