vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Qual: Update SQL query variables for situation mode in margin reports (#39282)

Browse source 
# Qual: Update SQL query variables for situation mode in margin reports

In the situation mode, the SQL queries for agentMargins, customerMargins, productMargins, and productMargins tab were updated to use new variable names ($sql_delta_pct and $sql_delta_ht) instead of the old ones ($delta_pct and $delta_ht).

This allows correct analysis by SqlInjection
This commit is contained in:
MDW 2026-07-27 13:02:34 +02:00 committed by GitHub
parent f551727df9
commit 3932cd5853
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 23 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
htdocs/margin/agentMargins.php
View file

@ -2,7 +2,7 @@
/* Copyright (C) 2012-2013 Christophe Battarel <christophe.battarel@altairis.fr>
* Copyright (C) 2014 Ferran Marcet <fmarcet@2byte.es>
* Copyright (C) 2015 Marcos García <marcosgdf@gmail.com>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -162,12 +162,12 @@ $sql .= " s.rowid as socid, s.nom as name, s.code_client, s.client,";
$sql .= " u.rowid as agent, u.login, u.lastname, u.firstname,";
// Special case for old situation mode: total_ht is stored cumulatively, use delta percent to avoid cumulating margins
if (getDolGlobalInt('INVOICE_USE_SITUATION') == 1) {
$delta_pct = 'CASE WHEN f.type = '.Facture::TYPE_SITUATION.' AND d.situation_percent > 0 THEN (d.situation_percent - COALESCE(prev_d.situation_percent, 0)) ELSE d.situation_percent END';
$delta_ht = 'CASE WHEN f.type = '.Facture::TYPE_SITUATION.' AND d.situation_percent > 0 THEN d.total_ht * ((d.situation_percent - COALESCE(prev_d.situation_percent, 0)) / d.situation_percent) ELSE d.total_ht END';
$sql .= " sum($delta_ht) as selling_price,";
$sql_delta_pct = 'CASE WHEN f.type = '.Facture::TYPE_SITUATION.' AND d.situation_percent > 0 THEN (d.situation_percent - COALESCE(prev_d.situation_percent, 0)) ELSE d.situation_percent END';
$sql_delta_ht = 'CASE WHEN f.type = '.Facture::TYPE_SITUATION.' AND d.situation_percent > 0 THEN d.total_ht * ((d.situation_percent - COALESCE(prev_d.situation_percent, 0)) / d.situation_percent) ELSE d.total_ht END';
$sql .= " sum($sql_delta_ht) as selling_price,";
// Note: qty and buy_price_ht is always positive (if not your database may be corrupted, you can update this)
$sql .= " sum(".$db->ifsql('(d.total_ht < 0 OR (d.total_ht = 0 AND f.type = 2))', "-1 * d.qty * d.buy_price_ht * ($delta_pct / 100)", "d.qty * d.buy_price_ht * ($delta_pct / 100)").") as buying_price,";
$sql .= " sum(".$db->ifsql('(d.total_ht < 0 OR (d.total_ht = 0 AND f.type = 2))', "-1 * (abs($delta_ht) - (d.buy_price_ht * d.qty * ($delta_pct / 100)))", "$delta_ht - (d.buy_price_ht * d.qty * ($delta_pct / 100))").") as marge";
$sql .= " sum(".$db->ifsql('(d.total_ht < 0 OR (d.total_ht = 0 AND f.type = 2))', "-1 * d.qty * d.buy_price_ht * ($sql_delta_pct / 100)", "d.qty * d.buy_price_ht * ($sql_delta_pct / 100)").") as buying_price,";
$sql .= " sum(".$db->ifsql('(d.total_ht < 0 OR (d.total_ht = 0 AND f.type = 2))', "-1 * (abs($sql_delta_ht) - (d.buy_price_ht * d.qty * ($sql_delta_pct / 100)))", "$sql_delta_ht - (d.buy_price_ht * d.qty * ($sql_delta_pct / 100))").") as marge";
} else {
$sql .= " sum(d.total_ht) as selling_price,";
// Note: qty and buy_price_ht is always positive (if not your database may be corrupted, you can update this)

12
htdocs/margin/customerMargins.php
View file

@ -1,7 +1,7 @@
<?php
/* Copyright (C) 2012-2013 Christophe Battarel <christophe.battarel@altairis.fr>
* Copyright (C) 2014 Ferran Marcet <fmarcet@2byte.es>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -230,12 +230,12 @@ if ($client) {
}
// Special case for old situation mode: total_ht is stored cumulatively, use delta percent to avoid cumulating margins
if (getDolGlobalInt('INVOICE_USE_SITUATION') == 1) {
$delta_pct = 'CASE WHEN f.type = '.Facture::TYPE_SITUATION.' AND d.situation_percent > 0 THEN (d.situation_percent - COALESCE(prev_d.situation_percent, 0)) ELSE d.situation_percent END';
$delta_ht = 'CASE WHEN f.type = '.Facture::TYPE_SITUATION.' AND d.situation_percent > 0 THEN d.total_ht * ((d.situation_percent - COALESCE(prev_d.situation_percent, 0)) / d.situation_percent) ELSE d.total_ht END';
$sql .= " sum($delta_ht) as selling_price,";
$sql_delta_pct = 'CASE WHEN f.type = '.Facture::TYPE_SITUATION.' AND d.situation_percent > 0 THEN (d.situation_percent - COALESCE(prev_d.situation_percent, 0)) ELSE d.situation_percent END';
$sql_delta_ht = 'CASE WHEN f.type = '.Facture::TYPE_SITUATION.' AND d.situation_percent > 0 THEN d.total_ht * ((d.situation_percent - COALESCE(prev_d.situation_percent, 0)) / d.situation_percent) ELSE d.total_ht END';
$sql .= " sum($sql_delta_ht) as selling_price,";
// Note: qty and buy_price_ht is always positive (if not, your database may be corrupted, you can update this)
$sql .= " sum(".$db->ifsql('(d.total_ht < 0 OR (d.total_ht = 0 AND f.type = 2))', "-1 * d.qty * d.buy_price_ht * ($delta_pct / 100)", "d.qty * d.buy_price_ht * ($delta_pct / 100)").") as buying_price,";
$sql .= " sum(".$db->ifsql('(d.total_ht < 0 OR (d.total_ht = 0 AND f.type = 2))', "-1 * (abs($delta_ht) - (d.buy_price_ht * d.qty * ($delta_pct / 100)))", "$delta_ht - (d.buy_price_ht * d.qty * ($delta_pct / 100))").") as marge";
$sql .= " sum(".$db->ifsql('(d.total_ht < 0 OR (d.total_ht = 0 AND f.type = 2))', "-1 * d.qty * d.buy_price_ht * ($sql_delta_pct / 100)", "d.qty * d.buy_price_ht * ($sql_delta_pct / 100)").") as buying_price,";
$sql .= " sum(".$db->ifsql('(d.total_ht < 0 OR (d.total_ht = 0 AND f.type = 2))', "-1 * (abs($sql_delta_ht) - (d.buy_price_ht * d.qty * ($sql_delta_pct / 100)))", "$sql_delta_ht - (d.buy_price_ht * d.qty * ($sql_delta_pct / 100))").") as marge";
} else {
$sql .= " sum(d.total_ht) as selling_price,";
// Note: qty and buy_price_ht is always positive (if not, your database may be corrupted, you can update this)

12
htdocs/margin/productMargins.php
View file

@ -3,7 +3,7 @@
* Copyright (C) 2014 Ferran Marcet <fmarcet@2byte.es>
* Copyright (C) 2020 Alexandre Spangaro <aspangaro@open-dsi.fr>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2025-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -196,13 +196,13 @@ if ($id > 0) {
}
// Special case for old situation mode: total_ht is stored cumulatively, use delta percent to avoid cumulating margins
if (getDolGlobalInt('INVOICE_USE_SITUATION') == 1) {
$delta_pct = 'CASE WHEN f.type = '.Facture::TYPE_SITUATION.' AND d.situation_percent > 0 THEN (d.situation_percent - COALESCE(prev_d.situation_percent, 0)) ELSE d.situation_percent END';
$delta_ht = 'CASE WHEN f.type = '.Facture::TYPE_SITUATION.' AND d.situation_percent > 0 THEN d.total_ht * ((d.situation_percent - COALESCE(prev_d.situation_percent, 0)) / d.situation_percent) ELSE d.total_ht END';
$sql .= " SUM($delta_ht) as selling_price,";
$sql_delta_pct = 'CASE WHEN f.type = '.Facture::TYPE_SITUATION.' AND d.situation_percent > 0 THEN (d.situation_percent - COALESCE(prev_d.situation_percent, 0)) ELSE d.situation_percent END';
$sql_delta_ht = 'CASE WHEN f.type = '.Facture::TYPE_SITUATION.' AND d.situation_percent > 0 THEN d.total_ht * ((d.situation_percent - COALESCE(prev_d.situation_percent, 0)) / d.situation_percent) ELSE d.total_ht END';
$sql .= " SUM($sql_delta_ht) as selling_price,";
$sql .= " SUM(d.qty) as product_qty,";
// Note: qty and buy_price_ht is always positive (if not your database may be corrupted, you can update this)
$sql .= " SUM(".$db->ifsql('(d.total_ht < 0 OR (d.total_ht = 0 AND f.type = 2))', "-1 * d.qty * d.buy_price_ht * ($delta_pct / 100)", "d.qty * d.buy_price_ht * ($delta_pct / 100)").") as buying_price,";
$sql .= " SUM(".$db->ifsql('(d.total_ht < 0 OR (d.total_ht = 0 AND f.type = 2))', "-1 * (abs($delta_ht) - (d.buy_price_ht * d.qty * ($delta_pct / 100)))", "$delta_ht - (d.buy_price_ht * d.qty * ($delta_pct / 100))").") as marge";
$sql .= " SUM(".$db->ifsql('(d.total_ht < 0 OR (d.total_ht = 0 AND f.type = 2))', "-1 * d.qty * d.buy_price_ht * ($sql_delta_pct / 100)", "d.qty * d.buy_price_ht * ($sql_delta_pct / 100)").") as buying_price,";
$sql .= " SUM(".$db->ifsql('(d.total_ht < 0 OR (d.total_ht = 0 AND f.type = 2))', "-1 * (abs($sql_delta_ht) - (d.buy_price_ht * d.qty * ($sql_delta_pct / 100)))", "$sql_delta_ht - (d.buy_price_ht * d.qty * ($sql_delta_pct / 100))").") as marge";
} else {
$sql .= " SUM(d.total_ht) as selling_price,";
$sql .= " SUM(d.qty) as product_qty,";

10
htdocs/margin/tabs/productMargins.php
View file

@ -215,12 +215,12 @@ if ($id > 0 || !empty($ref)) {
}
// Special case for old situation mode: total_ht is stored cumulatively, use delta percent to avoid cumulating margins
if (getDolGlobalInt('INVOICE_USE_SITUATION') == 1) {
$delta_pct = 'CASE WHEN f.type = '.Facture::TYPE_SITUATION.' AND d.situation_percent > 0 THEN (d.situation_percent - COALESCE(prev_d.situation_percent, 0)) ELSE d.situation_percent END';
$delta_ht = 'CASE WHEN f.type = '.Facture::TYPE_SITUATION.' AND d.situation_percent > 0 THEN d.total_ht * ((d.situation_percent - COALESCE(prev_d.situation_percent, 0)) / d.situation_percent) ELSE d.total_ht END';
$sql .= " sum($delta_ht) as selling_price,"; // may be negative or positive
$sql_delta_pct = 'CASE WHEN f.type = '.Facture::TYPE_SITUATION.' AND d.situation_percent > 0 THEN (d.situation_percent - COALESCE(prev_d.situation_percent, 0)) ELSE d.situation_percent END';
$sql_delta_ht = 'CASE WHEN f.type = '.Facture::TYPE_SITUATION.' AND d.situation_percent > 0 THEN d.total_ht * ((d.situation_percent - COALESCE(prev_d.situation_percent, 0)) / d.situation_percent) ELSE d.total_ht END';
$sql .= " sum($sql_delta_ht) as selling_price,"; // may be negative or positive
$sql .= " ".$db->ifsql('f.type = 2', '-1', '1')." * sum(d.qty) as qty,"; // not always positive in case of Credit note
$sql .= " ".$db->ifsql('f.type = 2', '-1', '1')." * sum(d.qty * d.buy_price_ht * ($delta_pct / 100)) as buying_price,"; // not always positive in case of Credit note
$sql .= " ".$db->ifsql('f.type = 2', '-1', '1')." * sum(abs($delta_ht) - (d.buy_price_ht * d.qty * ($delta_pct / 100))) as marge"; // not always positive in case of Credit note
$sql .= " ".$db->ifsql('f.type = 2', '-1', '1')." * sum(d.qty * d.buy_price_ht * ($sql_delta_pct / 100)) as buying_price,"; // not always positive in case of Credit note
$sql .= " ".$db->ifsql('f.type = 2', '-1', '1')." * sum(abs($sql_delta_ht) - (d.buy_price_ht * d.qty * ($sql_delta_pct / 100))) as marge"; // not always positive in case of Credit note
} else {
$sql .= " sum(d.total_ht) as selling_price,"; // may be negative or positive
$sql .= " ".$db->ifsql('f.type = 2', '-1', '1')." * sum(d.qty) as qty,"; // not always positive in case of Credit note