Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2026-01-28 19:53:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Suppression des addslashes. En effet, les donnes ne doivent jamais contenir une valeur "transforme" de leur valeur mais c'est uniquement dans l'ordre insert que le addslashes doit etre ajout. Ceci ces donnes peuvent etre manipules par d'autres portions de code que le insert qui elle requiert la donne d'origine.

Browse Source
This commit is contained in:
Laurent Destailleur
2006-06-07 21:03:19 +00:00
parent 50dca584c4
commit d04e921c60
3 changed files with 44 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
htdocs/commande/commande.class.php
View File

@@ -496,28 +496,28 @@ class Commande
}
}
/**
* Ajoute une ligne de commande
*
*/
/**
* Ajoute une ligne de commande
*
*/
function addline($desc, $product_desc, $pu, $qty, $txtva, $fk_product=0, $remise_percent=0)
{
global $conf;
// Nettoyage parametres
$qty = ereg_replace(',','.',$qty);
$pu = ereg_replace(',','.',$pu);
$qty = price2num($qty);
$pu = price2num($pu);
$desc=trim($desc);
$product_desc=trim($product_desc);
if (strlen(trim($qty))==0)
{
$qty=1;
}
// Verifs
if (! $this->brouillon) return -1;
$this->db->begin();
if ($fk_product > 0)
{
$prod = new Product($this->db, $fk_product);
@@ -526,45 +526,35 @@ class Commande
$desc = $desc?$desc:$prod->libelle;
$product_desc = $prod->description;
$client = new Societe($this->db);
$client->fetch($this->soc_id);
$client->fetch($this->soc_id);
if($client->tva_assuj == "0")
$txtva ="0";
$txtva ="0";
else
$txtva=$prod->tva_tx;
$txtva=$prod->tva_tx;
// multiprix
if($conf->global->PRODUIT_MULTIPRICES == 1)
{
$pu = $prod->multiprices[$client->price_level];
$pu = $prod->multiprices[$client->price_level];
}
else
$pu = $prod->price;
$pu = $prod->price;
}
}
$remise = 0;
$price = round(ereg_replace(',','.',$pu), 2);
$price = round(price2num($pu), 2);
$subprice = $price;
// appliquait la remise 2 fois : sur la ligne et le HT
/*
if (trim(strlen($remise_percent)) > 0)
{
$remise = round(($pu * $remise_percent / 100), 2);
$price = $pu - $remise;
}
*/
$sql = 'INSERT INTO '.MAIN_DB_PREFIX.'commandedet (fk_commande,label,description,fk_product, price,qty,tva_tx, remise_percent, subprice, remise)';
if ($conf->global->PRODUIT_CHANGE_PROD_DESC)
{
$sql .= " VALUES ($this->id, '" . addslashes($desc) . "','" . addslashes($product_desc) . "',$fk_product,".price2num($price).", '$qty', $txtva, $remise_percent,'".price2num($subprice)."','".price2num( $remise)."') ;";
}
else
{
$sql .= " VALUES ($this->id, '" . addslashes($desc) . "','" . addslashes($desc) . "',$fk_product,".price2num($price).", '$qty', $txtva, $remise_percent,'".price2num($subprice)."','".price2num( $remise)."') ;";
}
{
$sql .= " VALUES ($this->id, '" . addslashes($desc) . "','" . addslashes($product_desc) . "',$fk_product,".price2num($price).", '$qty', $txtva, $remise_percent,'".price2num($subprice)."','".price2num( $remise)."') ;";
}
else
{
$sql .= " VALUES ($this->id, '" . addslashes($desc) . "','" . addslashes($desc) . "',$fk_product,".price2num($price).", '$qty', $txtva, $remise_percent,'".price2num($subprice)."','".price2num( $remise)."') ;";
}
if ( $this->db->query( $sql) )
{
$this->update_price();