Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2026-02-08 00:52:01 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix cast into variable into sql request.

Browse Source
This commit is contained in:
Laurent Destailleur
2021-08-23 17:41:11 +02:00
parent edb239837c
commit d4b5ee6c85
130 changed files with 396 additions and 379 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
htdocs/commande/class/commande.class.php
View File

@@ -2688,7 +2688,7 @@ class Commande extends CommonOrder
$sql .= " WHERE c.entity IN (".getEntity('commande').")";
$sql .= " AND c.fk_soc = s.rowid";
if (!$user->rights->societe->client->voir && !$socid) { //restriction
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id;
$sql .= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
}
if ($socid) {
$sql .= " AND s.rowid = ".((int) $socid);
@@ -3507,14 +3507,14 @@ class Commande extends CommonOrder
$sql .= " FROM ".MAIN_DB_PREFIX."commande as c";
if (!$user->rights->societe->client->voir && !$user->socid) {
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON c.fk_soc = sc.fk_soc";
$sql .= " WHERE sc.fk_user = ".$user->id;
$sql .= " WHERE sc.fk_user = ".((int) $user->id);
$clause = " AND";
}
$sql .= $clause." c.entity IN (".getEntity('commande').")";
//$sql.= " AND c.fk_statut IN (1,2,3) AND c.facture = 0";
$sql .= " AND ((c.fk_statut IN (".self::STATUS_VALIDATED.",".self::STATUS_SHIPMENTONPROCESS.")) OR (c.fk_statut = ".self::STATUS_CLOSED." AND c.facture = 0))"; // If status is 2 and facture=1, it must be selected
if ($user->socid) {
$sql .= " AND c.fk_soc = ".$user->socid;
$sql .= " AND c.fk_soc = ".((int) $user->socid);
}
$resql = $this->db->query($sql);
@@ -3917,7 +3917,7 @@ class Commande extends CommonOrder
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe as s ON co.fk_soc = s.rowid";
if (!$user->rights->societe->client->voir && !$user->socid) {
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON s.rowid = sc.fk_soc";
$sql .= " WHERE sc.fk_user = ".$user->id;
$sql .= " WHERE sc.fk_user = ".((int) $user->id);
$clause = "AND";
}
$sql .= " ".$clause." co.entity IN (".getEntity('commande').")";