vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Qual: Fix 'SqlInjection' notices (#39221)

Browse source 
# Qual: Fix 'SqlInjection' notices

Batch of 25 files with changes to fix 'SqlInjection' Notices
This commit is contained in:
MDW 2026-07-20 02:51:11 +02:00 committed by GitHub
parent 1a8825d759
commit 7cc8ae1efb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
25 changed files with 100 additions and 96 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
htdocs/accountancy/admin/categories_list.php
View file

@ -261,7 +261,7 @@ if (GETPOST('actionadd', 'alpha') || GETPOST('actionmodify', 'alpha')) {
// List of values
if ($tabrowid[$id] && !in_array($tabrowid[$id], $listfieldinsert)) {
$sql .= $newid.",";
$sql .= ((int) $newid).",";
}
$i = 0;
foreach ($listfieldinsert as $f => $value) {

2
htdocs/admin/website.php
View file

@ -205,7 +205,7 @@ if (GETPOST('actionadd', 'alpha') || GETPOST('actionmodify', 'alpha')) {
// List of values
if ($tabrowid[$id] && !in_array($tabrowid[$id], $listfieldinsert)) {
$sql .= $newid.",";
$sql .= ((int) $newid).",";
}
$i = 0;
foreach ($listfieldinsert as $f => $value) {

8
htdocs/ai/tools/categories.class.php
View file

@ -287,7 +287,7 @@ class ToolCategories extends McpTool
* Executes the requested tool function based on its name.
*
* @param string $name The name of the tool to execute.
* @param array<string, mixed> $args The arguments for the tool (key-value pairs).
* @param array<string, mixed> $args The arguments for the tool (key-value pairs). Only SQL safe arguments!
* @return mixed The result of the tool execution (usually an array) or an error array.
*/
public function execute(string $name, array $args)
@ -406,6 +406,8 @@ class ToolCategories extends McpTool
/**
* Searches for categories based on a query and type.
*
* Note: Only call with sql safe parameters
*
* @param array<string, mixed> $args Array containing 'query' (string), 'scope' (string), 'limit' (int), 'offset' (int).
* @return array{error:string}|array{count:int}|list<array<string, mixed>> A list of found categories or an error array.
*/
@ -442,9 +444,9 @@ class ToolCategories extends McpTool
$sql .= " WHERE c.entity IN (" . getEntity('category') . ")";
if (!empty($query)) {
$query_lower = strtolower($query);
$sqlSearchText = $this->db->escape(strtolower($query));
$sql .= " AND (LOWER(c.label) LIKE '%" . $this->db->escape($query_lower) . "%' OR LOWER(c.description) LIKE '%" . $this->db->escape($query_lower) . "%')";
$sql .= " AND (LOWER(c.label) LIKE '%" . $sqlSearchText . "%' OR LOWER(c.description) LIKE '%" . $sqlSearchText . "%')";
}
if (!empty($scope_filter)) {

4
htdocs/asset/class/asset.class.php
View file

@ -1765,14 +1765,14 @@ class Asset extends CommonObject
if (preg_match('/^[\(]?PROV/i', $this->ref)) {
// Now we rename also files into index
$sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'asset/".$this->db->escape($this->newref)."'";
$sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'bom/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
$sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'bom/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;
$this->error = $this->db->lasterror();
}
$sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'asset/".$this->db->escape($this->newref)."'";
$sql .= " WHERE filepath = 'asset/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
$sql .= " WHERE filepath = 'asset/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;

4
htdocs/comm/mailing/list.php
View file

@ -1,7 +1,7 @@
<?php
/* Copyright (C) 2005-2023 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2010 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024 Alexandre Spangaro <alexandre@inovea-conseil.com>
* Copyright (C) 2024-2026 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2025 Jon Bendtsen <jon.bendtsen.github@jonb.dk>
@ -197,7 +197,7 @@ if ($filteremail) {
$sql .= " FROM ".MAIN_DB_PREFIX."mailing as m, ".MAIN_DB_PREFIX."mailing_cibles as mc";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."projet as pr ON pr.rowid = m.fk_project";
$sql .= " WHERE m.rowid = mc.fk_mailing AND m.entity = ".$conf->entity;
$sql .= " WHERE m.rowid = mc.fk_mailing AND m.entity = ".((int) $conf->entity);
$sql .= " AND mc.email = '".$db->escape($filteremail)."'";
if ($search_ref) {
$sql .= natural_search("m.rowid", $search_ref, 1);

4
htdocs/compta/bank/bankentries_list.php
View file

@ -10,7 +10,7 @@
* Copyright (C) 2018 Ferran Marcet <fmarcet@2byte.es>
* Copyright (C) 2018-2026 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2021 Gauthier VERDOL <gauthier.verdol@atm-consulting.fr>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -1340,7 +1340,7 @@ if ($resql) {
$sqlforbalance .= " AND ba.entity IN (".getEntity('bank_account').")";
$sqlforbalance .= " AND b.fk_account = ".((int) $search_account);
// To limit record on the page
$sqlforbalance .= " AND (b.datev < '".$db->idate($db->jdate($objp->dv))."' OR (b.datev = '".$db->idate($db->jdate($objp->dv))."' AND (b.dateo < '".$db->idate($db->jdate($objp->do))."' OR (b.dateo = '".$db->idate($db->jdate($objp->do))."' AND b.rowid < ".$objp->rowid."))))";
$sqlforbalance .= " AND (b.datev < '".$db->idate($db->jdate($objp->dv))."' OR (b.datev = '".$db->idate($db->jdate($objp->dv))."' AND (b.dateo < '".$db->idate($db->jdate($objp->do))."' OR (b.dateo = '".$db->idate($db->jdate($objp->do))."' AND b.rowid < ".((int) $objp->rowid)."))))";
$resqlforbalance = $db->query($sqlforbalance);
//print $sqlforbalance;

8
htdocs/compta/bank/class/bankcateg.class.php
View file

@ -3,7 +3,7 @@
* Copyright (C) 2009 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2016 Marcos García <marcosgdf@gmail.com>
* Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -159,7 +159,7 @@ class BankCateg // extends CommonObject
$sql .= " t.label";
$sql .= " FROM ".MAIN_DB_PREFIX."categorie as t";
$sql .= " WHERE t.rowid = ".((int) $id);
$sql .= " AND t.entity = ".$conf->entity." AND t.type = " . ((int) $catTypeID);
$sql .= " AND t.entity = ".((int) $conf->entity)." AND t.type = " . ((int) $catTypeID);
dol_syslog(get_class($this)."::fetch", LOG_DEBUG);
$resql = $this->db->query($sql);
@ -203,7 +203,7 @@ class BankCateg // extends CommonObject
$sql = "UPDATE ".MAIN_DB_PREFIX."categorie SET";
$sql .= " label=".(isset($this->label) ? "'".$this->db->escape($this->label)."'" : "null");
$sql .= " WHERE rowid=".((int) $this->id);
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$this->db->begin();
@ -349,7 +349,7 @@ class BankCateg // extends CommonObject
$return = array();
$sql = "SELECT rowid, label FROM ".MAIN_DB_PREFIX."categorie WHERE entity = ".$conf->entity." AND type = ".((int) $catTypeID)." ORDER BY label";
$sql = "SELECT rowid, label FROM ".MAIN_DB_PREFIX."categorie WHERE entity = ".((int) $conf->entity)." AND type = ".((int) $catTypeID)." ORDER BY label";
$resql = $this->db->query($sql);
if ($resql) {

6
htdocs/compta/cashcontrol/class/cashcontrol.class.php
View file

@ -3,7 +3,7 @@
* Copyright (C) 2009 Regis Houssin <regis.houssin@capnetworks.com>
* Copyright (C) 2016 Marcos García <marcosgdf@gmail.com>
* Copyright (C) 2018 Andreu Bisquerra <jove@bisquerra.com>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -300,8 +300,8 @@ class CashControl extends CommonObject
$sql .= ", '".$this->db->idate(dol_now())."'";
$sql .= ", '".$this->db->escape($this->posmodule)."'";
$sql .= ", '".$this->db->escape($this->posnumber)."'";
$sql .= ", ".($this->day_close > 0 ? $this->day_close : "null");
$sql .= ", ".($this->month_close > 0 ? $this->month_close : "null");
$sql .= ", ".($this->day_close > 0 ? ((int) $this->day_close) : "null");
$sql .= ", ".($this->month_close > 0 ? ((int) $this->month_close) : "null");
$sql .= ", ".((int) $this->year_close);
$sql .= ", ".(isset($this->hour_close) ? (int) $this->hour_close : 23);
$sql .= ", ".(isset($this->min_close) ? (int) $this->min_close : 59);

10
htdocs/compta/prelevement/stats.php
View file

@ -4,7 +4,7 @@
* Copyright (C) 2005-2009 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2010-2011 Juanjo Menent <jmenent@2byte.es>
* Copyright (C) 2024-2026 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -91,7 +91,7 @@ print_barre_liste($title, 0, $_SERVER["PHP_SELF"], $param, '', '', $massactionbu
$sql = "SELECT sum(pb.amount) as amount, count(pb.amount) as nb";
//$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_lignes as pl";
$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_bons as pb";
$sql .= " WHERE pb.entity = ".$conf->entity;
$sql .= " WHERE pb.entity = ".((int) $conf->entity);
if ($type == 'bank-transfer') {
$sql .= " AND pb.type = 'bank-transfer'";
} else {
@ -127,7 +127,7 @@ $sql = "SELECT COUNT(pb.rowid) as nb, SUM(pb.amount) as amount, pb.statut as sta
//$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_lignes as pl";
$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_bons as pb";
//$sql .= " WHERE pl.fk_prelevement_bons = pb.rowid";
$sql .= " WHERE pb.entity = ".$conf->entity;
$sql .= " WHERE pb.entity = ".((int) $conf->entity);
if ($type == 'bank-transfer') {
$sql .= " AND pb.type = 'bank-transfer'";
} else {
@ -211,7 +211,7 @@ $sql = "SELECT sum(pl.amount), count(pl.amount)";
$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_lignes as pl";
$sql .= ", ".MAIN_DB_PREFIX."prelevement_bons as pb";
$sql .= " WHERE pl.fk_prelevement_bons = pb.rowid";
$sql .= " AND pb.entity = ".$conf->entity;
$sql .= " AND pb.entity = ".((int) $conf->entity);
$sql .= " AND pl.statut = 3";
if ($type == 'bank-transfer') {
$sql .= " AND pb.type = 'bank-transfer'";
@ -235,7 +235,7 @@ $sql .= " FROM ".MAIN_DB_PREFIX."prelevement_lignes as pl";
$sql .= ", ".MAIN_DB_PREFIX."prelevement_bons as pb";
$sql .= ", ".MAIN_DB_PREFIX."prelevement_rejet as pr";
$sql .= " WHERE pl.fk_prelevement_bons = pb.rowid";
$sql .= " AND pb.entity = ".$conf->entity;
$sql .= " AND pb.entity = ".((int) $conf->entity);
$sql .= " AND pl.statut = 3";
$sql .= " AND pr.fk_prelevement_lignes = pl.rowid";
if ($type == 'bank-transfer') {

6
htdocs/compta/sociales/class/cchargesociales.class.php
View file

@ -4,7 +4,7 @@
* Copyright (C) 2015 Florian Henry <florian.henry@open-concept.pro>
* Copyright (C) 2015 Raphaël Doursenaud <rdoursenaud@gpcsolutions.fr>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2026 Vincent de Grandpré <vincent@de-grandpre.quebec>
*
* This program is free software; you can redistribute it and/or modify
@ -153,10 +153,10 @@ class Cchargesociales
$sql .= 'accountancy_code';
$sql .= ') VALUES (';
$sql .= ' '.(!isset($this->libelle) ? 'NULL' : "'".$this->db->escape($this->libelle)."'").',';
$sql .= ' '.(!isset($this->deductible) ? 'NULL' : $this->deductible).',';
$sql .= ' '.(!isset($this->deductible) ? 'NULL' : "'".$this->db->escape($this->deductible)."'").',';
$sql .= ' ' . (int) $this->active . ',';
$sql .= ' '.(!isset($this->code) ? 'NULL' : "'".$this->db->escape($this->code)."'").',';
$sql .= ' '.(!isset($this->fk_pays) ? 'NULL' : $this->fk_pays).',';
$sql .= ' '.(!isset($this->fk_pays) ? 'NULL' : ((int) $this->fk_pays)).',';
$sql .= ' '.(!isset($this->module) ? 'NULL' : "'".$this->db->escape($this->module)."'").',';
$sql .= ' '.(!isset($this->accountancy_code) ? 'NULL' : "'".$this->db->escape($this->accountancy_code)."'");
$sql .= ')';

4
htdocs/compta/sociales/class/paymentsocialcontribution.class.php
View file

@ -232,10 +232,10 @@ class PaymentSocialContribution extends CommonObject
if ($totalamount != 0) {
$sql = "INSERT INTO ".MAIN_DB_PREFIX."paiementcharge (fk_charge, datec, datep, amount,";
$sql .= " fk_typepaiement, num_paiement, note, fk_user_creat, fk_bank)";
$sql .= " VALUES ($this->chid, '".$this->db->idate($now)."',";
$sql .= " VALUES (".((int) $this->chid).", '".$this->db->idate($now)."',";
$sql .= " '".$this->db->idate($this->datepaye)."',";
$sql .= " ".((float) $totalamount).",";
$sql .= " ".((int) $this->paiementtype).", '".$this->db->escape($this->num_payment)."', '".$this->db->escape($this->note)."', ".$user->id.",";
$sql .= " ".((int) $this->paiementtype).", '".$this->db->escape($this->num_payment)."', '".$this->db->escape($this->note)."', ".((int) $user->id).",";
$sql .= " 0)";
$resql = $this->db->query($sql);

2
htdocs/core/class/html.formbarcode.class.php
View file

@ -143,7 +143,7 @@ class FormBarCode
$sql = "SELECT rowid, code, libelle as label";
$sql .= " FROM ".$this->db->prefix()."c_barcode_type";
$sql .= " WHERE coder <> '0'";
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$sql .= " ORDER BY code";
$result = $this->db->query($sql);

10
htdocs/core/class/infobox.class.php
View file

@ -3,7 +3,7 @@
* Copyright (C) 2004-2012 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2012 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2019 Nicolas ZABOURI <info@inovea-conseil.com>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -105,12 +105,12 @@ class InfoBox
$sql .= " d.rowid as box_id, d.file, d.note, d.tms";
$sql .= " FROM ".$dbs->prefix()."boxes as b, ".$dbs->prefix()."boxes_def as d";
$sql .= " WHERE b.box_id = d.rowid";
$sql .= " AND b.entity IN (0,".$conf->entity.")";
$sql .= " AND b.entity IN (0,".((int) $conf->entity).")";
if ($zone >= 0) {
$sql .= " AND b.position = ".((int) $zone);
}
if (is_object($user)) {
$sql .= " AND b.fk_user IN (0,".$user->id.")";
$sql .= " AND b.fk_user IN (0,".((int) $user->id).")";
} else {
$sql .= " AND b.fk_user = 0";
}
@ -118,7 +118,7 @@ class InfoBox
} else { // available
$sql = "SELECT d.rowid as box_id, d.file, d.note, d.tms";
$sql .= " FROM ".$dbs->prefix()."boxes_def as d";
$sql .= " WHERE d.entity IN (0, ".$conf->entity.")";
$sql .= " WHERE d.entity IN (0, ".((int) $conf->entity).")";
}
dol_syslog(self::class."::listBoxes get default box list for mode=".$mode." userid=".(is_object($user) ? $user->id : ''), LOG_DEBUG);
@ -260,7 +260,7 @@ class InfoBox
// Delete all lines
$sql = "DELETE FROM ".$dbs->prefix()."boxes";
$sql .= " WHERE entity = ".$conf->entity;
$sql .= " WHERE entity = ".((int) $conf->entity);
$sql .= " AND fk_user = ".((int) $userid);
$sql .= " AND position = ".((int) $zone);

21
htdocs/core/modules/modFacture.class.php
View file

@ -7,6 +7,7 @@
* Copyright (C) 2021-2024 Alexandre Spangaro <alexandre@inovea-conseil.com>
* Copyright (C) 2022-2026 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 William Mead <william.mead@manchenumerique.fr>
* Copyright (C) 2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -274,7 +275,7 @@ class modFacture extends DolibarrModules
}
// Add extra fields
$import_extrafield_sample = array();
$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE elementtype = 'facture' AND entity IN (0, ".$conf->entity.")";
$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE elementtype = 'facture' AND entity IN (0, ".((int) $conf->entity).")";
$resql = $this->db->query($sql);
if ($resql) {
while ($obj = $this->db->fetch_object($resql)) {
@ -402,7 +403,7 @@ class modFacture extends DolibarrModules
}
// Add extra fields
$import_extrafield_sample = array();
$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE elementtype = 'facture_det' AND entity IN (0, ".$conf->entity.")";
$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE elementtype = 'facture_det' AND entity IN (0, ".((int) $conf->entity).")";
$resql = $this->db->query($sql);
if ($resql) {
while ($obj = $this->db->fetch_object($resql)) {
@ -466,7 +467,7 @@ class modFacture extends DolibarrModules
$this->import_updatekeys_array[$r] = array(
'fd.rowid' => 'Row Id',
'fd.fk_facture' => 'Invoice Id',
'fd.fk_product'=> 'ProductRef'
'fd.fk_product' => 'ProductRef'
);
$this->import_convertvalue_array[$r] = array(
'fd.fk_facture' => array(
@ -477,11 +478,11 @@ class modFacture extends DolibarrModules
'element' => 'facture'
),
'fd.fk_product' => array(
'rule'=>'fetchidfromref',
'classfile'=>'/product/class/product.class.php',
'class'=>'Product',
'method'=>'fetch',
'element'=>'Product'
'rule' => 'fetchidfromref',
'classfile' => '/product/class/product.class.php',
'class' => 'Product',
'method' => 'fetch',
'element' => 'Product'
),
'fd.fk_projet' => array(
'rule' => 'fetchidfromref',
@ -666,7 +667,7 @@ class modFacture extends DolibarrModules
$this->export_sql_end[$r] .= ' WHERE f.fk_soc = s.rowid AND f.rowid = fd.fk_facture';
$this->export_sql_end[$r] .= ' AND f.entity IN ('.getEntity('invoice').')';
if (!empty($user) && !$user->hasRight('societe', 'client', 'voir')) {
$this->export_sql_end[$r] .= ' AND sc.fk_user = '.(empty($user) ? 0 : $user->id);
$this->export_sql_end[$r] .= ' AND sc.fk_user = '.(empty($user) ? 0 : ((int) $user->id));
}
$r++;
@ -758,7 +759,7 @@ class modFacture extends DolibarrModules
$this->export_sql_end[$r] .= ' WHERE f.fk_soc = s.rowid';
$this->export_sql_end[$r] .= ' AND f.entity IN ('.getEntity('invoice').')';
if (!empty($user) && !$user->hasRight('societe', 'client', 'voir')) {
$this->export_sql_end[$r] .= ' AND sc.fk_user = '.(empty($user) ? 0 : $user->id);
$this->export_sql_end[$r] .= ' AND sc.fk_user = '.(empty($user) ? 0 : ((int) $user->id));
}
$r++;
}

18
htdocs/core/modules/modFournisseur.class.php
View file

@ -457,7 +457,7 @@ if (!getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD')) {
$this->export_sql_end[$r] .= ' WHERE f.fk_soc = s.rowid AND f.rowid = fd.fk_facture_fourn';
$this->export_sql_end[$r] .= ' AND f.entity IN (' . getEntity('supplier_invoice') . ')';
if (is_object($user) && !$user->hasRight('societe', 'client', 'voir')) {
$this->export_sql_end[$r] .= ' AND sc.fk_user = ' . ( (int) $user->id);
$this->export_sql_end[$r] .= ' AND sc.fk_user = ' . ((int) $user->id);
}
// Invoices and payments
@ -540,7 +540,7 @@ if (!getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD')) {
$this->export_sql_end[$r] .= ' WHERE f.fk_soc = s.rowid';
$this->export_sql_end[$r] .= ' AND f.entity IN (' . getEntity('supplier_invoice') . ')';
if (is_object($user) && !$user->hasRight('societe', 'client', 'voir')) {
$this->export_sql_end[$r] .= ' AND sc.fk_user = ' . ( (int) $user->id);
$this->export_sql_end[$r] .= ' AND sc.fk_user = ' . ((int) $user->id);
}
// Order
@ -620,7 +620,7 @@ if (!getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD')) {
$this->export_sql_end[$r] .= ' WHERE f.fk_soc = s.rowid AND f.rowid = fd.fk_commande';
$this->export_sql_end[$r] .= ' AND f.entity IN (' . getEntity('supplier_order') . ')';
if (is_object($user) && !$user->hasRight('societe', 'client', 'voir')) {
$this->export_sql_end[$r] .= ' AND sc.fk_user = ' . ( (int) $user->id);
$this->export_sql_end[$r] .= ' AND sc.fk_user = ' . ((int) $user->id);
}
//Import Supplier Invoice
@ -668,7 +668,7 @@ if (!getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD')) {
}
// Add extra fields
$import_extrafield_sample = array();
$sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE type <> 'separate' AND elementtype = 'facture_fourn' AND entity IN (0, " . $conf->entity . ")";
$sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE type <> 'separate' AND elementtype = 'facture_fourn' AND entity IN (0, " . ((int) $conf->entity) . ")";
$resql = $this->db->query($sql);
if ($resql) {
while ($obj = $this->db->fetch_object($resql)) {
@ -763,7 +763,7 @@ if (!getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD')) {
}
// Add extra fields
$import_extrafield_sample = array();
$sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE type <> 'separate' AND elementtype = 'facture_fourn_det' AND entity IN (0, " . $conf->entity . ")";
$sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE type <> 'separate' AND elementtype = 'facture_fourn_det' AND entity IN (0, " . ((int) $conf->entity) . ")";
$resql = $this->db->query($sql);
if ($resql) {
while ($obj = $this->db->fetch_object($resql)) {
@ -850,7 +850,7 @@ if (!getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD')) {
// Add extra fields
$import_extrafield_sample = array();
$sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE type <> 'separate' AND elementtype = 'commande_fournisseur' AND entity IN (0, " . $conf->entity . ")";
$sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE type <> 'separate' AND elementtype = 'commande_fournisseur' AND entity IN (0, " . ((int) $conf->entity) . ")";
$resql = $this->db->query($sql);
if ($resql) {
@ -932,7 +932,7 @@ if (!getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD')) {
}
// Add extra fields
$sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE type <> 'separate' AND elementtype = 'commande_fournisseurdet' AND entity IN (0, " . $conf->entity . ")";
$sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE type <> 'separate' AND elementtype = 'commande_fournisseurdet' AND entity IN (0, " . ((int) $conf->entity) . ")";
$resql = $this->db->query($sql);
if ($resql) {
while ($obj = $this->db->fetch_object($resql)) {
@ -995,8 +995,8 @@ if (!getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD')) {
}
$sql_order = array(
"DELETE FROM " . MAIN_DB_PREFIX . "document_model WHERE nom = '" . $this->db->escape($this->const[0][2]) . "' AND type = 'order_supplier' AND entity = " . ( (int) $conf->entity),
"INSERT INTO " . MAIN_DB_PREFIX . "document_model (nom, type, entity) VALUES('" . $this->db->escape($this->const[0][2]) . "', 'order_supplier', " . ( (int) $conf->entity) . ")",
"DELETE FROM " . MAIN_DB_PREFIX . "document_model WHERE nom = '" . $this->db->escape($this->const[0][2]) . "' AND type = 'order_supplier' AND entity = " . ((int) $conf->entity),
"INSERT INTO " . MAIN_DB_PREFIX . "document_model (nom, type, entity) VALUES('" . $this->db->escape($this->const[0][2]) . "', 'order_supplier', " . ((int) $conf->entity) . ")",
);
//ODT template for Supplier Invoice

12
htdocs/core/modules/modStock.class.php
View file

@ -4,7 +4,7 @@
* Copyright (C) 2005-2009 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2012 Juanjo Menent <jmenent@2byte.es>
* Copyright (C) 2021 Ferran Marcet <fmarcet@2byte.es>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -320,7 +320,7 @@ class modStock extends DolibarrModules
'e.rowid' => 'IdWarehouse', 'e.ref' => 'LocationSummary', 'e.description' => 'DescWareHouse', 'e.lieu' => 'LieuWareHouse', 'e.address' => 'Address', 'e.zip' => 'Zip', 'e.town' => 'Town',
'p.rowid' => "ProductId", 'p.ref' => "Ref", 'p.fk_product_type' => "Type", 'p.label' => "Label", 'p.description' => "Description", 'p.note' => "Note",
'p.price' => "Price", 'p.tva_tx' => 'VAT', 'p.tosell' => "OnSell", 'p.tobuy' => 'OnBuy', 'p.duration' => "Duration",
'p.datec' => 'DateCreation', 'p.tms' => 'DateModification', 'p.pmp' => 'PMPValue', 'p.cost_price' => 'CostPrice', 'lcpn.label'=>'Nature',
'p.datec' => 'DateCreation', 'p.tms' => 'DateModification', 'p.pmp' => 'PMPValue', 'p.cost_price' => 'CostPrice', 'lcpn.label' => 'Nature',
'pb.rowid' => 'Id', 'pb.batch' => 'Batch', 'pb.qty' => 'Qty',
'pl.eatby' => 'EatByDate', 'pl.sellby' => 'SellByDate', 'none.dateLastMovement' => 'LastMovement'
);
@ -331,7 +331,7 @@ class modStock extends DolibarrModules
'e.rowid' => 'List:entrepot:ref::stock', 'e.ref' => 'Text', 'e.lieu' => 'Text', 'e.description' => 'Text', 'e.address' => 'Text', 'e.zip' => 'Text', 'e.town' => 'Text',
'p.rowid' => "Numeric", 'p.ref' => "Text", 'p.fk_product_type' => "Text", 'p.label' => "Text", 'p.description' => "Text", 'p.note' => "Text",
'p.price' => "Numeric", 'p.tva_tx' => 'Numeric', 'p.tosell' => "Boolean", 'p.tobuy' => "Boolean", 'p.duration' => "Duree",
'p.datec' => 'Date', 'p.tms' => 'Date', 'p.pmp' => 'PMPValue', 'p.cost_price' => 'CostPrice', 'lcpn.label'=>'Text',
'p.datec' => 'Date', 'p.tms' => 'Date', 'p.pmp' => 'PMPValue', 'p.cost_price' => 'CostPrice', 'lcpn.label' => 'Text',
'pb.batch' => 'Text', 'pb.qty' => 'Numeric',
'pl.eatby' => 'Date', 'pl.sellby' => 'Date', 'none.dateLastMovement' => 'Date'
);
@ -341,12 +341,12 @@ class modStock extends DolibarrModules
$this->export_entities_array[$r] = array(
'p.rowid' => "product", 'p.ref' => "product", 'p.fk_product_type' => "product", 'p.label' => "product", 'p.description' => "product", 'p.note' => "product",
'p.price' => "product", 'p.tva_tx' => 'product', 'p.tosell' => "product", 'p.tobuy' => "product", 'p.duration' => "product",
'p.datec' => 'product', 'p.tms' => 'product', 'p.pmp' => 'product', 'p.cost_price' => 'product', 'lcpn.label'=>'product',
'p.datec' => 'product', 'p.tms' => 'product', 'p.pmp' => 'product', 'p.cost_price' => 'product', 'lcpn.label' => 'product',
'pb.rowid' => 'batch', 'pb.batch' => 'batch', 'pb.qty' => 'batch', 'none.dateLastMovement' => 'movement',
'pl.eatby' => 'batch', 'pl.sellby' => 'batch'
); // We define here only fields that use another icon that the one defined into export_icon
$this->export_special_array[$r] = array(
'none.dateLastMovement'=>array('rule'=>'compute', 'classfile'=>'/product/stock/class/mouvementstock.class.php', 'class'=>'MouvementStock', 'method'=>'getDateLastMovementProductBatch', 'method_params'=>['e_rowid', 'p_rowid', 'pb_batch']),
'none.dateLastMovement' => array('rule' => 'compute', 'classfile' => '/product/stock/class/mouvementstock.class.php', 'class' => 'MouvementStock', 'method' => 'getDateLastMovementProductBatch', 'method_params' => ['e_rowid', 'p_rowid', 'pb_batch']),
);
if (isModEnabled('barcode')) {
$this->export_entities_array[$r] = array_merge($this->export_entities_array[$r], array('p.barcode' => 'product'));
@ -502,7 +502,7 @@ class modStock extends DolibarrModules
$this->import_regex_array[$r] = array('e.statut' => '^[0|1]');
// Add extra fields
$import_extrafield_sample = [];
$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'entrepot' AND entity IN (0, ".$conf->entity.")";
$sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'entrepot' AND entity IN (0, ".((int) $conf->entity).")";
$resql = $this->db->query($sql);
if ($resql) { // This can fail when class is used on old database (during migration for example)
while ($obj = $this->db->fetch_object($resql)) {

6
htdocs/cron/list.php
View file

@ -3,7 +3,7 @@
* Copyright (C) 2013 Florian Henry <florian.henry@open-concept.pro>
* Copyright (C) 2013-2021 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2019-2024 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024 Alexandre Spangaro <alexandre@inovea-conseil.com>
*
* This program is free software; you can redistribute it and/or modify
@ -347,7 +347,7 @@ $sql .= " t.nbrun,";
$sql .= " t.libname,";
$sql .= " t.test";
$sql .= " FROM ".MAIN_DB_PREFIX."cronjob as t";
$sql .= " WHERE entity IN (0,".$conf->entity.")";
$sql .= " WHERE entity IN (0,".((int) $conf->entity).")";
if (!empty($TTestNotAllowed)) {
$sql .= ' AND t.rowid NOT IN ('.$db->sanitize(implode(',', $TTestNotAllowed)).')';
}
@ -888,7 +888,7 @@ if ($num > 0) {
if ($user->hasRight('cron', 'execute')) {
if (!empty($obj->status)) {
print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?id='.$obj->rowid.'&action=execute&token='.newToken();
print (!getDolGlobalString('CRON_KEY') ? '' : '&securitykey=' . getDolGlobalString('CRON_KEY'));
print(!getDolGlobalString('CRON_KEY') ? '' : '&securitykey=' . getDolGlobalString('CRON_KEY'));
print '&sortfield='.$sortfield;
print '&sortorder='.$sortorder;
print $param."\" title=\"".dol_escape_htmltag($langs->trans('CronExecute'))."\">".img_picto($langs->trans('CronExecute'), "play", '', 0, 0, 0, '', 'marginleftonly').'</a>';

14
htdocs/expedition/class/expeditionligne.class.php
View file

@ -13,7 +13,7 @@
* Copyright (C) 2018 Nicolas ZABOURI <info@inovea-conseil.com>
* Copyright (C) 2018-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2020 Lenin Rivas <lenin@leninrivas.com>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2025 Nick Fragoulis
*
* This program is free software; you can redistribute it and/or modify
@ -437,11 +437,11 @@ class ExpeditionLigne extends CommonObjectLine
$sql .= ", description";
$sql .= ", rang";
$sql .= ") VALUES (";
$sql .= $this->fk_expedition;
$sql .= ", ".(empty($this->entrepot_id) ? 'NULL' : $this->entrepot_id);
$sql .= ", ".(empty($this->fk_elementdet) ? 'NULL' : $this->fk_elementdet);
$sql .= ", ".(empty($this->fk_parent) ? 'NULL' : $this->fk_parent);
$sql .= ", ".(empty($this->fk_product) ? 'NULL' : $this->fk_product);
$sql .= ((int) $this->fk_expedition);
$sql .= ", ".(empty($this->entrepot_id) ? 'NULL' : ((int) $this->entrepot_id));
$sql .= ", ".(empty($this->fk_elementdet) ? 'NULL' : ((int) $this->fk_elementdet));
$sql .= ", ".(empty($this->fk_parent) ? 'NULL' : ((int) $this->fk_parent));
$sql .= ", ".(empty($this->fk_product) ? 'NULL' : ((int) $this->fk_product));
$sql .= ", '".(empty($this->element_type) ? 'order' : $this->db->escape($this->element_type))."'";
$sql .= ", ".price2num($this->qty, 'MS');
$sql .= ", ".((int) $this->fk_unit);
@ -817,7 +817,7 @@ class ExpeditionLigne extends CommonObjectLine
if (!$error) {
// update line
$sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET";
$sql .= " fk_entrepot = ".($this->entrepot_id > 0 ? $this->entrepot_id : 'null');
$sql .= " fk_entrepot = ".($this->entrepot_id > 0 ? ((int) $this->entrepot_id) : 'null');
$sql .= " , qty = ".((float) price2num($qty, 'MS'));
$sql .= " , fk_unit = ".((int) $this->fk_unit);
$sql .= " WHERE rowid = ".((int) $this->id);

4
htdocs/hrm/class/skill.class.php
View file

@ -641,14 +641,14 @@ class Skill extends CommonObject
if (preg_match('/^[\(]?PROV/i', $this->ref)) {
// Now we rename also files into index
$sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'skill/".$this->db->escape($this->newref)."'";
$sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'skill/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
$sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'skill/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;
$this->error = $this->db->lasterror();
}
$sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'skill/".$this->db->escape($this->newref)."'";
$sql .= " WHERE filepath = 'skill/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
$sql .= " WHERE filepath = 'skill/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;

8
htdocs/modulebuilder/template/core/modules/mymodule/mod_myobject_standard.php
View file

@ -97,14 +97,14 @@ class mod_myobject_standard extends ModeleNumRefMyObject
$max = '';
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(t.ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(t.ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".$db->prefix()."mymodule_myobject as t";
$sql .= " WHERE t.ref LIKE '".$db->escape($this->prefix)."____-%'";
if ($object->ismultientitymanaged == 1) {
$sql .= " AND t.entity = ".((int) $conf->entity);
} elseif (preg_match('/^\w+@\w+$/', (string) $object->ismultientitymanaged)) {
$tmparray = explode('@', (string) $object->ismultientitymanaged);
$sql .= " LEFT JOIN ".$db->prefix().$tmparray[1]." as pt ON t.".$db->sanitize($tmparray[0])." = pt.rowid";
$sql .= " LEFT JOIN ".$db->prefix().$db->sanitize($tmparray[1])." as pt ON t.".$db->sanitize($tmparray[0])." = pt.rowid";
$sql .= " WHERE pt.entity IN (".getEntity($object->element).")";
}
@ -137,14 +137,14 @@ class mod_myobject_standard extends ModeleNumRefMyObject
// first we get the max value
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(t.ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(t.ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".$db->prefix()."mymodule_myobject as t";
$sql .= " WHERE t.ref LIKE '".$db->escape($this->prefix)."____-%'";
if ($object->ismultientitymanaged == 1) {
$sql .= " AND t.entity = ".((int) $conf->entity);
} elseif (preg_match('/^\w+@\w+$/', (string) $object->ismultientitymanaged)) {
$tmparray = explode('@', (string) $object->ismultientitymanaged);
$sql .= " LEFT JOIN ".$db->prefix().$tmparray[1]." as pt ON t.".$db->sanitize($tmparray[0])." = pt.rowid";
$sql .= " LEFT JOIN ".$db->prefix().$db->sanitize($tmparray[1])." as pt ON t.".$db->sanitize($tmparray[0])." = pt.rowid";
$sql .= " WHERE pt.entity IN (".getEntity($object->element).")";
}

18
htdocs/product/class/productcustomerprice.class.php
View file

@ -360,7 +360,7 @@ class ProductCustomerPrice extends CommonObject
$sql .= " ".(empty($this->price_min_ttc) ? '0' : "'".$this->db->escape($this->price_min_ttc)."'").",";
$sql .= " ".(!isset($this->price_base_type) ? 'NULL' : "'".$this->db->escape($this->price_base_type)."'").",";
$sql .= " ".($this->default_vat_code ? "'".$this->db->escape($this->default_vat_code)."'" : "null").",";
$sql .= " ".(!isset($this->tva_tx) ? 'NULL' : (empty($this->tva_tx) ? 0 : $this->tva_tx)).",";
$sql .= " ".(!isset($this->tva_tx) ? 'NULL' : (empty($this->tva_tx) ? 0 : ((float) $this->tva_tx))).",";
$sql .= " ".(!isset($this->recuperableonly) ? 'NULL' : "'".$this->db->escape($this->recuperableonly)."'").",";
$sql .= " ".(empty($this->localtax1_type) ? "'0'" : "'".$this->db->escape($this->localtax1_type)."'").",";
$sql .= " ".(!isset($this->localtax1_tx) ? 'NULL' : (empty($this->localtax1_tx) ? "'0'" : "'".$this->db->escape($this->localtax1_tx)."'")).",";
@ -930,17 +930,17 @@ class ProductCustomerPrice extends CommonObject
$sql .= " entity=".((int) $conf->entity).",";
$sql .= " datec='".$this->db->idate($now)."',";
$sql .= " tms=".(dol_strlen((string) $this->tms) != 0 ? "'".$this->db->idate($this->tms)."'" : 'null').",";
$sql .= " fk_product=".(isset($this->fk_product) ? $this->fk_product : "null").",";
$sql .= " fk_soc=".(isset($this->fk_soc) ? $this->fk_soc : "null").",";
$sql .= " fk_product=".(isset($this->fk_product) ? ((int) $this->fk_product) : "null").",";
$sql .= " fk_soc=".(isset($this->fk_soc) ? ((int) $this->fk_soc) : "null").",";
$sql .= " ref_customer=".(isset($this->ref_customer) ? "'".$this->db->escape($this->ref_customer)."'" : "null").",";
$sql .= " price=".(isset($this->price) ? $this->price : "null").",";
$sql .= " price_ttc=".(isset($this->price_ttc) ? $this->price_ttc : "null").",";
$sql .= " price_min=".(isset($this->price_min) ? $this->price_min : "null").",";
$sql .= " price_min_ttc=".(isset($this->price_min_ttc) ? $this->price_min_ttc : "null").",";
$sql .= " price=".(isset($this->price) ? ((float) $this->price) : "null").",";
$sql .= " price_ttc=".(isset($this->price_ttc) ? ((float) $this->price_ttc) : "null").",";
$sql .= " price_min=".(isset($this->price_min) ? ((float) $this->price_min) : "null").",";
$sql .= " price_min_ttc=".(isset($this->price_min_ttc) ? ((float) $this->price_min_ttc) : "null").",";
$sql .= " price_base_type=".(isset($this->price_base_type) ? "'".$this->db->escape($this->price_base_type)."'" : "null").",";
$sql .= " default_vat_code = ".($this->default_vat_code ? "'".$this->db->escape($this->default_vat_code)."'" : "null").",";
$sql .= " tva_tx=".(isset($this->tva_tx) ? (empty($this->tva_tx) ? 0 : $this->tva_tx) : "null").",";
$sql .= " recuperableonly=".(isset($this->recuperableonly) ? $this->recuperableonly : "null").",";
$sql .= " tva_tx=".(isset($this->tva_tx) ? (empty($this->tva_tx) ? 0 : ((float) $this->tva_tx)) : "null").",";
$sql .= " recuperableonly=".(isset($this->recuperableonly) ? ((int) $this->recuperableonly) : "null").",";
$sql .= " localtax1_tx=".(isset($this->localtax1_tx) ? (empty($this->localtax1_tx) ? "'0'" : "'".$this->db->escape($this->localtax1_tx)."'") : "null").",";
$sql .= " localtax2_tx=".(isset($this->localtax2_tx) ? (empty($this->localtax2_tx) ? "'0'" : "'".$this->db->escape($this->localtax2_tx)."'") : "null").",";
$sql .= " localtax1_type=".(!empty($this->localtax1_type) ? "'".$this->db->escape($this->localtax1_type)."'" : "'0'").",";

4
htdocs/product/class/productfournisseurprice.class.php
View file

@ -613,14 +613,14 @@ class ProductFournisseurPrice extends CommonObject
if (preg_match('/^[\(]?PROV/i', $this->ref)) {
// Now we rename also files into index
$sql = 'UPDATE '.$this->db->prefix()."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'productfournisseurprice/".$this->db->escape($this->newref)."'";
$sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'productfournisseurprice/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
$sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'productfournisseurprice/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;
$this->error = $this->db->lasterror();
}
$sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'productfournisseurprice/".$this->db->escape($this->newref)."'";
$sql .= " WHERE filepath = 'productfournisseurprice/".$this->db->escape($this->ref)."' and entity = ".$conf->entity;
$sql .= " WHERE filepath = 'productfournisseurprice/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity);
$resql = $this->db->query($sql);
if (!$resql) {
$error++;

4
htdocs/product/inventory/inventory.php
View file

@ -1,7 +1,7 @@
<?php
/* Copyright (C) 2019 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2025-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -267,7 +267,7 @@ if (empty($reshook)) {
// is the accountancy-codes flag; using it to gate the pmp write here means we
// silently write into a row that fetch never looks at (#37773).
if (getDolGlobalString('MULTICOMPANY_PRODUCT_SHARING_ENABLED') && getDolGlobalString('MULTICOMPANY_PMP_PER_ENTITY_ENABLED')) {
$sqlpmp = 'UPDATE '.MAIN_DB_PREFIX.'product_perentity SET pmp = '.((float) $line->pmp_real).' WHERE fk_product = '.((int) $line->fk_product).' AND entity='.$conf->entity;
$sqlpmp = 'UPDATE '.MAIN_DB_PREFIX.'product_perentity SET pmp = '.((float) $line->pmp_real).' WHERE fk_product = '.((int) $line->fk_product).' AND entity='.((int) $conf->entity);
$resqlpmp = $db->query($sqlpmp);
if (! $resqlpmp) {
$error++;

13
htdocs/webportal/class/html.formlistwebportal.class.php
View file

@ -418,7 +418,7 @@ class FormListWebPortal
}
$field_spec = $this->object->fields[$key];
// @phpstan-ignore-next-line
$alias = $field_spec['alias'] ?? 't.';
$sanitized_alias = $field_spec['alias'] ?? 't.'; // @phan-suppress-current-line SqlInjection
$mode_search = (($this->object->isInt($field_spec) || $this->object->isFloat($field_spec)) ? 1 : 0);
if ((strpos($field_spec['type'], 'integer:') === 0) || (strpos($field_spec['type'], 'sellist:') === 0) || !empty($field_spec['arrayofkeyval'])) {
if ($val == "$this->emptyValueKey" || ($val === '0' && (empty($field_spec['arrayofkeyval']) || !array_key_exists('0', $field_spec['arrayofkeyval'])))) {
@ -435,11 +435,11 @@ class FormListWebPortal
// @phpstan-ignore-next-line
if (empty($field_spec['searchmulti'])) {
if (!is_array($val) && $val != '') {
$this->sql_body .= natural_search($alias . $this->db->escape($key), $val, (($key == 'status') ? 2 : $mode_search));
$this->sql_body .= natural_search($sanitized_alias . $this->db->escape($key), $val, (($key == 'status') ? 2 : $mode_search));
}
} else {
if (is_array($val) && !empty($val)) {
$this->sql_body .= natural_search($alias . $this->db->escape($key), implode(',', $val), (($key == 'status') ? 2 : $mode_search));
$this->sql_body .= natural_search($sanitized_alias . $this->db->escape($key), implode(',', $val), (($key == 'status') ? 2 : $mode_search));
}
}
} elseif (preg_match('/(_dtstart|_dtend)$/', $key) && $val != '') {
@ -447,13 +447,13 @@ class FormListWebPortal
if (array_key_exists($columnName, $this->object->fields)) {
$field_spec = $this->object->fields[$columnName];
// @phpstan-ignore-next-line
$alias = $field_spec['alias'] ?? 't.';
$sanitized_alias = $field_spec['alias'] ?? 't.'; // @phan-suppress-current-line SqlInjection
if (preg_match('/^(date|timestamp|datetime)/', $field_spec['type'])) {
if (preg_match('/_dtstart$/', $key)) {
$this->sql_body .= " AND " . $alias . $this->db->sanitize($columnName) . " >= '" . $this->db->idate((int) $val) . "'";
$this->sql_body .= " AND " . $sanitized_alias . $this->db->sanitize($columnName) . " >= '" . $this->db->idate((int) $val) . "'";
}
if (preg_match('/_dtend$/', $key)) {
$this->sql_body .= " AND " . $alias . $this->db->sanitize($columnName) . " <= '" . $this->db->idate((int) $val) . "'";
$this->sql_body .= " AND " . $sanitized_alias . $this->db->sanitize($columnName) . " <= '" . $this->db->idate((int) $val) . "'";
}
}
}
@ -475,6 +475,7 @@ class FormListWebPortal
}
$this->offset = $this->limit * ($this->page - 1);
// Supposed GETPOST(...,"az09comma") is sql protection for sortfield @phan-suppress-next-line SqlInjection
$this->sql_order = $this->db->order($this->sortfield, $this->sortorder);
$this->sql_order .= $sqlOrder;
// Add order by from hooks

4
htdocs/webservices/server_user.php
View file

@ -452,7 +452,7 @@ function getListOfGroups($authentication)
if (isModEnabled('multicompany') && $conf->entity == 1 && (getDolGlobalString('MULTICOMPANY_TRANSVERSE_MODE') || ($user->admin && !$user->entity))) {
$sql .= " WHERE g.entity IS NOT NULL";
} else {
$sql .= " WHERE g.entity IN (0,".$conf->entity.")";
$sql .= " WHERE g.entity IN (0,".((int) $conf->entity).")";
}
$sql .= " GROUP BY g.rowid, g.nom, g.entity, g.datec";
$resql = $db->query($sql);
@ -531,7 +531,7 @@ function createUserFromThirdparty($authentication, $thirdpartywithuser)
// If a contact / company already exists with the email, return the corresponding socid
$sql = "SELECT s.rowid as socid FROM ".MAIN_DB_PREFIX."societe as s";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."socpeople as sp ON sp.fk_soc = s.rowid";
$sql .= " WHERE s.entity=".$conf->entity;
$sql .= " WHERE s.entity=".((int) $conf->entity);
$sql .= " AND s.email='".$db->escape($thirdpartywithuser['email'])."'";
$sql .= " OR sp.email='".$db->escape($thirdpartywithuser['email'])."'";
$sql .= $db->plimit(1);