From 1dcd497c691ad7f00a0403dec109818c8f411d4a Mon Sep 17 00:00:00 2001 From: MDW Date: Mon, 20 Jul 2026 02:50:44 +0200 Subject: [PATCH] Qual: Fix 'SqlInjection' notices (#39219) # Qual: Fix 'SqlInjection' notices Batch of 25 files with changes to fix 'SqlInjection' Notices --- htdocs/accountancy/admin/journals_list.php | 8 +- htdocs/adherents/card.php | 4 +- htdocs/admin/system/dolibarr.php | 6 +- htdocs/bom/class/bom.class.php | 4 +- htdocs/commande/class/orderline.class.php | 12 +- htdocs/compta/resultat/clientfourn.php | 150 +++++++++--------- htdocs/contrat/class/contratligne.class.php | 14 +- htdocs/core/class/comment.class.php | 14 +- .../core/class/html.formaccounting.class.php | 2 +- htdocs/core/class/menubase.class.php | 6 +- htdocs/core/db/sqlite3.class.php | 10 +- htdocs/core/modules/modProduct.class.php | 16 +- htdocs/core/modules/modProjet.class.php | 4 +- htdocs/cron/class/cronjob.class.php | 8 +- htdocs/delivery/class/delivery.class.php | 8 +- htdocs/don/class/don.class.php | 14 +- htdocs/ecm/class/ecmfiles.class.php | 12 +- .../class/expensereport.class.php | 4 +- .../class/fournisseur.facture-rec.class.php | 6 +- htdocs/hrm/index.php | 8 +- .../partnership/class/partnership.class.php | 8 +- .../class/recruitmentjobposition.class.php | 6 +- htdocs/salaries/class/api_salaries.class.php | 2 +- htdocs/salaries/class/paymentsalary.class.php | 6 +- .../class/companybankaccount.class.php | 2 +- 25 files changed, 167 insertions(+), 167 deletions(-) diff --git a/htdocs/accountancy/admin/journals_list.php b/htdocs/accountancy/admin/journals_list.php index 1a8d8a2318c..4c9b0370b55 100644 --- a/htdocs/accountancy/admin/journals_list.php +++ b/htdocs/accountancy/admin/journals_list.php @@ -225,7 +225,7 @@ if (GETPOST('actionadd', 'alpha') || GETPOST('actionmodify', 'alpha')) { // List of values if ($tabrowid[$id] && !in_array($tabrowid[$id], $listfieldinsert)) { - $sql .= $newid.","; + $sql .= ((int) $newid).","; } $i = 0; foreach ($listfieldinsert as $f => $value) { @@ -239,7 +239,7 @@ if (GETPOST('actionadd', 'alpha') || GETPOST('actionmodify', 'alpha')) { } $i++; } - $sql .= ",1,".$conf->entity.")"; + $sql .= ",1,".((int) $conf->entity).")"; dol_syslog("actionadd", LOG_DEBUG); $result = $db->query($sql); @@ -326,7 +326,7 @@ if ($action == $acts[0]) { } elseif ($code) { $sql = "UPDATE ".$db->sanitize($tabname[$id])." SET active = 1 WHERE code = '".$db->escape($code)."'"; } - $sql .= " AND entity = ".$conf->entity; + $sql .= " AND entity = ".((int) $conf->entity); $result = $db->query($sql); if (!$result) { @@ -348,7 +348,7 @@ if ($action == $acts[1]) { } elseif ($code) { $sql = "UPDATE ".$db->sanitize($tabname[$id])." SET active = 0 WHERE code='".$db->escape($code)."'"; } - $sql .= " AND entity = ".$conf->entity; + $sql .= " AND entity = ".((int) $conf->entity); $result = $db->query($sql); if (!$result) { diff --git a/htdocs/adherents/card.php b/htdocs/adherents/card.php index 09750d5c2da..ce510e61a80 100644 --- a/htdocs/adherents/card.php +++ b/htdocs/adherents/card.php @@ -8,7 +8,7 @@ * Copyright (C) 2015-2024 Alexandre Spangaro * Copyright (C) 2018-2026 Frédéric France * Copyright (C) 2021 Waël Almoman - * Copyright (C) 2024-2025 MDW + * Copyright (C) 2024-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -206,7 +206,7 @@ if (empty($reshook)) { if ($socid != $object->socid) { // If link differs from currently in database $sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."adherent"; $sql .= " WHERE socid = ".((int) $socid); - $sql .= " AND entity = ".$conf->entity; + $sql .= " AND entity = ".((int) $conf->entity); $resql = $db->query($sql); if ($resql) { $obj = $db->fetch_object($resql); diff --git a/htdocs/admin/system/dolibarr.php b/htdocs/admin/system/dolibarr.php index 6aee101399f..463090c157f 100644 --- a/htdocs/admin/system/dolibarr.php +++ b/htdocs/admin/system/dolibarr.php @@ -2,7 +2,7 @@ /* Copyright (C) 2005-2020 Laurent Destailleur * Copyright (C) 2007 Rodolphe Quiedeville * Copyright (C) 2007-2012 Regis Houssin - * Copyright (C) 2024 MDW + * Copyright (C) 2024-2026 MDW * Copyright (C) 2024-2026 Frédéric France * * This program is free software; you can redistribute it and/or modify @@ -595,11 +595,11 @@ $sql .= ", entity"; $sql .= " FROM ".MAIN_DB_PREFIX."const"; if (!isModEnabled('multicompany')) { // If no multicompany mode, admins can see global and their constantes - $sql .= " WHERE entity IN (0,".$conf->entity.")"; + $sql .= " WHERE entity IN (0,".((int) $conf->entity).")"; } else { // If multicompany mode, superadmin (user->entity=0) can see everything, admin are limited to their entities. if ($user->entity) { - $sql .= " WHERE entity IN (".$db->sanitize($user->entity.",".$conf->entity).")"; + $sql .= " WHERE entity IN (".$db->sanitize($user->entity.",".((int) $conf->entity)).")"; } } $sql .= " ORDER BY entity, name ASC"; diff --git a/htdocs/bom/class/bom.class.php b/htdocs/bom/class/bom.class.php index f6c06d7b1c6..6f56a0d7192 100644 --- a/htdocs/bom/class/bom.class.php +++ b/htdocs/bom/class/bom.class.php @@ -983,14 +983,14 @@ class BOM extends CommonObject if (preg_match('/^[\(]?PROV/i', $this->ref)) { // Now we rename also files into index $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'bom/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'bom/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'bom/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; $this->error = $this->db->lasterror(); } $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'bom/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filepath = 'bom/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filepath = 'bom/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; diff --git a/htdocs/commande/class/orderline.class.php b/htdocs/commande/class/orderline.class.php index 8d9beccded9..99a113262d6 100644 --- a/htdocs/commande/class/orderline.class.php +++ b/htdocs/commande/class/orderline.class.php @@ -469,7 +469,7 @@ class OrderLine extends CommonOrderLine $sql .= ' fk_unit,'; $sql .= ' fk_multicurrency, multicurrency_code, multicurrency_subprice, multicurrency_total_ht, multicurrency_total_tva, multicurrency_total_ttc'; $sql .= ')'; - $sql .= " VALUES (".$this->fk_commande.","; + $sql .= " VALUES (".((int) $this->fk_commande).","; $sql .= " ".($this->fk_parent_line > 0 ? "'".$this->db->escape((string) $this->fk_parent_line)."'" : "null").","; $sql .= " ".(!empty($this->label) ? "'".$this->db->escape($this->label)."'" : "null").","; $sql .= " '".$this->db->escape($this->desc)."',"; @@ -481,15 +481,15 @@ class OrderLine extends CommonOrderLine $sql .= " '".price2num($this->localtax2_tx)."',"; $sql .= " '".$this->db->escape($this->localtax1_type)."',"; $sql .= " '".$this->db->escape($this->localtax2_type)."',"; - $sql .= ' '.((!empty($this->fk_product) && $this->fk_product > 0) ? $this->fk_product : "null").','; + $sql .= ' '.((!empty($this->fk_product) && $this->fk_product > 0) ? ((int) $this->fk_product) : "null").','; $sql .= " ".((int) $this->product_type).","; $sql .= " '".price2num($this->remise_percent)."',"; $sql .= " ".(price2num($this->subprice) !== '' ? price2num($this->subprice) : "null").","; $sql .= " ".($this->price != '' ? "'".price2num($this->price)."'" : "null").","; - $sql .= ' '.(!empty($this->fk_remise_except) ? $this->fk_remise_except : "null").','; + $sql .= ' '.(!empty($this->fk_remise_except) ? ((int) $this->fk_remise_except) : "null").','; $sql .= ' '.((int) $this->special_code).','; $sql .= ' '.((int) $this->rang).','; - $sql .= ' '.(!empty($this->fk_fournprice) ? $this->fk_fournprice : "null").','; + $sql .= ' '.(!empty($this->fk_fournprice) ? ((int) $this->fk_fournprice) : "null").','; $sql .= ' '.price2num($this->pa_ht).','; $sql .= " ".((int) $this->info_bits).","; $sql .= " ".price2num($this->total_ht, 'MT').","; @@ -653,14 +653,14 @@ class OrderLine extends CommonOrderLine $sql .= " , total_localtax1=".price2num($this->total_localtax1); $sql .= " , total_localtax2=".price2num($this->total_localtax2); } - $sql .= " , fk_product_fournisseur_price=".(!empty($this->fk_fournprice) ? $this->fk_fournprice : "null"); + $sql .= " , fk_product_fournisseur_price=".(!empty($this->fk_fournprice) ? ((int) $this->fk_fournprice) : "null"); $sql .= " , buy_price_ht='".price2num($this->pa_ht)."'"; $sql .= " , info_bits=".((int) $this->info_bits); $sql .= " , special_code=".((int) $this->special_code); $sql .= " , date_start=".(!empty($this->date_start) ? "'".$this->db->idate($this->date_start)."'" : "null"); $sql .= " , date_end=".(!empty($this->date_end) ? "'".$this->db->idate($this->date_end)."'" : "null"); $sql .= " , product_type = ".((int) $this->product_type); - $sql .= " , fk_parent_line=".(!empty($this->fk_parent_line) ? $this->fk_parent_line : "null"); + $sql .= " , fk_parent_line=".(!empty($this->fk_parent_line) ? ((int) $this->fk_parent_line) : "null"); if (!empty($this->rang)) { $sql .= ", rang=".((int) $this->rang); } diff --git a/htdocs/compta/resultat/clientfourn.php b/htdocs/compta/resultat/clientfourn.php index b8c58c9a15a..1a83fd5d5ca 100644 --- a/htdocs/compta/resultat/clientfourn.php +++ b/htdocs/compta/resultat/clientfourn.php @@ -317,7 +317,7 @@ if ($modecompta == 'BOOKKEEPING') { $sql .= " WHERE 1=1"; $sql .= " AND ".$sanitizedpredefinedgroupwhere; $sql .= " AND aa.fk_pcg_version = '".$db->escape($charofaccountstring)."'"; - $sql .= " AND f.entity = ".$conf->entity; + $sql .= " AND f.entity = ".((int) $conf->entity); if (!empty($date_start) && !empty($date_end)) { $sql .= " AND f.doc_date >= '".$db->idate($date_start)."'"; $sql .= " AND f.doc_date <= '".$db->idate($date_end)."'"; @@ -587,17 +587,17 @@ if ($modecompta == 'BOOKKEEPING') { } } $sql .= " GROUP BY p.societe, p.firstname, p.lastname, dm"; - $newsortfield = $sortfield; - if ($newsortfield == 's.nom, s.rowid') { - $newsortfield = 'p.societe, p.firstname, p.lastname, dm'; + $sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection + if ($sqlNewSortField == 's.nom, s.rowid') { + $sqlNewSortField = 'p.societe, p.firstname, p.lastname, dm'; } - if ($newsortfield == 'amount_ht') { - $newsortfield = 'amount'; + if ($sqlNewSortField == 'amount_ht') { + $sqlNewSortField = 'amount'; } - if ($newsortfield == 'amount_ttc') { - $newsortfield = 'amount'; + if ($sqlNewSortField == 'amount_ttc') { + $sqlNewSortField = 'amount'; } - $sql .= $db->order($newsortfield, $sortorder); + $sql .= $db->order($sqlNewSortField, $sortorder); dol_syslog("get dunning"); $result = $db->query($sql); @@ -777,20 +777,20 @@ if ($modecompta == 'BOOKKEEPING') { $sql .= " AND p.datep >= '".$db->idate($date_start)."' AND p.datep <= '".$db->idate($date_end)."'"; } } - $sql .= " AND cs.entity = ".$conf->entity; + $sql .= " AND cs.entity = ".((int) $conf->entity); $sql .= " GROUP BY c.libelle, c.id, c.accountancy_code"; - $newsortfield = $sortfield; - if ($newsortfield == 's.nom, s.rowid') { - $newsortfield = 'c.libelle, c.id'; + $sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection + if ($sqlNewSortField == 's.nom, s.rowid') { + $sqlNewSortField = 'c.libelle, c.id'; } - if ($newsortfield == 'amount_ht') { - $newsortfield = 'amount'; + if ($sqlNewSortField == 'amount_ht') { + $sqlNewSortField = 'amount'; } - if ($newsortfield == 'amount_ttc') { - $newsortfield = 'amount'; + if ($sqlNewSortField == 'amount_ttc') { + $sqlNewSortField = 'amount'; } - $sql .= $db->order($newsortfield, $sortorder); + $sql .= $db->order($sqlNewSortField, $sortorder); dol_syslog("get social contributions deductible=0", LOG_DEBUG); $result = $db->query($sql); @@ -868,7 +868,7 @@ if ($modecompta == 'BOOKKEEPING') { if (!empty($date_start) && !empty($date_end)) { $sql .= " AND cs.date_ech >= '".$db->idate($date_start)."' AND cs.date_ech <= '".$db->idate($date_end)."'"; } - $sql .= " AND cs.entity = ".$conf->entity; + $sql .= " AND cs.entity = ".((int) $conf->entity); } elseif ($modecompta == 'RECETTES-DEPENSES') { $sql = "SELECT c.id, c.libelle as label, c.accountancy_code, sum(p.amount) as amount"; $sql .= " FROM ".MAIN_DB_PREFIX."c_chargesociales as c"; @@ -880,20 +880,20 @@ if ($modecompta == 'BOOKKEEPING') { if (!empty($date_start) && !empty($date_end)) { $sql .= " AND p.datep >= '".$db->idate($date_start)."' AND p.datep <= '".$db->idate($date_end)."'"; } - $sql .= " AND cs.entity = ".$conf->entity; + $sql .= " AND cs.entity = ".((int) $conf->entity); } $sql .= " GROUP BY c.libelle, c.id, c.accountancy_code"; - $newsortfield = $sortfield; - if ($newsortfield == 's.nom, s.rowid') { - $newsortfield = 'c.libelle, c.id'; + $sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection + if ($sqlNewSortField == 's.nom, s.rowid') { + $sqlNewSortField = 'c.libelle, c.id'; } - if ($newsortfield == 'amount_ht') { - $newsortfield = 'amount'; + if ($sqlNewSortField == 'amount_ht') { + $sqlNewSortField = 'amount'; } - if ($newsortfield == 'amount_ttc') { - $newsortfield = 'amount'; + if ($sqlNewSortField == 'amount_ttc') { + $sqlNewSortField = 'amount'; } - $sql .= $db->order($newsortfield, $sortorder); + $sql .= $db->order($sqlNewSortField, $sortorder); dol_syslog("get social contributions deductible=1", LOG_DEBUG); $result = $db->query($sql); @@ -989,17 +989,17 @@ if ($modecompta == 'BOOKKEEPING') { $sql .= " GROUP BY u.rowid, u.firstname, u.lastname, s.fk_user, p.label, dm"; } - $newsortfield = $sortfield; - if ($newsortfield == 's.nom, s.rowid') { - $newsortfield = 'u.firstname, u.lastname'; + $sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection + if ($sqlNewSortField == 's.nom, s.rowid') { + $sqlNewSortField = 'u.firstname, u.lastname'; } - if ($newsortfield == 'amount_ht') { - $newsortfield = 'amount'; + if ($sqlNewSortField == 'amount_ht') { + $sqlNewSortField = 'amount'; } - if ($newsortfield == 'amount_ttc') { - $newsortfield = 'amount'; + if ($sqlNewSortField == 'amount_ttc') { + $sqlNewSortField = 'amount'; } - $sql .= $db->order($newsortfield, $sortorder); + $sql .= $db->order($sqlNewSortField, $sortorder); } dol_syslog("get salaries"); @@ -1095,11 +1095,11 @@ if ($modecompta == 'BOOKKEEPING') { } else { $sql .= " GROUP BY u.rowid, p.rowid, p.ref, u.firstname, u.lastname, dm"; } - $newsortfield = $sortfield; - if ($newsortfield == 's.nom, s.rowid') { - $newsortfield = 'p.ref'; + $sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection + if ($sqlNewSortField == 's.nom, s.rowid') { + $sqlNewSortField = 'p.ref'; } - $sql .= $db->order($newsortfield, $sortorder); + $sql .= $db->order($sqlNewSortField, $sortorder); } print ''.$langs->trans("ExpenseReport").''; @@ -1320,17 +1320,17 @@ if ($modecompta == 'BOOKKEEPING') { } $sql .= " AND f.entity IN (".getEntity('invoice').")"; $sql .= " GROUP BY dm"; - $newsortfield = $sortfield; - if ($newsortfield == 's.nom, s.rowid') { - $newsortfield = 'dm'; + $sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection + if ($sqlNewSortField == 's.nom, s.rowid') { + $sqlNewSortField = 'dm'; } - if ($newsortfield == 'amount_ht') { - $newsortfield = 'amount'; + if ($sqlNewSortField == 'amount_ht') { + $sqlNewSortField = 'amount'; } - if ($newsortfield == 'amount_ttc') { - $newsortfield = 'amount'; + if ($sqlNewSortField == 'amount_ttc') { + $sqlNewSortField = 'amount'; } - $sql .= $db->order($newsortfield, $sortorder); + $sql .= $db->order($sqlNewSortField, $sortorder); dol_syslog("get vat to pay", LOG_DEBUG); $result = $db->query($sql); @@ -1376,19 +1376,19 @@ if ($modecompta == 'BOOKKEEPING') { if (!empty($date_start) && !empty($date_end)) { $sql .= " AND f.datef >= '".$db->idate($date_start)."' AND f.datef <= '".$db->idate($date_end)."'"; } - $sql .= " AND f.entity = ".$conf->entity; + $sql .= " AND f.entity = ".((int) $conf->entity); $sql .= " GROUP BY dm"; - $newsortfield = $sortfield; - if ($newsortfield == 's.nom, s.rowid') { - $newsortfield = 'dm'; + $sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection + if ($sqlNewSortField == 's.nom, s.rowid') { + $sqlNewSortField = 'dm'; } - if ($newsortfield == 'amount_ht') { - $newsortfield = 'amount'; + if ($sqlNewSortField == 'amount_ht') { + $sqlNewSortField = 'amount'; } - if ($newsortfield == 'amount_ttc') { - $newsortfield = 'amount'; + if ($sqlNewSortField == 'amount_ttc') { + $sqlNewSortField = 'amount'; } - $sql .= $db->order($newsortfield, $sortorder); + $sql .= $db->order($sqlNewSortField, $sortorder); dol_syslog("get vat received back", LOG_DEBUG); $result = $db->query($sql); @@ -1430,19 +1430,19 @@ if ($modecompta == 'BOOKKEEPING') { if (!empty($date_start) && !empty($date_end)) { $sql .= " AND t.datev >= '".$db->idate($date_start)."' AND t.datev <= '".$db->idate($date_end)."'"; } - $sql .= " AND t.entity = ".$conf->entity; + $sql .= " AND t.entity = ".((int) $conf->entity); $sql .= " GROUP BY dm"; - $newsortfield = $sortfield; - if ($newsortfield == 's.nom, s.rowid') { - $newsortfield = 'dm'; + $sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection + if ($sqlNewSortField == 's.nom, s.rowid') { + $sqlNewSortField = 'dm'; } - if ($newsortfield == 'amount_ht') { - $newsortfield = 'amount'; + if ($sqlNewSortField == 'amount_ht') { + $sqlNewSortField = 'amount'; } - if ($newsortfield == 'amount_ttc') { - $newsortfield = 'amount'; + if ($sqlNewSortField == 'amount_ttc') { + $sqlNewSortField = 'amount'; } - $sql .= $db->order($newsortfield, $sortorder); + $sql .= $db->order($sqlNewSortField, $sortorder); dol_syslog("get vat really paid", LOG_DEBUG); $result = $db->query($sql); @@ -1485,19 +1485,19 @@ if ($modecompta == 'BOOKKEEPING') { if (!empty($date_start) && !empty($date_end)) { $sql .= " AND t.datev >= '".$db->idate($date_start)."' AND t.datev <= '".$db->idate($date_end)."'"; } - $sql .= " AND t.entity = ".$conf->entity; + $sql .= " AND t.entity = ".((int) $conf->entity); $sql .= " GROUP BY dm"; - $newsortfield = $sortfield; - if ($newsortfield == 's.nom, s.rowid') { - $newsortfield = 'dm'; + $sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection + if ($sqlNewSortField == 's.nom, s.rowid') { + $sqlNewSortField = 'dm'; } - if ($newsortfield == 'amount_ht') { - $newsortfield = 'amount'; + if ($sqlNewSortField == 'amount_ht') { + $sqlNewSortField = 'amount'; } - if ($newsortfield == 'amount_ttc') { - $newsortfield = 'amount'; + if ($sqlNewSortField == 'amount_ttc') { + $sqlNewSortField = 'amount'; } - $sql .= $db->order($newsortfield, $sortorder); + $sql .= $db->order($sqlNewSortField, $sortorder); dol_syslog("get vat really received back", LOG_DEBUG); $result = $db->query($sql); diff --git a/htdocs/contrat/class/contratligne.class.php b/htdocs/contrat/class/contratligne.class.php index 99c4404e0e0..61775afc4ac 100644 --- a/htdocs/contrat/class/contratligne.class.php +++ b/htdocs/contrat/class/contratligne.class.php @@ -691,19 +691,19 @@ class ContratLigne extends CommonObjectLine $sql .= " localtax2_tx = ".price2num($this->localtax2_tx).","; $sql .= " qty = ".price2num($this->qty).","; $sql .= " remise_percent = ".price2num($this->remise_percent).","; - $sql .= " fk_remise_except = ".($this->fk_remise_except > 0 ? $this->fk_remise_except : "null").","; - $sql .= " subprice = ".($this->subprice != '' ? $this->subprice : "null").","; + $sql .= " fk_remise_except = ".($this->fk_remise_except > 0 ? ((int) $this->fk_remise_except) : "null").","; + $sql .= " subprice = ".($this->subprice != '' ? ((float) $this->subprice) : "null").","; $sql .= " total_ht = ".((float) $this->total_ht).","; $sql .= " total_tva = ".((float) $this->total_tva).","; $sql .= " total_localtax1 = ".((float) $this->total_localtax1).","; $sql .= " total_localtax2 = ".((float) $this->total_localtax2).","; $sql .= " total_ttc = ".((float) $this->total_ttc).","; - $sql .= " fk_product_fournisseur_price = ".(!empty($this->fk_fournprice) ? $this->fk_fournprice : "NULL").","; + $sql .= " fk_product_fournisseur_price = ".(!empty($this->fk_fournprice) ? ((int) $this->fk_fournprice) : "NULL").","; $sql .= " buy_price_ht = '".price2num($this->pa_ht)."',"; $sql .= " info_bits = '".$this->db->escape((string) $this->info_bits)."',"; - $sql .= " fk_user_author = ".($this->fk_user_author >= 0 ? $this->fk_user_author : "NULL").","; - $sql .= " fk_user_ouverture = ".($this->fk_user_ouverture > 0 ? $this->fk_user_ouverture : "NULL").","; - $sql .= " fk_user_cloture = ".($this->fk_user_cloture > 0 ? $this->fk_user_cloture : "NULL").","; + $sql .= " fk_user_author = ".($this->fk_user_author >= 0 ? ((int) $this->fk_user_author) : "NULL").","; + $sql .= " fk_user_ouverture = ".($this->fk_user_ouverture > 0 ? ((int) $this->fk_user_ouverture) : "NULL").","; + $sql .= " fk_user_cloture = ".($this->fk_user_cloture > 0 ? ((int) $this->fk_user_cloture) : "NULL").","; $sql .= " commentaire = '".$this->db->escape($this->commentaire)."',"; $sql .= " fk_unit = ".(!$this->fk_unit ? 'NULL' : ((int) $this->fk_unit)).","; $sql .= " rang = ".(empty($this->rang) ? '0' : ((int) $this->rang)); @@ -834,7 +834,7 @@ class ContratLigne extends CommonObjectLine $sql .= ",date_fin_validite"; } $sql .= ") VALUES (".((int) $this->fk_contrat).", '', '".$this->db->escape($this->description)."',"; - $sql .= ($this->fk_product > 0 ? $this->fk_product : "null").","; + $sql .= ($this->fk_product > 0 ? ((int) $this->fk_product) : "null").","; $sql .= " '".$this->db->escape((string) $this->qty)."',"; $sql .= " '".$this->db->escape($this->vat_src_code)."',"; $sql .= " '".$this->db->escape($this->tva_tx)."',"; diff --git a/htdocs/core/class/comment.class.php b/htdocs/core/class/comment.class.php index 9bb732e0a42..116a118adcb 100644 --- a/htdocs/core/class/comment.class.php +++ b/htdocs/core/class/comment.class.php @@ -1,6 +1,6 @@ - * Copyright (C) 2024 MDW + * Copyright (C) 2024-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -114,11 +114,11 @@ class Comment extends CommonObject $sql .= ") VALUES ("; $sql .= "'".$this->db->escape($this->description)."'"; $sql .= ", ".($this->datec != '' ? "'".$this->db->idate($this->datec)."'" : 'null'); - $sql .= ", '".(isset($this->fk_element) ? $this->fk_element : "null")."'"; + $sql .= ", '".(isset($this->fk_element) ? ((int) $this->fk_element) : "null")."'"; $sql .= ", '".$this->db->escape($this->element_type)."'"; - $sql .= ", '".(isset($this->fk_user_author) ? $this->fk_user_author : "null")."'"; + $sql .= ", '".(isset($this->fk_user_author) ? ((int) $this->fk_user_author) : "null")."'"; $sql .= ", ".((int) $user->id); - $sql .= ", ".(!empty($this->entity) ? $this->entity : '1'); + $sql .= ", ".(!empty($this->entity) ? ((int) $this->entity) : '1'); $sql .= ", ".(!empty($this->import_key) ? "'".$this->db->escape($this->import_key)."'" : "null"); $sql .= ")"; @@ -246,10 +246,10 @@ class Comment extends CommonObject $sql = "UPDATE ".$this->db->prefix().$this->table_element." SET"; $sql .= " description = ".(isset($this->description) ? "'".$this->db->escape($this->description)."'" : "null").","; $sql .= " datec = ".($this->datec != '' ? "'".$this->db->idate($this->datec)."'" : 'null').","; - $sql .= " fk_element = ".(isset($this->fk_element) ? $this->fk_element : "null").","; + $sql .= " fk_element = ".(isset($this->fk_element) ? ((int) $this->fk_element) : "null").","; $sql .= " element_type = '".$this->db->escape($this->element_type)."',"; $sql .= " fk_user_modif = ".((int) $user->id).","; - $sql .= " entity = ".(!empty($this->entity) ? $this->entity : '1').","; + $sql .= " entity = ".(!empty($this->entity) ? ((int) $this->entity) : '1').","; $sql .= " import_key = ".(!empty($this->import_key) ? "'".$this->db->escape($this->import_key)."'" : "null"); $sql .= " WHERE rowid = ".((int) $this->id); @@ -358,7 +358,7 @@ class Comment extends CommonObject $sql .= " FROM ".$this->db->prefix().$this->table_element." as c"; $sql .= " WHERE c.fk_element = ".((int) $fk_element); $sql .= " AND c.element_type = '".$this->db->escape($element_type)."'"; - $sql .= " AND c.entity = ".$conf->entity; + $sql .= " AND c.entity = ".((int) $conf->entity); $sql .= " ORDER BY c.tms DESC"; dol_syslog(get_class($this).'::'.__METHOD__, LOG_DEBUG); diff --git a/htdocs/core/class/html.formaccounting.class.php b/htdocs/core/class/html.formaccounting.class.php index cb18ad826dc..5f110f6b68a 100644 --- a/htdocs/core/class/html.formaccounting.class.php +++ b/htdocs/core/class/html.formaccounting.class.php @@ -179,7 +179,7 @@ class FormAccounting extends Form $sql = "SELECT rowid, code, label, nature, entity, active"; $sql .= " FROM ".$this->db->prefix()."accounting_journal"; $sql .= " WHERE active = 1"; - $sql .= " AND entity = ".$conf->entity; + $sql .= " AND entity = ".((int) $conf->entity); if ($nature && is_numeric($nature)) { $sql .= " AND nature = ".((int) $nature); } diff --git a/htdocs/core/class/menubase.class.php b/htdocs/core/class/menubase.class.php index d1abc4af54d..065080d289e 100644 --- a/htdocs/core/class/menubase.class.php +++ b/htdocs/core/class/menubase.class.php @@ -230,7 +230,7 @@ class Menubase $maxrowid = 1; } - $sql = "SELECT setval('".$this->db->prefix()."menu_rowid_seq', ".($maxrowid).")"; + $sql = "SELECT setval('".$this->db->prefix()."menu_rowid_seq', ".((int) $maxrowid).")"; //print $sql; exit; $resqlrowidset = $this->db->query($sql); if (!$resqlrowidset) { @@ -248,7 +248,7 @@ class Menubase $sql .= " AND fk_menu = ".((int) $this->fk_menu); $sql .= " AND position = ".((int) $this->position); $sql .= " AND url = '".$this->db->escape($this->url)."'"; - $sql .= " AND entity IN (0, ".$conf->entity.")"; + $sql .= " AND entity IN (0, ".((int) $conf->entity).")"; $result = $this->db->query($sql); if ($result) { @@ -649,7 +649,7 @@ class Menubase $sql = "SELECT m.rowid, m.type, m.module, m.fk_menu, m.fk_mainmenu, m.fk_leftmenu, m.url, m.titre,"; $sql .= " m.prefix, m.langs, m.perms, m.enabled, m.target, m.mainmenu, m.leftmenu, m.position, m.showtopmenuinframe"; $sql .= " FROM ".$this->db->prefix()."menu as m"; - $sql .= " WHERE m.entity IN (0,".$conf->entity.")"; + $sql .= " WHERE m.entity IN (0,".((int) $conf->entity).")"; $sql .= " AND m.menu_handler IN ('".$this->db->escape($menu_handler)."','all')"; if ($type_user == 0) { $sql .= " AND m.usertype IN (0,2)"; diff --git a/htdocs/core/db/sqlite3.class.php b/htdocs/core/db/sqlite3.class.php index 1dd35471061..e119e67018e 100644 --- a/htdocs/core/db/sqlite3.class.php +++ b/htdocs/core/db/sqlite3.class.php @@ -887,7 +887,7 @@ class DoliDBSqlite3 extends DoliDB $sanitizedlike = "LIKE '".$this->escape($tmptable)."'"; } - $sanitizedtmpdatabase = preg_replace('/[^a-z0-9\.\-\_]/i', '', $database); + $sanitizedtmpdatabase = preg_replace('/[^a-z0-9\.\-\_]/i', '', $database); // @phan-suppress-current-line SqlInjection $sql = "SHOW TABLES FROM ".$sanitizedtmpdatabase." ".$sanitizedlike.";"; //print $sql; @@ -919,7 +919,7 @@ class DoliDBSqlite3 extends DoliDB $sanitizedlike = "LIKE '".$this->escape($tmptable)."'"; } - $sanitizedtmpdatabase = preg_replace('/[^a-z0-9\.\-\_]/i', '', $database); + $sanitizedtmpdatabase = preg_replace('/[^a-z0-9\.\-\_]/i', '', $database); // @phan-suppress-current-line SqlInjection $sql = "SHOW FULL TABLES FROM ".$sanitizedtmpdatabase." ".$sanitizedlike.";"; //print $sql; @@ -1223,7 +1223,7 @@ class DoliDBSqlite3 extends DoliDB // phpcs:enable $sql = "INSERT INTO user "; $sql .= "(Host,User,password,Select_priv,Insert_priv,Update_priv,Delete_priv,Create_priv,Drop_priv,Index_Priv,Alter_priv,Lock_tables_priv)"; - $sql .= " VALUES ('".$this->escape($dolibarr_main_db_host)."','".$this->escape($dolibarr_main_db_user)."',password('".addslashes($dolibarr_main_db_pass)."')"; + $sql .= " VALUES ('".$this->escape($dolibarr_main_db_host)."','".$this->escape($dolibarr_main_db_user)."',password('".$this->escape($dolibarr_main_db_pass)."')"; $sql .= ",'Y','Y','Y','Y','Y','Y','Y','Y','Y')"; dol_syslog(get_class($this)."::DDLCreateUser", LOG_DEBUG); // No sql to avoid password in log @@ -1234,7 +1234,7 @@ class DoliDBSqlite3 extends DoliDB $sql = "INSERT INTO db "; $sql .= "(Host,Db,User,Select_priv,Insert_priv,Update_priv,Delete_priv,Create_priv,Drop_priv,Index_Priv,Alter_priv,Lock_tables_priv)"; - $sql .= " VALUES ('".$this->escape($dolibarr_main_db_host)."','".$this->escape($dolibarr_main_db_name)."','".addslashes($dolibarr_main_db_user)."'"; + $sql .= " VALUES ('".$this->escape($dolibarr_main_db_host)."','".$this->escape($dolibarr_main_db_name)."','".$this->escape($dolibarr_main_db_user)."'"; $sql .= ",'Y','Y','Y','Y','Y','Y','Y','Y','Y')"; dol_syslog(get_class($this)."::DDLCreateUser", LOG_DEBUG); @@ -1371,7 +1371,7 @@ class DoliDBSqlite3 extends DoliDB // TODO prendre en compte le filtre foreach ($pragmas as $var) { - $sql = "PRAGMA $var"; + $sql = "PRAGMA $var"; // @phan-suppress-current-line SqlInjection $resql = $this->query($sql); if ($resql) { $obj = $this->fetch_row($resql); diff --git a/htdocs/core/modules/modProduct.class.php b/htdocs/core/modules/modProduct.class.php index 029eb4a16d9..73daea5dd65 100644 --- a/htdocs/core/modules/modProduct.class.php +++ b/htdocs/core/modules/modProduct.class.php @@ -8,7 +8,7 @@ * Copyright (C) 2014 Christophe Battarel * Copyright (C) 2014 Cedric Gross * Copyright (C) 2020-2021 Alexandre Spangaro - * Copyright (C) 2024 MDW + * Copyright (C) 2024-2026 MDW * Copyright (C) 2025-2026 Frédéric France * Copyright (C) 2025 Pierre Ardoin * @@ -147,7 +147,7 @@ class modProduct extends DolibarrModules $this->rights[$r][5] = 'read_supplier_prices'; $r++; - // EN: Advanced permission to write supplier prices + // EN: Advanced permission to write supplier prices $this->rights[$r][0] = 36; // id de la permission $this->rights[$r][1] = 'Write supplier prices'; // libelle de la permission $this->rights[$r][2] = 'w'; // type de la permission (deprecated) @@ -387,7 +387,7 @@ class modProduct extends DolibarrModules ); $this->export_sql_start[$r] = 'SELECT DISTINCT '; $this->export_sql_end[$r] = ' FROM '.MAIN_DB_PREFIX.'product as p'; - $this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product_price as pr ON p.rowid = pr.fk_product AND pr.entity = '.$conf->entity; // export prices only for the current entity + $this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product_price as pr ON p.rowid = pr.fk_product AND pr.entity = '.((int) $conf->entity); // export prices only for the current entity $this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product_price_extrafields as extra ON pr.rowid = extra.fk_object'; $this->export_sql_end[$r] .= ' WHERE p.entity IN ('.getEntity('product').')'; // For product and service profile $this->export_sql_end[$r] .= ' AND pr.date_price = (SELECT MAX(pr2.date_price) FROM '.MAIN_DB_PREFIX.'product_price as pr2 WHERE pr2.fk_product = pr.fk_product AND pr2.price_level = pr.price_level AND pr2.entity IN ('.getEntity('product').'))'; // export only latest prices not full history @@ -435,7 +435,7 @@ class modProduct extends DolibarrModules 'pr.datec' => "product"); $this->export_sql_start[$r] = 'SELECT DISTINCT '; $this->export_sql_end[$r] = ' FROM '.MAIN_DB_PREFIX.'product as p'; - $this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product_customer_price as pr ON p.rowid = pr.fk_product AND pr.entity = '.$conf->entity; // export prices only for the current entity + $this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'product_customer_price as pr ON p.rowid = pr.fk_product AND pr.entity = '.((int) $conf->entity); // export prices only for the current entity $this->export_sql_end[$r] .= ' LEFT JOIN '.MAIN_DB_PREFIX.'societe as s ON pr.fk_soc = s.rowid'; $this->export_sql_end[$r] .= ' WHERE p.entity IN ('.getEntity('product').')'; // For product and service profile } @@ -703,7 +703,7 @@ class modProduct extends DolibarrModules // Add extra fields $import_extrafield_sample = array(); - $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'product' AND entity IN (0, ".$conf->entity.")"; + $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'product' AND entity IN (0, ".((int) $conf->entity).")"; $resql = $this->db->query($sql); if ($resql) { // This can fail when class is used on old database (during migration for example) while ($obj = $this->db->fetch_object($resql)) { @@ -896,7 +896,7 @@ class modProduct extends DolibarrModules // Add extra fields $import_extrafield_sample = array(); - $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'product_fournisseur_price' AND entity IN (0, ".$conf->entity.")"; + $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'product_fournisseur_price' AND entity IN (0, ".((int) $conf->entity).")"; $resql = $this->db->query($sql); if ($resql) { // This can fail when class is used on old database (during migration for example) while ($obj = $this->db->fetch_object($resql)) { @@ -995,7 +995,7 @@ class modProduct extends DolibarrModules // Add extra fields $import_extrafield_sample = array(); - $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'product_price' AND entity IN (0, ".$conf->entity.")"; + $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'product_price' AND entity IN (0, ".((int) $conf->entity).")"; $resql = $this->db->query($sql); if ($resql) { // This can fail when class is used on old database (during migration for example) while ($obj = $this->db->fetch_object($resql)) { @@ -1065,7 +1065,7 @@ class modProduct extends DolibarrModules 'sp.tva_tx' => '20', 'sp.default_vat_code' => '5', 'sp.discount_percent' => '30', - 'sp.price_base_type'=> 'HT (for excl tax) or TTC (for inc tax)', + 'sp.price_base_type' => 'HT (for excl tax) or TTC (for inc tax)', 'sp.price' => "100", 'sp.price_min' => "80", 'sp.price_ttc' => "120", diff --git a/htdocs/core/modules/modProjet.class.php b/htdocs/core/modules/modProjet.class.php index e5b6797bfeb..07a765689bd 100644 --- a/htdocs/core/modules/modProjet.class.php +++ b/htdocs/core/modules/modProjet.class.php @@ -307,7 +307,7 @@ class modProjet extends DolibarrModules $this->import_fields_array[$r] = array('t.ref' => 'ProjectRef*', 't.title' => 'Label*', 't.description' => "Description", 't.fk_soc' => 'ThirdPartyName', 't.public' => "Public", 't.fk_statut' => "Status"); $this->import_fields_array[$r] = array_merge($this->import_fields_array[$r], array('t.fk_opp_status' => "OpportunityStatus", 't.opp_percent' => "OpportunityProbability", 't.opp_amount' => "OpportunityAmount", 't.note_public' => "NotePublic", 't.note_private' => "NotePrivate", 't.budget_amount' => "Budget", 't.dateo' => "DateStart", 't.datee' => "DateEnd", 't.usage_opportunity' => "UsageOpportunity", 't.usage_task' => 'UsageTasks', 't.usage_bill_time' => 'UsageBillTimeShort')); // Add extra fields - $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'projet' AND entity IN (0,".$conf->entity.")"; + $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'projet' AND entity IN (0,".((int) $conf->entity).")"; $resql = $this->db->query($sql); if ($resql) { // This can fail when class is used on old database (during migration for example) while ($obj = $this->db->fetch_object($resql)) { @@ -353,7 +353,7 @@ class modProjet extends DolibarrModules $this->import_tables_array[$r] = array('t' => MAIN_DB_PREFIX.'projet_task', 'extra' => MAIN_DB_PREFIX.'projet_task_extrafields'); // List of tables to insert into (insert done in same order) $this->import_fields_array[$r] = array('t.fk_projet' => 'ProjectRef*', 't.ref' => 'RefTask*', 't.label' => 'LabelTask*', 't.dateo' => "DateStart", 't.datee' => "DateEnd", 't.planned_workload' => "PlannedWorkload", 't.progress' => "Progress", 't.note_private' => "NotePrivate", 't.note_public' => "NotePublic", 't.datec' => "DateCreation"); // Add extra fields - $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'projet_task' AND entity IN (0,".$conf->entity.")"; + $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'projet_task' AND entity IN (0,".((int) $conf->entity).")"; $resql = $this->db->query($sql); if ($resql) { // This can fail when class is used on old database (during migration for example) while ($obj = $this->db->fetch_object($resql)) { diff --git a/htdocs/cron/class/cronjob.class.php b/htdocs/cron/class/cronjob.class.php index 227b1e14841..72c7a69802f 100644 --- a/htdocs/cron/class/cronjob.class.php +++ b/htdocs/cron/class/cronjob.class.php @@ -904,7 +904,7 @@ class Cronjob extends CommonObject // Update request $sql = "UPDATE ".MAIN_DB_PREFIX."cronjob SET"; - $sql .= " entity=".(isset($this->entity) ? ((int) $this->entity) : $conf->entity).","; + $sql .= " entity=".(isset($this->entity) ? ((int) $this->entity) : ((int) $conf->entity)).","; $sql .= " label=".(isset($this->label) ? "'".$this->db->escape($this->label)."'" : "null").","; $sql .= " jobtype=".(isset($this->jobtype) ? "'".$this->db->escape($this->jobtype)."'" : "null").","; $sql .= " command=".(isset($this->command) ? "'".$this->db->escape($this->command)."'" : "null").","; @@ -925,13 +925,13 @@ class Cronjob extends CommonObject $sql .= " unitfrequency=".(isset($this->unitfrequency) ? "'".$this->db->escape($this->unitfrequency)."'" : "null").","; $sql .= " frequency=".(isset($this->frequency) ? ((int) $this->frequency) : "null").","; $sql .= " status=".(isset($this->status) ? ((int) $this->status) : "null").","; - $sql .= " processing=".((isset($this->processing) && $this->processing > 0) ? $this->processing : "0").","; + $sql .= " processing=".((isset($this->processing) && $this->processing > 0) ? ((int) $this->processing) : "0").","; $sql .= " pid=".(isset($this->pid) ? ((int) $this->pid) : "null").","; $sql .= " email_alert = ".(isset($this->email_alert) ? "'".$this->db->escape($this->email_alert)."'" : "null").","; $sql .= " fk_user_mod = ".((int) $user->id).","; $sql .= " note=".(isset($this->note_private) ? "'".$this->db->escape($this->note_private)."'" : "null").","; - $sql .= " nbrun=".((isset($this->nbrun) && $this->nbrun > 0) ? $this->nbrun : "null").","; - $sql .= " maxrun=".((isset($this->maxrun) && $this->maxrun > 0) ? $this->maxrun : "0").","; + $sql .= " nbrun=".((isset($this->nbrun) && $this->nbrun > 0) ? ((int) $this->nbrun) : "null").","; + $sql .= " maxrun=".((isset($this->maxrun) && $this->maxrun > 0) ? ((int) $this->maxrun) : "0").","; $sql .= " libname=".(isset($this->libname) ? "'".$this->db->escape($this->libname)."'" : "null").","; $sql .= " test=".(isset($this->test) ? "'".$this->db->escape($this->test)."'" : "null"); $sql .= " WHERE rowid=".((int) $this->id); diff --git a/htdocs/delivery/class/delivery.class.php b/htdocs/delivery/class/delivery.class.php index d145d4d64d1..0872dc8f667 100644 --- a/htdocs/delivery/class/delivery.class.php +++ b/htdocs/delivery/class/delivery.class.php @@ -7,7 +7,7 @@ * Copyright (C) 2013 Florian Henry * Copyright (C) 2014-2015 Marcos García * Copyright (C) 2023-2025 Frédéric France - * Copyright (C) 2024-2025 MDW + * Copyright (C) 2024-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -193,7 +193,7 @@ class Delivery extends CommonObject $sql .= ", '".$this->db->idate($now)."'"; $sql .= ", ".((int) $user->id); $sql .= ", ".($this->date_delivery ? "'".$this->db->idate($this->date_delivery)."'" : "null"); - $sql .= ", ".($this->fk_delivery_address > 0 ? $this->fk_delivery_address : "null"); + $sql .= ", ".($this->fk_delivery_address > 0 ? ((int) $this->fk_delivery_address) : "null"); $sql .= ", ".(!empty($this->note_private) ? "'".$this->db->escape($this->note_private)."'" : "null"); $sql .= ", ".(!empty($this->note_public) ? "'".$this->db->escape($this->note_public)."'" : "null"); $sql .= ", ".(!empty($this->model_pdf) ? "'".$this->db->escape($this->model_pdf)."'" : "null"); @@ -293,7 +293,7 @@ class Delivery extends CommonObject $sql = "INSERT INTO ".MAIN_DB_PREFIX."deliverydet (fk_delivery, fk_origin_line,"; $sql .= " fk_product, description, qty)"; - $sql .= " VALUES (".$this->id.",".((int) $origin_id).","; + $sql .= " VALUES (".((int) $this->id).",".((int) $origin_id).","; $sql .= " ".($fk_product > 0 ? ((int) $fk_product) : "null").","; $sql .= " ".($description ? "'".$this->db->escape($description)."'" : "null").","; $sql .= (price2num($qty, 'MS')).")"; @@ -501,7 +501,7 @@ class Delivery extends CommonObject $this->error = $this->db->lasterror(); } $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'expedition/receipt/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filepath = 'expedition/receipt/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filepath = 'expedition/receipt/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; diff --git a/htdocs/don/class/don.class.php b/htdocs/don/class/don.class.php index 04a9d99637a..72e65f7fc01 100644 --- a/htdocs/don/class/don.class.php +++ b/htdocs/don/class/don.class.php @@ -8,7 +8,7 @@ * Copyright (C) 2019 Thibault FOUCART * Copyright (C) 2019-2025 Frédéric France * Copyright (C) 2021 Maxime DEMAREST - * Copyright (C) 2024-2025 MDW + * Copyright (C) 2024-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -258,7 +258,7 @@ class Don extends CommonObject $sql = "SELECT rowid"; $sql .= " FROM ".MAIN_DB_PREFIX."societe"; $sql .= " WHERE client IN (1, 3)"; - $sql .= " AND entity = ".$conf->entity; + $sql .= " AND entity = ".((int) $conf->entity); $sql .= " LIMIT 10"; $resql = $this->db->query($sql); @@ -436,8 +436,8 @@ class Don extends CommonObject $sql .= "'".$this->db->idate($this->date ? $this->date : $now)."'"; $sql .= ", ".((int) $conf->entity); $sql .= ", ".((float) $this->amount); - $sql .= ", ".($this->modepaymentid ? $this->modepaymentid : "null"); - $sql .= ", ".($this->socid > 0 ? $this->socid : "null"); + $sql .= ", ".($this->modepaymentid ? ((int) $this->modepaymentid) : "null"); + $sql .= ", ".($this->socid > 0 ? ((int) $this->socid) : "null"); $sql .= ", '".$this->db->escape($this->firstname)."'"; $sql .= ", '".$this->db->escape($this->lastname)."'"; $sql .= ", '".$this->db->escape($this->societe)."'"; @@ -529,7 +529,7 @@ class Don extends CommonObject $sql = "UPDATE ".MAIN_DB_PREFIX."don SET"; $sql .= " amount = ".((float) $this->amount); - $sql .= ", fk_payment = ".($this->modepaymentid ? $this->modepaymentid : "null"); + $sql .= ", fk_payment = ".($this->modepaymentid ? ((int) $this->modepaymentid) : "null"); $sql .= ", firstname = '".$this->db->escape($this->firstname)."'"; $sql .= ", lastname='".$this->db->escape($this->lastname)."'"; $sql .= ", societe='".$this->db->escape($this->societe)."'"; @@ -538,7 +538,7 @@ class Don extends CommonObject $sql .= ", town='".$this->db->escape($this->town)."'"; $sql .= ", fk_country = ".($this->country_id > 0 ? ((int) $this->country_id) : '0'); $sql .= ", public=".((int) $this->public); - $sql .= ", fk_projet=".($this->fk_project > 0 ? $this->fk_project : 'null'); + $sql .= ", fk_projet=".($this->fk_project > 0 ? ((int) $this->fk_project) : 'null'); $sql .= ", note_private=".(!empty($this->note_private) ? ("'".$this->db->escape($this->note_private)."'") : "NULL"); $sql .= ", note_public=".(!empty($this->note_public) ? ("'".$this->db->escape($this->note_public)."'") : "NULL"); $sql .= ", datedon='".$this->db->idate($this->date)."'"; @@ -904,7 +904,7 @@ class Don extends CommonObject $sql = "SELECT sum(amount) as total"; $sql .= " FROM ".MAIN_DB_PREFIX."don"; $sql .= " WHERE fk_statut = ".((int) $param); - $sql .= " AND entity = ".$conf->entity; + $sql .= " AND entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if ($resql) { diff --git a/htdocs/ecm/class/ecmfiles.class.php b/htdocs/ecm/class/ecmfiles.class.php index 3dbfc6f401e..9ea289f7db6 100644 --- a/htdocs/ecm/class/ecmfiles.class.php +++ b/htdocs/ecm/class/ecmfiles.class.php @@ -464,7 +464,7 @@ class EcmFiles extends CommonObject if (isset($entity)) { $sql .= " AND t.entity = " . (int) $entity; } else { - $sql .= " AND t.entity = " . $conf->entity; // unique key include the entity so each company has its own index + $sql .= " AND t.entity = " . ((int) $conf->entity); // unique key include the entity so each company has its own index } $filterfound++; } @@ -473,7 +473,7 @@ class EcmFiles extends CommonObject if (isset($entity)) { $sql .= " AND t.entity = " . (int) $entity; } else { - $sql .= " AND t.entity = " . $conf->entity; // unique key include the entity so each company has its own index + $sql .= " AND t.entity = " . ((int) $conf->entity); // unique key include the entity so each company has its own index } $filterfound++; } @@ -482,7 +482,7 @@ class EcmFiles extends CommonObject if (isset($entity)) { $sql .= " AND t.entity = " . (int) $entity; } else { - $sql .= " AND t.entity = " . $conf->entity; // unique key include the entity so each company has its own index + $sql .= " AND t.entity = " . ((int) $conf->entity); // unique key include the entity so each company has its own index } $filterfound++; } @@ -492,7 +492,7 @@ class EcmFiles extends CommonObject } else { $sql .= " AND t.share IS NOT NULL AND t.share <> ''"; } - //$sql .= " AND t.entity = ".$conf->entity; // hashforshare already unique + //$sql .= " AND t.entity = ".((int) $conf->entity); // hashforshare already unique $filterfound++; } if ($src_object_type && $src_object_id) { @@ -500,7 +500,7 @@ class EcmFiles extends CommonObject if (isset($entity)) { $sql .= " AND t.entity = " . (int) $entity; } else { - $sql .= " AND t.entity = " . $conf->entity; // unique key include the entity so each company has its own index + $sql .= " AND t.entity = " . ((int) $conf->entity); // unique key include the entity so each company has its own index } $filterfound++; } @@ -769,7 +769,7 @@ class EcmFiles extends CommonObject $sql .= " ref = '".$this->db->escape(dol_hash($this->filepath."/".$this->filename, '3'))."',"; $sql .= ' label = '.(isset($this->label) ? "'".$this->db->escape($this->label)."'" : "null").','; $sql .= ' share = '.(!empty($this->share) ? "'".$this->db->escape($this->share)."'" : "null").','; - $sql .= ' entity = '.(isset($this->entity) ? $this->entity : $conf->entity).','; + $sql .= ' entity = '.(isset($this->entity) ? ((int) $this->entity) : ((int) $conf->entity)).','; $sql .= ' filename = '.(isset($this->filename) ? "'".$this->db->escape($this->filename)."'" : "null").','; $sql .= ' filepath = '.(isset($this->filepath) ? "'".$this->db->escape($this->filepath)."'" : "null").','; $sql .= ' fullpath_orig = '.(isset($this->fullpath_orig) ? "'".$this->db->escape($this->fullpath_orig)."'" : "null").','; diff --git a/htdocs/expensereport/class/expensereport.class.php b/htdocs/expensereport/class/expensereport.class.php index 011c2e65b94..71bf9db3192 100644 --- a/htdocs/expensereport/class/expensereport.class.php +++ b/htdocs/expensereport/class/expensereport.class.php @@ -921,7 +921,7 @@ class ExpenseReport extends CommonObject $sql .= " f.fk_user_approve"; $sql .= " FROM ".MAIN_DB_PREFIX."expensereport as f"; $sql .= " WHERE f.rowid = ".((int) $id); - $sql .= " AND f.entity = ".$conf->entity; + $sql .= " AND f.entity = ".((int) $conf->entity); @@ -1405,7 +1405,7 @@ class ExpenseReport extends CommonObject $this->error = $this->db->lasterror(); } $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'expensereport/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filepath = 'expensereport/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filepath = 'expensereport/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; diff --git a/htdocs/fourn/class/fournisseur.facture-rec.class.php b/htdocs/fourn/class/fournisseur.facture-rec.class.php index dffcd6ad9cd..5f08e5deb3b 100644 --- a/htdocs/fourn/class/fournisseur.facture-rec.class.php +++ b/htdocs/fourn/class/fournisseur.facture-rec.class.php @@ -913,10 +913,10 @@ class FactureFournisseurRec extends CommonInvoice $error = 0; $this->db->begin(); - $main = MAIN_DB_PREFIX.'facture_fourn_det_rec'; - $ef = $main."_extrafields"; + $sql_main_table = MAIN_DB_PREFIX.'facture_fourn_det_rec'; + $sql_ef_table = $sql_main_table."_extrafields"; - $sqlef = "DELETE FROM ".$ef." WHERE fk_object IN (SELECT rowid FROM ".$main." WHERE fk_facture_fourn = ". (int) $rowid .")"; + $sqlef = "DELETE FROM ".$sql_ef_table." WHERE fk_object IN (SELECT rowid FROM ".$sql_main_table." WHERE fk_facture_fourn = ". (int) $rowid .")"; $sql = "DELETE FROM ".MAIN_DB_PREFIX."facture_fourn_det_rec WHERE fk_facture_fourn = ". (int) $rowid; if ($this->db->query($sqlef) && $this->db->query($sql)) { diff --git a/htdocs/hrm/index.php b/htdocs/hrm/index.php index 3610006d5a4..a5c25b4a751 100644 --- a/htdocs/hrm/index.php +++ b/htdocs/hrm/index.php @@ -5,7 +5,7 @@ * Copyright (C) 2015-2016 Alexandre Spangaro * Copyright (C) 2019 Nicolas ZABOURI * Copyright (C) 2021-2026 Frédéric France - * Copyright (C) 2024 MDW + * Copyright (C) 2024-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -204,7 +204,7 @@ if (isModEnabled('holiday') && $user->hasRight('holiday', 'read')) { $sql .= " x.rowid, x.ref, x.fk_type, x.date_debut as date_start, x.date_fin as date_end, x.halfday, x.tms as dm, x.statut as status"; $sql .= " FROM ".MAIN_DB_PREFIX."holiday as x, ".MAIN_DB_PREFIX."user as u"; $sql .= " WHERE u.rowid = x.fk_user"; - $sql .= " AND x.entity = ".$conf->entity; + $sql .= " AND x.entity = ".((int) $conf->entity); if (!$user->hasRight('holiday', 'readall')) { $sql .= ' AND x.fk_user IN ('.$db->sanitize(implode(',', $childids)).')'; } @@ -310,7 +310,7 @@ if (isModEnabled('expensereport') && $user->hasRight('expensereport', 'read')) { $sql .= " FROM ".MAIN_DB_PREFIX."expensereport as x, ".MAIN_DB_PREFIX."user as u"; //if (empty($user->rights->societe->client->voir) && !$user->socid) $sql.= ", ".MAIN_DB_PREFIX."societe as s, ".MAIN_DB_PREFIX."societe_commerciaux as sc"; $sql .= " WHERE u.rowid = x.fk_user_author"; - $sql .= " AND x.entity = ".$conf->entity; + $sql .= " AND x.entity = ".((int) $conf->entity); if (!$user->hasRight('expensereport', 'readall') && !$user->hasRight('expensereport', 'lire_tous')) { $sql .= ' AND x.fk_user_author IN ('.$db->sanitize(implode(',', $childids)).')'; } @@ -400,7 +400,7 @@ if (isModEnabled('recruitment') && $user->hasRight('recruitment', 'recruitmentjo $sql .= " AND rp.fk_soc = sc.fk_soc AND sc.fk_user = ".((int) $user->id); } if ($socid) { - $sql .= " AND rp.fk_soc = $socid"; + $sql .= " AND rp.fk_soc = ".((int) $socid); } $sql .= $db->order("rc.tms", "DESC"); $sql .= $db->plimit($max, 0); diff --git a/htdocs/partnership/class/partnership.class.php b/htdocs/partnership/class/partnership.class.php index 2d78d08f747..d4ad300267a 100644 --- a/htdocs/partnership/class/partnership.class.php +++ b/htdocs/partnership/class/partnership.class.php @@ -710,14 +710,14 @@ class Partnership extends CommonObject if (preg_match('/^[\(]?PROV/i', $this->ref)) { // Now we rename also files into index $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'partnership/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'partnership/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'partnership/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; $this->error = $this->db->lasterror(); } $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'partnership/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filepath = 'partnership/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filepath = 'partnership/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; @@ -836,14 +836,14 @@ class Partnership extends CommonObject if (preg_match('/^[\(]?PROV/i', $this->ref)) { // Now we rename also files into index $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'partnership/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'partnership/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'partnership/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; $this->error = $this->db->lasterror(); } $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'partnership/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filepath = 'partnership/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filepath = 'partnership/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; diff --git a/htdocs/recruitment/class/recruitmentjobposition.class.php b/htdocs/recruitment/class/recruitmentjobposition.class.php index a5e0c47a6c5..c89197d0550 100644 --- a/htdocs/recruitment/class/recruitmentjobposition.class.php +++ b/htdocs/recruitment/class/recruitmentjobposition.class.php @@ -596,14 +596,14 @@ class RecruitmentJobPosition extends CommonObject if (preg_match('/^[\(]?PROV/i', $this->ref)) { // Now we rename also files into index $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'recruitmentjobposition/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'recruitmentjobposition/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'recruitmentjobposition/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; $this->error = $this->db->lasterror(); } $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'recruitmentjobposition/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filepath = 'recruitmentjobposition/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filepath = 'recruitmentjobposition/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; @@ -720,7 +720,7 @@ class RecruitmentJobPosition extends CommonObject $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element; $sql .= " SET status = ".((int) $status).", note_private = '".$this->db->escape($newprivatenote)."'"; - //$sql .= ", date_cloture='".$this->db->idate($now)."', fk_user_cloture=".$user->id; + //$sql .= ", date_cloture='".$this->db->idate($now)."', fk_user_cloture=".((int) $user->id); $sql .= " WHERE rowid = ".((int) $this->id); $resql = $this->db->query($sql); diff --git a/htdocs/salaries/class/api_salaries.class.php b/htdocs/salaries/class/api_salaries.class.php index 1526801db27..3ed68a36e95 100644 --- a/htdocs/salaries/class/api_salaries.class.php +++ b/htdocs/salaries/class/api_salaries.class.php @@ -1,7 +1,7 @@ - * Copyright (C) 2025 MDW + * Copyright (C) 2025-2026 MDW * Copyright (C) 2025-2026 Frédéric France * * This program is free software; you can redistribute it and/or modify diff --git a/htdocs/salaries/class/paymentsalary.class.php b/htdocs/salaries/class/paymentsalary.class.php index 595c3b08454..aef427d18c2 100644 --- a/htdocs/salaries/class/paymentsalary.class.php +++ b/htdocs/salaries/class/paymentsalary.class.php @@ -432,12 +432,12 @@ class PaymentSalary extends CommonObject // Update request $sql = "UPDATE ".MAIN_DB_PREFIX."payment_salary SET"; - $sql .= " fk_salary=".(isset($this->fk_salary) ? $this->fk_salary : "null").","; + $sql .= " fk_salary=".(isset($this->fk_salary) ? ((int) $this->fk_salary) : "null").","; $sql .= " datec=".(dol_strlen($this->datec) != 0 ? "'".$this->db->idate($this->datec)."'" : 'null').","; $sql .= " tms=".(dol_strlen((string) $this->tms) != 0 ? "'".$this->db->idate($this->tms)."'" : 'null').","; $sql .= " datep=".(dol_strlen($this->datepaye) != 0 ? "'".$this->db->idate($this->datepaye)."'" : 'null').","; - $sql .= " amount=".(isset($this->amount) ? $this->amount : "null").","; - $sql .= " fk_typepayment=".(isset($this->fk_typepayment) ? $this->fk_typepayment : "null").","; + $sql .= " amount=".(isset($this->amount) ? ((float) $this->amount) : "null").","; + $sql .= " fk_typepayment=".(isset($this->fk_typepayment) ? ((int) $this->fk_typepayment) : "null").","; $sql .= " num_payment=".(isset($this->num_payment) ? "'".$this->db->escape($this->num_payment)."'" : "null").","; $sql .= " note=".(isset($this->note) ? "'".$this->db->escape($this->note)."'" : "null").","; $sql .= " fk_bank=".(isset($this->fk_bank) ? ((int) $this->fk_bank) : "null").","; diff --git a/htdocs/societe/class/companybankaccount.class.php b/htdocs/societe/class/companybankaccount.class.php index c9b0a64ae84..48686ef2394 100644 --- a/htdocs/societe/class/companybankaccount.class.php +++ b/htdocs/societe/class/companybankaccount.class.php @@ -693,7 +693,7 @@ class CompanyBankAccount extends Account public function setAsDefault($rib = 0, $resetolddefaultfor = 'ban') { $sql1 = "SELECT rowid as id, fk_soc as socid FROM ".MAIN_DB_PREFIX."societe_rib"; - $sql1 .= " WHERE rowid = ".((int) ($rib ? $rib : $this->id)); + $sql1 .= " WHERE rowid = ".((int) ($rib ? $rib : ((int) $this->id))); dol_syslog(get_class($this).'::setAsDefault', LOG_DEBUG); $result1 = $this->db->query($sql1);