vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Qual: Fix 'SqlInjection' notices (#39229)

Browse source 
* Fix(ci): Add exceptions for 'mouvement' (codespell)

* Qual: Fix 'SqlInjection' notices

# Qual: Fix 'SqlInjection' notices

Batch of 25 files with changes to fix 'SqlInjection' Notices
This commit is contained in:
MDW 2026-07-20 15:26:43 +02:00 committed by GitHub
parent a801fb5229
commit 1f30bd1d7d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
25 changed files with 140 additions and 136 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
htdocs/accountancy/admin/categories.php
View file

@ -238,7 +238,7 @@ if ($useNewSystem) {
$sql .= " FROM ".MAIN_DB_PREFIX."accounting_category_account as aca";
$sql .= " INNER JOIN ".MAIN_DB_PREFIX."accounting_account as aa ON aa.rowid = aca.fk_accounting_account";
$sql .= " WHERE aca.fk_accounting_category = ".((int) $id);
$sql .= " AND aa.entity = ".$conf->entity;
$sql .= " AND aa.entity = ".((int) $conf->entity);
// Search filters
if (!empty($search_account)) {

130
htdocs/accountancy/customer/list.php
View file

@ -7,7 +7,7 @@
* Copyright (C) 2016 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2021 Gauthier VERDOL <gauthier.verdol@atm-consulting.fr>
* Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -309,10 +309,10 @@ if (getDolGlobalString('MAIN_PRODUCT_PERENTITY_SHARED')) {
}
$alias_societe_perentity = !getDolGlobalString('MAIN_COMPANY_PERENTITY_SHARED') ? "s" : "spe";
$alias_product_perentity = !getDolGlobalString('MAIN_PRODUCT_PERENTITY_SHARED') ? "p" : "ppe";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa ON " . $alias_product_perentity . ".accountancy_code_sell = aa.account_number AND aa.active = 1 AND aa.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa.entity = ".$conf->entity;
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa2 ON " . $alias_product_perentity . ".accountancy_code_sell_intra = aa2.account_number AND aa2.active = 1 AND aa2.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa2.entity = ".$conf->entity;
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa3 ON " . $alias_product_perentity . ".accountancy_code_sell_export = aa3.account_number AND aa3.active = 1 AND aa3.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa3.entity = ".$conf->entity;
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa4 ON " . $alias_societe_perentity . ".accountancy_code_sell = aa4.account_number AND aa4.active = 1 AND aa4.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa4.entity = ".$conf->entity;
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa ON " . $alias_product_perentity . ".accountancy_code_sell = aa.account_number AND aa.active = 1 AND aa.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa.entity = ".((int) $conf->entity);
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa2 ON " . $alias_product_perentity . ".accountancy_code_sell_intra = aa2.account_number AND aa2.active = 1 AND aa2.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa2.entity = ".((int) $conf->entity);
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa3 ON " . $alias_product_perentity . ".accountancy_code_sell_export = aa3.account_number AND aa3.active = 1 AND aa3.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa3.entity = ".((int) $conf->entity);
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa4 ON " . $alias_societe_perentity . ".accountancy_code_sell = aa4.account_number AND aa4.active = 1 AND aa4.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa4.entity = ".((int) $conf->entity);
// Add table from hooks
$parameters = array();
$reshook = $hookmanager->executeHooks('printFieldListFrom', $parameters, $object, $action); // Note that $action and $object may have been modified by hook
@ -541,68 +541,68 @@ if ($result) {
}
// Line ID
if (!empty($arrayfields['l.rowid']['checked'])) {
print '<td class="liste_titre" data-key="lineid">';
print '<input type="text" class="flat maxwidth40" name="search_lineid" value="'.dol_escape_htmltag($search_lineid).'">';
print '</td>';
print '<td class="liste_titre" data-key="lineid">';
print '<input type="text" class="flat maxwidth40" name="search_lineid" value="'.dol_escape_htmltag($search_lineid).'">';
print '</td>';
}
// Ref invoice
if (!empty($arrayfields['f.ref']['checked'])) {
print '<td class="liste_titre" data-key="invoice">';
print '<input type="text" class="flat maxwidth50" name="search_invoice" value="'.dol_escape_htmltag($search_invoice).'">';
print '</td>';
print '<td class="liste_titre" data-key="invoice">';
print '<input type="text" class="flat maxwidth50" name="search_invoice" value="'.dol_escape_htmltag($search_invoice).'">';
print '</td>';
}
// Date
if (!empty($arrayfields['f.datef']['checked'])) {
print '<td class="liste_titre center">';
print '<div class="nowrapfordate">';
print $form->selectDate($search_date_start ? $search_date_start : -1, 'search_date_start', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From'));
print '</div>';
print '<div class="nowrapfordate">';
print $form->selectDate($search_date_end ? $search_date_end : -1, 'search_date_end', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('to'));
print '</div>';
print '</td>';
print '<td class="liste_titre center">';
print '<div class="nowrapfordate">';
print $form->selectDate($search_date_start ? $search_date_start : -1, 'search_date_start', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('From'));
print '</div>';
print '<div class="nowrapfordate">';
print $form->selectDate($search_date_end ? $search_date_end : -1, 'search_date_end', 0, 0, 1, '', 1, 0, 0, '', '', '', '', 1, '', $langs->trans('to'));
print '</div>';
print '</td>';
}
// Product ref
if (!empty($arrayfields['p.ref']['checked'])) {
print '<td class="liste_titre" data-key="ref">';
print '<input type="text" class="flat maxwidth50" name="search_ref" value="'.dol_escape_htmltag($search_ref).'">';
print '</td>';
print '<td class="liste_titre" data-key="ref">';
print '<input type="text" class="flat maxwidth50" name="search_ref" value="'.dol_escape_htmltag($search_ref).'">';
print '</td>';
}
// Description
if (!empty($arrayfields['l.description']['checked'])) {
print '<td class="liste_titre" data-key="desc">';
print '<input type="text" class="flat maxwidth50" name="search_desc" value="'.dol_escape_htmltag($search_desc).'">';
print '</td>';
print '<td class="liste_titre" data-key="desc">';
print '<input type="text" class="flat maxwidth50" name="search_desc" value="'.dol_escape_htmltag($search_desc).'">';
print '</td>';
}
// Amount
if (!empty($arrayfields['l.total_ht']['checked'])) {
print '<td class="liste_titre" data-key="amount">';
print '<input type="text" class="right flat maxwidth50" name="search_amount" value="'.dol_escape_htmltag($search_amount).'">';
print '</td>';
print '<td class="liste_titre" data-key="amount">';
print '<input type="text" class="right flat maxwidth50" name="search_amount" value="'.dol_escape_htmltag($search_amount).'">';
print '</td>';
}
// VAT
if (!empty($arrayfields['l.tva_tx']['checked'])) {
print '<td class="liste_titre" data-key="vat">';
print '<input type="text" class="right flat maxwidth50" placeholder="%" name="search_vat" size="1" value="'.dol_escape_htmltag($search_vat).'">';
print '</td>';
print '<td class="liste_titre" data-key="vat">';
print '<input type="text" class="right flat maxwidth50" placeholder="%" name="search_vat" size="1" value="'.dol_escape_htmltag($search_vat).'">';
print '</td>';
}
// Thirdparty
if (!empty($arrayfields['s.nom']['checked'])) {
print '<td class="liste_titre" data-key="societe">';
print '<input type="text" class="flat maxwidth75imp" name="search_societe" value="'.dol_escape_htmltag($search_societe).'">';
print '</td>';
print '<td class="liste_titre" data-key="societe">';
print '<input type="text" class="flat maxwidth75imp" name="search_societe" value="'.dol_escape_htmltag($search_societe).'">';
print '</td>';
}
// Country
if (!empty($arrayfields['co.label']['checked'])) {
print '<td class="liste_titre" data-key="country">';
print $form->select_country($search_country, 'search_country', '', 0, 'maxwidth125', 'code2', 1, 0, 1);
print '</td>';
print '<td class="liste_titre" data-key="country">';
print $form->select_country($search_country, 'search_country', '', 0, 'maxwidth125', 'code2', 1, 0, 1);
print '</td>';
}
// TVA Intracom
if (!empty($arrayfields['s.tva_intra']['checked'])) {
print '<td class="liste_titre">';
print '<input type="text" class="flat maxwidth50" name="search_tvaintra" value="'.dol_escape_htmltag($search_tvaintra).'">';
print '</td>';
print '<td class="liste_titre">';
print '<input type="text" class="flat maxwidth50" name="search_tvaintra" value="'.dol_escape_htmltag($search_tvaintra).'">';
print '</td>';
}
// Data suggested
if (!empty($arrayfields['aa.data_suggest']['checked'])) {
@ -610,7 +610,7 @@ if ($result) {
}
// Account
if (!empty($arrayfields['aa.account_number']['checked'])) {
print '<td class="liste_titre"></td>';
print '<td class="liste_titre"></td>';
}
// Fields from hook
$parameters = array('arrayfields' => $arrayfields);
@ -639,53 +639,53 @@ if ($result) {
}
// Line ID
if (!empty($arrayfields['l.rowid']['checked'])) {
print_liste_field_titre($arrayfields['l.rowid']['label'], $_SERVER["PHP_SELF"], "l.rowid", "", $param, '', $sortfield, $sortorder);
$totalarray['nbfield']++;
print_liste_field_titre($arrayfields['l.rowid']['label'], $_SERVER["PHP_SELF"], "l.rowid", "", $param, '', $sortfield, $sortorder);
$totalarray['nbfield']++;
}
// Ref invoice
if (!empty($arrayfields['f.ref']['checked'])) {
print_liste_field_titre($arrayfields['f.ref']['label'], $_SERVER["PHP_SELF"], "f.ref", "", $param, '', $sortfield, $sortorder);
$totalarray['nbfield']++;
print_liste_field_titre($arrayfields['f.ref']['label'], $_SERVER["PHP_SELF"], "f.ref", "", $param, '', $sortfield, $sortorder);
$totalarray['nbfield']++;
}
// Date
if (!empty($arrayfields['f.datef']['checked'])) {
print_liste_field_titre($arrayfields['f.datef']['label'], $_SERVER["PHP_SELF"], "f.datef, f.ref, l.rowid", "", $param, '', $sortfield, $sortorder, 'center ');
$totalarray['nbfield']++;
print_liste_field_titre($arrayfields['f.datef']['label'], $_SERVER["PHP_SELF"], "f.datef, f.ref, l.rowid", "", $param, '', $sortfield, $sortorder, 'center ');
$totalarray['nbfield']++;
}
// Product ref
if (!empty($arrayfields['p.ref']['checked'])) {
print_liste_field_titre($arrayfields['p.ref']['label'], $_SERVER["PHP_SELF"], "p.ref", "", $param, '', $sortfield, $sortorder);
$totalarray['nbfield']++;
print_liste_field_titre($arrayfields['p.ref']['label'], $_SERVER["PHP_SELF"], "p.ref", "", $param, '', $sortfield, $sortorder);
$totalarray['nbfield']++;
}
// product description
if (!empty($arrayfields['l.description']['checked'])) {
print_liste_field_titre($arrayfields['l.description']['label'], $_SERVER["PHP_SELF"], "l.description", "", $param, '', $sortfield, $sortorder);
$totalarray['nbfield']++;
print_liste_field_titre($arrayfields['l.description']['label'], $_SERVER["PHP_SELF"], "l.description", "", $param, '', $sortfield, $sortorder);
$totalarray['nbfield']++;
}
// Amount
if (!empty($arrayfields['l.total_ht']['checked'])) {
print_liste_field_titre($arrayfields['l.total_ht']['label'], $_SERVER["PHP_SELF"], "l.total_ht", "", $param, '', $sortfield, $sortorder, 'right ');
$totalarray['nbfield']++;
print_liste_field_titre($arrayfields['l.total_ht']['label'], $_SERVER["PHP_SELF"], "l.total_ht", "", $param, '', $sortfield, $sortorder, 'right ');
$totalarray['nbfield']++;
}
// VAT
if (!empty($arrayfields['l.tva_tx']['checked'])) {
print_liste_field_titre($arrayfields['l.tva_tx']['label'], $_SERVER["PHP_SELF"], "l.tva_tx", "", $param, '', $sortfield, $sortorder, 'right ');
$totalarray['nbfield']++;
print_liste_field_titre($arrayfields['l.tva_tx']['label'], $_SERVER["PHP_SELF"], "l.tva_tx", "", $param, '', $sortfield, $sortorder, 'right ');
$totalarray['nbfield']++;
}
// Thirdparty
if (!empty($arrayfields['s.nom']['checked'])) {
print_liste_field_titre($arrayfields['s.nom']['label'], $_SERVER["PHP_SELF"], "s.nom", "", $param, '', $sortfield, $sortorder);
$totalarray['nbfield']++;
print_liste_field_titre($arrayfields['s.nom']['label'], $_SERVER["PHP_SELF"], "s.nom", "", $param, '', $sortfield, $sortorder);
$totalarray['nbfield']++;
}
// Country
if (!empty($arrayfields['co.label']['checked'])) {
print_liste_field_titre($arrayfields['co.label']['label'], $_SERVER["PHP_SELF"], "co.label", "", $param, '', $sortfield, $sortorder);
$totalarray['nbfield']++;
print_liste_field_titre($arrayfields['co.label']['label'], $_SERVER["PHP_SELF"], "co.label", "", $param, '', $sortfield, $sortorder);
$totalarray['nbfield']++;
}
// TVA Intracom
if (!empty($arrayfields['s.tva_intra']['checked'])) {
print_liste_field_titre($arrayfields['s.tva_intra']['label'], $_SERVER["PHP_SELF"], "s.tva_intra", "", $param, '', $sortfield, $sortorder);
$totalarray['nbfield']++;
print_liste_field_titre($arrayfields['s.tva_intra']['label'], $_SERVER["PHP_SELF"], "s.tva_intra", "", $param, '', $sortfield, $sortorder);
$totalarray['nbfield']++;
}
// Data suggested
if (!empty($arrayfields['aa.data_suggest']['checked'])) {
@ -694,8 +694,8 @@ if ($result) {
}
// Account
if (!empty($arrayfields['aa.account_number']['checked'])) {
print_liste_field_titre($arrayfields['aa.account_number']['label'], $_SERVER["PHP_SELF"], "aa.account_number", "", $param, '', $sortfield, $sortorder);
$totalarray['nbfield']++;
print_liste_field_titre($arrayfields['aa.account_number']['label'], $_SERVER["PHP_SELF"], "aa.account_number", "", $param, '', $sortfield, $sortorder);
$totalarray['nbfield']++;
}
// Hook fields
$parameters = array('arrayfields' => $arrayfields, 'param' => $param, 'sortfield' => $sortfield, 'sortorder' => $sortorder);
@ -703,8 +703,8 @@ if ($result) {
print $hookmanager->resPrint;
// Action column
if (!$conf->main_checkbox_left_column) {
print getTitleFieldOfList($selectedfields, 0, $_SERVER["PHP_SELF"], '', '', '', '', $sortfield, $sortorder, 'center maxwidthsearch ')."\n";
$totalarray['nbfield']++;
print getTitleFieldOfList($selectedfields, 0, $_SERVER["PHP_SELF"], '', '', '', '', $sortfield, $sortorder, 'center maxwidthsearch ')."\n";
$totalarray['nbfield']++;
}
print "</tr>\n";

4
htdocs/accountancy/expensereport/list.php
View file

@ -6,7 +6,7 @@
* Copyright (C) 2014 Juanjo Menent <jmenent@2byte.es>
* Copyright (C) 2016 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2025-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -274,7 +274,7 @@ $sql .= " FROM ".MAIN_DB_PREFIX."expensereport as er";
$sql .= " INNER JOIN ".MAIN_DB_PREFIX."expensereport_det as erd ON er.rowid = erd.fk_expensereport";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_type_fees as f ON f.id = erd.fk_c_type_fees";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."user as u ON u.rowid = er.fk_user_author";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa ON f.accountancy_code = aa.account_number AND aa.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa.entity = ".$conf->entity;
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa ON f.accountancy_code = aa.account_number AND aa.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa.entity = ".((int) $conf->entity);
// Add table from hooks
$parameters = array();
$reshook = $hookmanager->executeHooks('printFieldListFrom', $parameters, $object, $action); // Note that $action and $object may have been modified by hook

13
htdocs/accountancy/supplier/list.php
View file

@ -7,7 +7,7 @@
* Copyright (C) 2014 Juanjo Menent <jmenent@2byte.es>s
* Copyright (C) 2016 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -313,10 +313,10 @@ if (getDolGlobalString('MAIN_PRODUCT_PERENTITY_SHARED')) {
}
$alias_societe_perentity = !getDolGlobalString('MAIN_COMPANY_PERENTITY_SHARED') ? "s" : "spe";
$alias_product_perentity = !getDolGlobalString('MAIN_PRODUCT_PERENTITY_SHARED') ? "p" : "ppe";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa ON " . $alias_product_perentity . ".accountancy_code_buy = aa.account_number AND aa.active = 1 AND aa.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa.entity = ".$conf->entity;
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa2 ON " . $alias_product_perentity . ".accountancy_code_buy_intra = aa2.account_number AND aa2.active = 1 AND aa2.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa2.entity = ".$conf->entity;
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa3 ON " . $alias_product_perentity . ".accountancy_code_buy_export = aa3.account_number AND aa3.active = 1 AND aa3.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa3.entity = ".$conf->entity;
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa4 ON " . $alias_societe_perentity . ".accountancy_code_buy = aa4.account_number AND aa4.active = 1 AND aa4.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa4.entity = ".$conf->entity;
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa ON " . $alias_product_perentity . ".accountancy_code_buy = aa.account_number AND aa.active = 1 AND aa.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa.entity = ".((int) $conf->entity);
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa2 ON " . $alias_product_perentity . ".accountancy_code_buy_intra = aa2.account_number AND aa2.active = 1 AND aa2.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa2.entity = ".((int) $conf->entity);
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa3 ON " . $alias_product_perentity . ".accountancy_code_buy_export = aa3.account_number AND aa3.active = 1 AND aa3.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa3.entity = ".((int) $conf->entity);
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."accounting_account as aa4 ON " . $alias_societe_perentity . ".accountancy_code_buy = aa4.account_number AND aa4.active = 1 AND aa4.fk_pcg_version = '".$db->escape($chartaccountcode)."' AND aa4.entity = ".((int) $conf->entity);
// Add table from hooks
$parameters = array();
$reshook = $hookmanager->executeHooks('printFieldListFrom', $parameters, $object, $action); // Note that $action and $object may have been modified by hook
@ -836,7 +836,8 @@ if ($result) {
if ($conf->main_checkbox_left_column) {
print '<td class="nowrap center actioncolumn">';
$selected = in_array($objp->rowid."_".$i, $toselect);
print '<input type="checkbox" class="flat checkforselect checkforselect'.$facturefourn_static_det->id.'" name="toselect[]" value="'.$facturefourn_static_det->id."_".$i.'"'.($selected ? " checked" : "").'/>'; print '</td>';
print '<input type="checkbox" class="flat checkforselect checkforselect'.$facturefourn_static_det->id.'" name="toselect[]" value="'.$facturefourn_static_det->id."_".$i.'"'.($selected ? " checked" : "").'/>';
print '</td>';
if (!$i) {
$totalarray['nbfield']++;
}

2
htdocs/asset/class/assetdepreciationoptions.class.php
View file

@ -494,7 +494,7 @@ class AssetDepreciationOptions extends CommonObject
foreach ($this->deprecation_options_fields as $mode_key => $mode_info) {
// Delete old accountancy codes
$sql = "DELETE FROM " . MAIN_DB_PREFIX . $mode_info['table'];
$sql = "DELETE FROM " . MAIN_DB_PREFIX . $mode_info['table']; // From safe table @phan-suppress-current-line SqlInjection
$sql .= " WHERE " . ($asset_id > 0 ? " fk_asset = " . (int) $asset_id : " fk_asset_model = " . (int) $asset_model_id);
$resql = $this->db->query($sql);
if (!$resql) {

4
htdocs/comm/mailing/class/html.formadvtargetemailing.class.php
View file

@ -226,7 +226,7 @@ class FormAdvTargetEmailing extends Form
$sql_usr = '';
$sql_usr .= "SELECT DISTINCT u2.rowid, u2.lastname as name, u2.firstname, u2.login";
$sql_usr .= " FROM ".MAIN_DB_PREFIX."user as u2, ".MAIN_DB_PREFIX."societe_commerciaux as sc";
$sql_usr .= " WHERE u2.entity IN (0,".$conf->entity.")";
$sql_usr .= " WHERE u2.entity IN (0,".((int) $conf->entity).")";
$sql_usr .= " AND u2.rowid = sc.fk_user";
if (getDolGlobalString('USER_HIDE_INACTIVE_IN_COMBOBOX')) {
$sql_usr .= " AND u2.statut <> 0";
@ -325,7 +325,7 @@ class FormAdvTargetEmailing extends Form
if (!empty($InfoFieldList[1])) {
$sql .= $this->db->order($InfoFieldList[1]);
}
// $sql.= ' WHERE entity = '.$conf->entity;
// $sql.= ' WHERE entity = '.((int) $conf->entity);
$resql = $this->db->query($sql);
if ($resql) {

6
htdocs/comm/mailing/class/mailing.class.php
View file

@ -3,7 +3,7 @@
* Copyright (C) 2005-2016 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2009 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2025 Jon Bendtsen <jon.bendtsen.github@jonb.dk>
*
* This program is free software; you can redistribute it and/or modify
@ -703,7 +703,7 @@ class Mailing extends CommonObject
$now = dol_now();
$sql = "UPDATE ".MAIN_DB_PREFIX."mailing ";
$sql .= " SET statut = 1, date_valid = '".$this->db->idate($now)."', fk_user_valid=".$user->id;
$sql .= " SET statut = 1, date_valid = '".$this->db->idate($now)."', fk_user_valid=".((int) $user->id);
$sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog("Mailing::valid", LOG_DEBUG);
@ -726,7 +726,7 @@ class Mailing extends CommonObject
$now = dol_now();
$sql = "UPDATE ".MAIN_DB_PREFIX."mailing ";
$sql .= " SET statut = 0, tms = '".$this->db->idate($now)."', fk_user_modif=".$user->id;
$sql .= " SET statut = 0, tms = '".$this->db->idate($now)."', fk_user_modif=".((int) $user->id);
$sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog("Mailing::valid", LOG_DEBUG);

18
htdocs/compta/accounting-files.php
View file

@ -196,7 +196,7 @@ if ($action == 'searchfiles' || $action == 'dl') { // Test on permission not req
$sql .= " t.multicurrency_code as currency, t.fk_soc, t.datef as date, t.date_lim_reglement as date_due, 'Invoice' as item, s.nom as thirdparty_name, s.code_client as thirdparty_code, c.code as country_code, s.tva_intra as vatnum, ".PAY_CREDIT." as sens";
$sql .= " FROM ".MAIN_DB_PREFIX."facture as t LEFT JOIN ".MAIN_DB_PREFIX."societe as s ON s.rowid = t.fk_soc LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON c.rowid = s.fk_pays";
$sql .= " WHERE datef between ".$sanitizedwheretail;
$sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : $entity).')';
$sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : ((int) $entity)).')';
$sql .= " AND t.fk_statut <> ".Facture::STATUS_DRAFT;
if (!empty($projectid)) {
$sql .= " AND fk_projet = ".((int) $projectid);
@ -212,7 +212,7 @@ if ($action == 'searchfiles' || $action == 'dl') { // Test on permission not req
$sql .= " t.multicurrency_code as currency, t.fk_soc, t.datef as date, t.date_lim_reglement as date_due, 'SupplierInvoice' as item, s.nom as thirdparty_name, s.code_fournisseur as thirdparty_code, c.code as country_code, s.tva_intra as vatnum, ".PAY_DEBIT." as sens";
$sql .= " FROM ".MAIN_DB_PREFIX."facture_fourn as t LEFT JOIN ".MAIN_DB_PREFIX."societe as s ON s.rowid = t.fk_soc LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON c.rowid = s.fk_pays";
$sql .= " WHERE datef between ".$sanitizedwheretail;
$sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : $entity).')';
$sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : ((int) $entity)).')';
$sql .= " AND t.fk_statut <> ".FactureFournisseur::STATUS_DRAFT;
if (!empty($projectid)) {
$sql .= " AND fk_projet = ".((int) $projectid);
@ -234,7 +234,7 @@ if ($action == 'searchfiles' || $action == 'dl') { // Test on permission not req
$sql .= " LEFT JOIN " . MAIN_DB_PREFIX . "user as u ON u.rowid = t.fk_user_author";
$sql .= " LEFT JOIN " . MAIN_DB_PREFIX . "c_country as c ON c.rowid = u.fk_country";
$sql .= " WHERE date_fin between " . $sanitizedwheretail;
$sql .= " AND t.entity IN (" . $db->sanitize($entity == 1 ? '0,1' : $entity) . ')';
$sql .= " AND t.entity IN (" . $db->sanitize($entity == 1 ? '0,1' : ((int) $entity)) . ')';
$sql .= " AND t.fk_statut <> " . ExpenseReport::STATUS_DRAFT;
$sql .= " AND fk_projet = ".((int) $projectid);
} else {
@ -243,7 +243,7 @@ if ($action == 'searchfiles' || $action == 'dl') { // Test on permission not req
$sql .= " t.multicurrency_code as currency, t.fk_user_author as fk_soc, t.date_fin as date, t.date_fin as date_due, 'ExpenseReport' as item, CONCAT(CONCAT(u.lastname, ' '), u.firstname) as thirdparty_name, '' as thirdparty_code, c.code as country_code, '' as vatnum, " . PAY_DEBIT . " as sens";
$sql .= " FROM " . MAIN_DB_PREFIX . "expensereport as t LEFT JOIN " . MAIN_DB_PREFIX . "user as u ON u.rowid = t.fk_user_author LEFT JOIN " . MAIN_DB_PREFIX . "c_country as c ON c.rowid = u.fk_country";
$sql .= " WHERE date_fin between " . $sanitizedwheretail;
$sql .= " AND t.entity IN (" . $db->sanitize($entity == 1 ? '0,1' : $entity) . ')';
$sql .= " AND t.entity IN (" . $db->sanitize($entity == 1 ? '0,1' : ((int) $entity)) . ')';
$sql .= " AND t.fk_statut <> " . ExpenseReport::STATUS_DRAFT;
}
}
@ -257,7 +257,7 @@ if ($action == 'searchfiles' || $action == 'dl') { // Test on permission not req
$sql .= " '".$db->escape($conf->currency)."' as currency, 0 as fk_soc, t.datedon as date, t.datedon as date_due, 'Donation' as item, t.societe as thirdparty_name, '' as thirdparty_code, c.code as country_code, '' as vatnum, ".PAY_CREDIT." as sens";
$sql .= " FROM ".MAIN_DB_PREFIX."don as t LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON c.rowid = t.fk_country";
$sql .= " WHERE datedon between ".$sanitizedwheretail;
$sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : $entity).')';
$sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : ((int) $entity)).')';
$sql .= " AND t.fk_statut <> ".Don::STATUS_DRAFT;
if (!empty($projectid)) {
$sql .= " AND fk_projet = ".((int) $projectid);
@ -273,7 +273,7 @@ if ($action == 'searchfiles' || $action == 'dl') { // Test on permission not req
$sql .= " '".$db->escape($conf->currency)."' as currency, t.fk_user as fk_soc, t.datep as date, t.dateep as date_due, 'SalaryPayment' as item, CONCAT(CONCAT(u.lastname, ' '), u.firstname) as thirdparty_name, '' as thirdparty_code, c.code as country_code, '' as vatnum, ".PAY_DEBIT." as sens";
$sql .= " FROM ".MAIN_DB_PREFIX."payment_salary as t LEFT JOIN ".MAIN_DB_PREFIX."user as u ON u.rowid = t.fk_user LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON c.rowid = u.fk_country";
$sql .= " WHERE datep between ".$sanitizedwheretail;
$sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : $entity).')';
$sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : ((int) $entity)).')';
//$sql.=" AND fk_statut <> ".PaymentSalary::STATUS_DRAFT;
if (!empty($projectid)) {
$sql .= " AND fk_projet = ".((int) $projectid);
@ -289,7 +289,7 @@ if ($action == 'searchfiles' || $action == 'dl') { // Test on permission not req
$sql .= " '".$db->escape($conf->currency)."' as currency, 0 as fk_soc, t.date_ech as date, t.periode as date_due, 'SocialContributions' as item, '' as thirdparty_name, '' as thirdparty_code, '' as country_code, '' as vatnum, ".PAY_DEBIT." as sens";
$sql .= " FROM ".MAIN_DB_PREFIX."chargesociales as t";
$sql .= " WHERE t.date_ech between ".$sanitizedwheretail;
$sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : $entity).')';
$sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : ((int) $entity)).')';
//$sql.=" AND fk_statut <> ".ChargeSociales::STATUS_UNPAID;
if (!empty($projectid)) {
$sql .= " AND fk_projet = ".((int) $projectid);
@ -305,7 +305,7 @@ if ($action == 'searchfiles' || $action == 'dl') { // Test on permission not req
$sql .= " '".$db->escape($conf->currency)."' as currency, 0 as fk_soc, t.datep as date, t.datep as date_due, 'VariousPayment' as item, '' as thirdparty_name, '' as thirdparty_code, '' as country_code, '' as vatnum, sens";
$sql .= " FROM ".MAIN_DB_PREFIX."payment_various as t";
$sql .= " WHERE datep between ".$sanitizedwheretail;
$sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : $entity).')';
$sql .= " AND t.entity IN (".$db->sanitize($entity == 1 ? '0,1' : ((int) $entity)).')';
if (!empty($projectid)) {
$sql .= " AND fk_projet = ".((int) $projectid);
}
@ -320,7 +320,7 @@ if ($action == 'searchfiles' || $action == 'dl') { // Test on permission not req
$sql .= " '".$db->escape($conf->currency)."' as currency, 0 as fk_soc, t.datep as date, t.datep as date_due, 'LoanPayment' as item, '' as thirdparty_name, '' as thirdparty_code, '' as country_code, '' as vatnum, ".PAY_DEBIT." as sens";
$sql .= " FROM ".MAIN_DB_PREFIX."payment_loan as t LEFT JOIN ".MAIN_DB_PREFIX."loan as l ON l.rowid = t.fk_loan";
$sql .= " WHERE datep between ".$sanitizedwheretail;
$sql .= " AND l.entity IN (".$db->sanitize($entity == 1 ? '0,1' : $entity).')';
$sql .= " AND l.entity IN (".$db->sanitize($entity == 1 ? '0,1' : ((int) $entity)).')';
}
if ($sql) {

10
htdocs/compta/bank/annuel.php
View file

@ -3,7 +3,7 @@
* Copyright (C) 2004-2017 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2012 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2013-2023 Charlene BENKE <charlene@patas-monkey.com>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -325,8 +325,8 @@ if ($result < 0) {
$sql .= ", ".MAIN_DB_PREFIX."bank_account as ba";
$sql .= " WHERE b.fk_account = ba.rowid";
$sql .= " AND ba.entity IN (".getEntity('bank_account').")";
$sql .= " AND b.datev >= '".($year - $annee)."-01-01 00:00:00'";
$sql .= " AND b.datev <= '".($year - $annee)."-12-31 23:59:59'";
$sql .= " AND b.datev >= '".((int) ($year - $annee))."-01-01 00:00:00'";
$sql .= " AND b.datev <= '".((int) ($year - $annee))."-12-31 23:59:59'";
$sql .= " AND b.amount > 0";
if ($id && GETPOST("option") != 'all') {
$sql .= " AND b.fk_account IN (".$db->sanitize($id).")";
@ -408,8 +408,8 @@ if ($result < 0) {
$sql .= ", ".MAIN_DB_PREFIX."bank_account as ba";
$sql .= " WHERE b.fk_account = ba.rowid";
$sql .= " AND ba.entity IN (".getEntity('bank_account').")";
$sql .= " AND b.datev >= '".($year - $annee)."-01-01 00:00:00'";
$sql .= " AND b.datev <= '".($year - $annee)."-12-31 23:59:59'";
$sql .= " AND b.datev >= '".((int) ($year - $annee))."-01-01 00:00:00'";
$sql .= " AND b.datev <= '".((int) ($year - $annee))."-12-31 23:59:59'";
$sql .= " AND b.amount < 0";
if ($id && GETPOST("option") != 'all') {
$sql .= " AND b.fk_account IN (".$db->sanitize($id).")";

4
htdocs/compta/localtax/list.php
View file

@ -1,6 +1,6 @@
<?php
/* Copyright (C) 2011-2014 Juanjo Menent <jmenent@2byte.es>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -80,7 +80,7 @@ print load_fiche_titre($langs->transcountry($ltt == 2 ? "LT2Payments" : "LT1Paym
$sql = "SELECT rowid, amount, label, f.datev, f.datep";
$sql .= " FROM ".MAIN_DB_PREFIX."localtax as f ";
$sql .= " WHERE f.entity = ".$conf->entity." AND localtaxtype = ".((int) $ltt);
$sql .= " WHERE f.entity = ".((int) $conf->entity)." AND localtaxtype = ".((int) $ltt);
$sql .= " ORDER BY datev DESC";
$result = $db->query($sql);

2
htdocs/compta/prelevement/class/ligneprelevement.class.php
View file

@ -116,7 +116,7 @@ class LignePrelevement
$sql .= ", ".MAIN_DB_PREFIX."prelevement_bons as p";
$sql .= " WHERE pl.rowid=".((int) $rowid);
$sql .= " AND p.rowid = pl.fk_prelevement_bons";
$sql .= " AND p.entity = ".$conf->entity;
$sql .= " AND p.entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if ($resql) {

4
htdocs/compta/recap-compta.php
View file

@ -3,7 +3,7 @@
* Copyright (C) 2004-2017 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2017 Pierre-Henry Favre <support@atm-consulting.fr>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -213,7 +213,7 @@ if ($id > 0) {
$sql .= " ".MAIN_DB_PREFIX."paiement as p";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."user as u ON p.fk_user_creat = u.rowid";
$sql .= " WHERE pf.fk_paiement = p.rowid";
$sql .= " AND p.entity = ".$conf->entity;
$sql .= " AND p.entity = ".((int) $conf->entity);
$sql .= " AND pf.fk_facture = ".((int) $fac->id);
$sql .= " ORDER BY p.datep ASC, p.rowid ASC";

6
htdocs/compta/stats/supplier_turnover_by_prodserv.php
View file

@ -1,6 +1,6 @@
<?php
/* Copyright (C) 2020 Maxime Kohlhaas <maxime@atm-consulting.fr>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -288,9 +288,9 @@ if (isModEnabled('accounting')) {
$sql = "SELECT b.rowid ";
$sql .= " FROM ".MAIN_DB_PREFIX."accounting_bookkeeping as b,";
$sql .= " ".MAIN_DB_PREFIX."accounting_account as aa";
$sql .= " WHERE b.entity = ".$conf->entity; // In module double party accounting, we never share entities
$sql .= " WHERE b.entity = ".((int) $conf->entity); // In module double party accounting, we never share entities
$sql .= " AND b.numero_compte = aa.account_number";
$sql .= " AND aa.entity = ".$conf->entity;
$sql .= " AND aa.entity = ".((int) $conf->entity);
$sql .= " AND aa.fk_pcg_version = '".$db->escape($pcgvercode)."'";
$sql .= $db->plimit(1);

4
htdocs/fourn/class/fournisseur.class.php
View file

@ -3,7 +3,7 @@
* Copyright (C) 2006 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2009 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2011 Juanjo Menent <jmenent@2byte.es>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2025 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -107,7 +107,7 @@ class Fournisseur extends Societe
$sql = "SELECT count(pfp.rowid) as nb";
$sql .= " FROM ".MAIN_DB_PREFIX."product_fournisseur_price as pfp";
$sql .= " WHERE pfp.entity = ".$conf->entity;
$sql .= " WHERE pfp.entity = ".((int) $conf->entity);
$sql .= " AND pfp.fk_soc = ".((int) $this->id);
$resql = $this->db->query($sql);

4
htdocs/hrm/class/establishment.class.php
View file

@ -1,7 +1,7 @@
<?php
/* Copyright (C) 2015 Alexandre Spangaro <aspangaro@open-dsi.fr>
* Copyright (C) 2018-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -255,7 +255,7 @@ class Establishment extends CommonObject
$sql .= ", address = '".$this->db->escape($this->address)."'";
$sql .= ", zip = '".$this->db->escape($this->zip)."'";
$sql .= ", town = '".$this->db->escape($this->town)."'";
$sql .= ", fk_country = ".($this->country_id > 0 ? $this->country_id : 'null');
$sql .= ", fk_country = ".($this->country_id > 0 ? ((int) $this->country_id) : 'null');
$sql .= ", status = ".((int) $this->status);
$sql .= ", fk_user_mod = ".((int) $user->id);
$sql .= ", entity = ".((int) $this->entity);

10
htdocs/knowledgemanagement/core/modules/knowledgemanagement/mod_knowledgerecord_standard.php
View file

@ -1,7 +1,7 @@
<?php
/* Copyright (C) 2005-2010 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2009 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -91,11 +91,11 @@ class mod_knowledgerecord_standard extends ModeleNumRefKnowledgeRecord
$max = '';
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."knowledgemanagement_knowledgerecord";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
if ($object->ismultientitymanaged == 1) {
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
} elseif (!is_numeric($object->ismultientitymanaged)) {
// TODO
}
@ -129,11 +129,11 @@ class mod_knowledgerecord_standard extends ModeleNumRefKnowledgeRecord
// first we get the max value
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."knowledgemanagement_knowledgerecord";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
if ($object->ismultientitymanaged == 1) {
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
} elseif (!is_numeric($object->ismultientitymanaged)) {
// TODO
}

10
htdocs/partnership/core/modules/partnership/mod_partnership_standard.php
View file

@ -1,7 +1,7 @@
<?php
/* Copyright (C) 2005-2010 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2009 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2025 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -92,11 +92,11 @@ class mod_partnership_standard extends ModeleNumRefPartnership
$max = '';
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."partnership";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
if ($object->ismultientitymanaged == 1) {
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
} elseif (!is_numeric($object->ismultientitymanaged)) {
// TODO
}
@ -130,11 +130,11 @@ class mod_partnership_standard extends ModeleNumRefPartnership
// first we get the max value
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."partnership";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
if ($object->ismultientitymanaged == 1) {
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
} elseif (!is_numeric($object->ismultientitymanaged)) {
// TODO
}

3
htdocs/product/stock/replenishorders.php
View file

@ -4,6 +4,7 @@
* Copyright (C) 2014 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2018-2024 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2019 Juanjo Menent <jmenent@2byte.es>
* Copyright (C) 2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -138,7 +139,7 @@ if (!$user->hasRight('societe', 'client', 'voir')) {
$sql .= ', '.MAIN_DB_PREFIX.'societe_commerciaux as sc';
}
$sql .= ' WHERE cf.fk_soc = s.rowid ';
$sql .= ' AND cf.entity = '.$conf->entity;
$sql .= ' AND cf.entity = '.((int) $conf->entity);
if (getDolGlobalString('STOCK_CALCULATE_ON_SUPPLIER_VALIDATE_ORDER')) {
$sql .= ' AND cf.fk_statut < 3';
} elseif (getDolGlobalString('STOCK_CALCULATE_ON_SUPPLIER_DISPATCH_ORDER') || getDolGlobalString('STOCK_CALCULATE_ON_RECEPTION') || getDolGlobalString('STOCK_CALCULATE_ON_RECEPTION_CLOSE')) {

10
htdocs/recruitment/core/modules/recruitment/mod_recruitmentcandidature_standard.php
View file

@ -2,7 +2,7 @@
/* Copyright (C) 2005-2010 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2009 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -92,11 +92,11 @@ class mod_recruitmentcandidature_standard extends ModeleNumRefRecruitmentCandida
$max = '';
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."recruitment_recruitmentcandidature";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
if ($object->ismultientitymanaged == 1) {
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
} elseif (!is_numeric($object->ismultientitymanaged)) {
// TODO
}
@ -130,11 +130,11 @@ class mod_recruitmentcandidature_standard extends ModeleNumRefRecruitmentCandida
// First we get the max value
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."recruitment_recruitmentcandidature";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
if ($object->ismultientitymanaged == 1) {
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
} elseif (!is_numeric($object->ismultientitymanaged)) {
// TODO
}

10
htdocs/recruitment/core/modules/recruitment/mod_recruitmentjobposition_standard.php
View file

@ -2,7 +2,7 @@
/* Copyright (C) 2005-2010 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2009 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -92,11 +92,11 @@ class mod_recruitmentjobposition_standard extends ModeleNumRefRecruitmentJobPosi
$max = '';
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."recruitment_recruitmentjobposition";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
if ($object->ismultientitymanaged == 1) {
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
} elseif (!is_numeric($object->ismultientitymanaged)) {
// TODO
}
@ -130,11 +130,11 @@ class mod_recruitmentjobposition_standard extends ModeleNumRefRecruitmentJobPosi
// First we get the max value
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."recruitment_recruitmentjobposition";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
if ($object->ismultientitymanaged == 1) {
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
} elseif (!is_numeric($object->ismultientitymanaged)) {
// TODO
}

5
htdocs/recruitment/index.php
View file

@ -4,6 +4,7 @@
* Copyright (C) 2005-2012 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2015 Jean-François Ferry <jfefe@aternatik.fr>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -354,7 +355,7 @@ if (isModEnabled('recruitment') && $user->hasRight('recruitment', 'recruitmentjo
$sql .= " AND s.fk_soc = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
}
if ($socid) {
$sql .= " AND s.fk_soc = $socid";
$sql .= " AND s.fk_soc = ".((int) $socid);
}
$sql .= " GROUP BY s.rowid, s.ref, s.label, s.date_creation, s.tms, s.status";
$sql .= $db->order('s.tms', 'DESC');
@ -425,7 +426,7 @@ if (isModEnabled('recruitment') && $user->hasRight('recruitment', 'recruitmentjo
$sql .= " AND s.fk_soc = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
}
if ($socid) {
$sql .= " AND s.fk_soc = $socid";
$sql .= " AND s.fk_soc = ".((int) $socid);
}
$sql .= $db->order('rc.tms', 'DESC');
$sql .= $db->plimit($max, 0);

4
htdocs/salaries/payment_salary/card.php
View file

@ -4,7 +4,7 @@
* Copyright (C) 2005 Marc Barilley / Ocebo <marc@ocebo.com>
* Copyright (C) 2005-2009 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2021 Gauthier VERDOL <gauthier.verdol@atm-consulting.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024 Alexandre SPANGARO <alexandre@inovea-conseil.com>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
*
@ -212,7 +212,7 @@ $disable_delete = 0;
$sql = 'SELECT f.rowid as scid, f.label, f.paye, f.amount as sc_amount, ps.amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.'payment_salary as ps,'.MAIN_DB_PREFIX.'salary as f';
$sql .= ' WHERE ps.fk_salary = f.rowid';
$sql .= ' AND f.entity = '.$conf->entity;
$sql .= ' AND f.entity = '.((int) $conf->entity);
$sql .= ' AND ps.rowid = '.((int) $object->id);
dol_syslog("payment_salary/card.php", LOG_DEBUG);

2
htdocs/societe/class/companypaymentmode.class.php
View file

@ -532,7 +532,7 @@ class CompanyPaymentMode extends CommonObject
public function setAsDefault($id = 0, $alltypes = 0)
{
$sql1 = "SELECT rowid as id, fk_soc, type FROM ".MAIN_DB_PREFIX."societe_rib";
$sql1 .= " WHERE rowid = ".((int) ($id ? $id : $this->id));
$sql1 .= " WHERE rowid = ".((int) ($id ? $id : ((int) $this->id)));
dol_syslog(get_class($this).'::setAsDefault', LOG_DEBUG);
$result1 = $this->db->query($sql1);

5
htdocs/supplier_proposal/index.php
View file

@ -5,6 +5,7 @@
* Copyright (C) 2019 Nicolas ZABOURI <info@inovea-conseil.com>
* Copyright (C) 2024 Alexandre Spangaro <alexandre@inovea-conseil.com>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -190,7 +191,7 @@ if (isModEnabled('supplier_proposal')) {
$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
}
$sql .= " WHERE c.fk_soc = s.rowid";
$sql .= " AND c.entity = ".$conf->entity;
$sql .= " AND c.entity = ".((int) $conf->entity);
$sql .= " AND c.fk_statut = 0";
if ($socid) {
$sql .= " AND c.fk_soc = ".((int) $socid);
@ -248,7 +249,7 @@ if (!$user->hasRight('societe', 'client', 'voir')) {
$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
}
$sql .= " WHERE c.fk_soc = s.rowid";
$sql .= " AND c.entity = ".$conf->entity;
$sql .= " AND c.entity = ".((int) $conf->entity);
//$sql.= " AND c.fk_statut > 2";
if ($socid) {
$sql .= " AND c.fk_soc = ".((int) $socid);

4
htdocs/webservices/server_thirdparty.php
View file

@ -1,6 +1,6 @@
<?php
/* Copyright (C) 2006-2016 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -740,7 +740,7 @@ function getListOfThirdParties($authentication, $filterthirdparty)
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_country as c ON s.fk_pays = c.rowid";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe_extrafields as extra ON s.rowid=fk_object";
$sql .= " WHERE entity=".$conf->entity;
$sql .= " WHERE entity=".((int) $conf->entity);
foreach ($filterthirdparty as $key => $val) {
if ($key == 'name' && $val != '') {
$sql .= " AND s.name LIKE '%".$db->escape($val)."%'";