vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Qual: Fix 'SqlInjection' notices (#39231)

Browse source 
* Fix(ci): Add exceptions for 'mouvement' (codespell)

* Qual: Fix 'SqlInjection' notices

# Qual: Fix 'SqlInjection' notices

Batch of 25 files with changes to fix 'SqlInjection' Notices
This commit is contained in:
MDW 2026-07-20 15:28:15 +02:00 committed by GitHub
parent 63c88427f3
commit 21ae10b566
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
25 changed files with 111 additions and 108 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
htdocs/accountancy/expensereport/index.php
View file

@ -4,7 +4,7 @@
* Copyright (C) 2013-2024 Alexandre Spangaro <alexandre@inovea-conseil.com>
* Copyright (C) 2014 Juanjo Menent <jmenent@2byte.es>
* Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2025-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -233,7 +233,7 @@ for ($i = 1; $i <= 12; $i++) {
$param .= '&search_month='.$tmp['mon'].'&search_year='.$tmp['year'];
print '<a href="'.DOL_URL_ROOT.'/accountancy/expensereport/list.php?'.$param.'">';
}
print $langs->trans('MonthShort'.str_pad((string) $j, 2, '0', STR_PAD_LEFT));
print $langs->trans('MonthShort'.str_pad((string) ((int) $j), 2, '0', STR_PAD_LEFT));
if (!empty($tmp['mday'])) {
print '</a>';
}
@ -248,8 +248,8 @@ for ($i = 1; $i <= 12; $i++) {
if ($j > 12) {
$j -= 12;
}
$sql .= " SUM(".$db->ifsql("MONTH(er.date_debut) = ".((int) $j), "erd.total_ht", "0").") AS month".str_pad((string) $j, 2, "0", STR_PAD_LEFT).",";
$sql .= " SUM(".$db->ifsql("MONTH(er.date_debut) = ".((string) $j), "1", "0").") AS nbmonth".str_pad((string) $j, 2, "0", STR_PAD_LEFT).",";
$sql .= " SUM(".$db->ifsql("MONTH(er.date_debut) = ".((int) $j), "erd.total_ht", "0").") AS month".str_pad((string) ((int) $j), 2, "0", STR_PAD_LEFT).",";
$sql .= " SUM(".$db->ifsql("MONTH(er.date_debut) = ".((int) $j), "1", "0").") AS nbmonth".str_pad((string) ((int) $j), 2, "0", STR_PAD_LEFT).",";
}
$sql .= " SUM(erd.total_ht) as total, COUNT(erd.rowid) as nb";
$sql .= " FROM ".MAIN_DB_PREFIX."expensereport_det as erd";
@ -361,7 +361,7 @@ for ($i = 1; $i <= 12; $i++) {
$param .= '&search_date_endday='.$tmp['mday'].'&search_date_endmonth='.$tmp['mon'].'&search_date_endyear='.$tmp['year'];
print '<a href="'.DOL_URL_ROOT.'/accountancy/expensereport/lines.php?'.$param.'">';
}
print $langs->trans('MonthShort'.str_pad((string) $j, 2, '0', STR_PAD_LEFT));
print $langs->trans('MonthShort'.str_pad((string) ((int) $j), 2, '0', STR_PAD_LEFT));
if (!empty($tmp['mday'])) {
print '</a>';
}
@ -376,7 +376,7 @@ for ($i = 1; $i <= 12; $i++) {
if ($j > 12) {
$j -= 12;
}
$sql .= " SUM(".$db->ifsql("MONTH(er.date_debut) = ".((int) $j), "erd.total_ht", "0").") AS month".str_pad((string) $j, 2, "0", STR_PAD_LEFT).",";
$sql .= " SUM(".$db->ifsql("MONTH(er.date_debut) = ".((int) $j), "erd.total_ht", "0").") AS month".str_pad((string) ((int) $j), 2, "0", STR_PAD_LEFT).",";
}
$sql .= " ROUND(SUM(erd.total_ht),2) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."expensereport_det as erd";
@ -450,7 +450,7 @@ if (getDolGlobalString('SHOW_TOTAL_OF_PREVIOUS_LISTS_IN_LIN_PAGE')) { // This pa
if ($j > 12) {
$j -= 12;
}
print '<td width="60" class="right">'.$langs->trans('MonthShort'.str_pad((string) $j, 2, '0', STR_PAD_LEFT)).'</td>';
print '<td width="60" class="right">'.$langs->trans('MonthShort'.str_pad((string) ((int) $j), 2, '0', STR_PAD_LEFT)).'</td>';
}
print '<td width="60" class="right"><b>'.$langs->trans("Total").'</b></td></tr>';
@ -460,7 +460,7 @@ if (getDolGlobalString('SHOW_TOTAL_OF_PREVIOUS_LISTS_IN_LIN_PAGE')) { // This pa
if ($j > 12) {
$j -= 12;
}
$sql .= " SUM(".$db->ifsql("MONTH(er.date_create) = ".((int) $j), "erd.total_ht", "0").") AS month".str_pad((string) $j, 2, "0", STR_PAD_LEFT).",";
$sql .= " SUM(".$db->ifsql("MONTH(er.date_create) = ".((int) $j), "erd.total_ht", "0").") AS month".str_pad((string) ((int) $j), 2, "0", STR_PAD_LEFT).",";
}
$sql .= " SUM(erd.total_ht) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."expensereport_det as erd";

6
htdocs/admin/perms.php
View file

@ -3,7 +3,7 @@
* Copyright (C) 2004-2009 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2013 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2011 Herve Prot <herve.prot@symeos.com>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -58,14 +58,14 @@ if (!$user->admin) {
if ($action == 'add') {
$sql = "UPDATE ".MAIN_DB_PREFIX."rights_def SET bydefault=1";
$sql .= " WHERE id = ".GETPOSTINT("pid");
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$db->query($sql);
}
if ($action == 'remove') {
$sql = "UPDATE ".MAIN_DB_PREFIX."rights_def SET bydefault=0";
$sql .= " WHERE id = ".GETPOSTINT('pid');
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$db->query($sql);
}

6
htdocs/admin/system/constall.php
View file

@ -2,7 +2,7 @@
/* Copyright (C) 2003 Rodolphe Quiedeville <rodolphe@quiedeville.org>
* Copyright (C) 2004-2011 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2009 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -231,11 +231,11 @@ $sql .= ", entity";
$sql .= " FROM ".MAIN_DB_PREFIX."const";
if (!isModEnabled('multicompany')) {
// If no multicompany mode, admins can see global and their constantes
$sql .= " WHERE entity IN (0,".$conf->entity.")";
$sql .= " WHERE entity IN (0,".((int) $conf->entity).")";
} else {
// If multicompany mode, superadmin (user->entity=0) can see everything, admin are limited to their entities.
if ($user->entity) {
$sql .= " WHERE entity IN (".$db->sanitize($user->entity.",".$conf->entity).")";
$sql .= " WHERE entity IN (".$db->sanitize($user->entity.",".((int) $conf->entity)).")";
}
}
$sql .= " ORDER BY entity, name ASC";

10
htdocs/admin/system/dbtable.php
View file

@ -4,7 +4,7 @@
* Copyright (C) 2004 Sebastien Di Cintio <sdicintio@ressource-toi.org>
* Copyright (C) 2004 Benoit Mortier <benoit.mortier@opensides.be>
* Copyright (C) 2005-2012 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -67,7 +67,7 @@ if ($action == 'convertutf8') {
while ($i < $num) {
$row = $db->fetch_row($resql);
if ($row[0] == $field) {
$sql = "ALTER TABLE ".$db->sanitize($table)." MODIFY ".$db->sanitize($row[0])." ".$row[1]." CHARACTER SET utf8"; // We must not sanitize the $row[1]
$sql = "ALTER TABLE ".$db->sanitize($table)." MODIFY ".$db->sanitize($row[0])." ".$row[1]." CHARACTER SET utf8"; // We must not sanitize the $row[1] @phan-suppress-current-line SqlInjection
$logsql .= $sql.'<br>';
$db->query($sql);
@ -78,7 +78,7 @@ if ($action == 'convertutf8') {
$collation = 'utf8_general_ci';
}
$sql = "ALTER TABLE ".$db->sanitize($table)." MODIFY ".$db->sanitize($row[0])." ".$row[1]." COLLATE ".$db->sanitize($collation); // We must not sanitize the $row[1]
$sql = "ALTER TABLE ".$db->sanitize($table)." MODIFY ".$db->sanitize($row[0])." ".$row[1]." COLLATE ".$db->sanitize($collation); // We must not sanitize the $row[1] @phan-suppress-current-line SqlInjection
$logsql .= $sql.'<br>';
$resql2 = $db->query($sql);
@ -103,7 +103,7 @@ if ($action == 'convertutf8mb4') {
while ($i < $num) {
$row = $db->fetch_row($resql);
if ($row[0] == $field) {
$sql = "ALTER TABLE ".$db->sanitize($table)." MODIFY ".$db->sanitize($row[0])." ".$row[1]." CHARACTER SET utf8mb4"; // We must not sanitize the $row[1]
$sql = "ALTER TABLE ".$db->sanitize($table)." MODIFY ".$db->sanitize($row[0])." ".$row[1]." CHARACTER SET utf8mb4"; // We must not sanitize the $row[1] @phan-suppress-current-line SqlInjection
$logsql .= $sql.'<br>';
$db->query($sql);
@ -114,7 +114,7 @@ if ($action == 'convertutf8mb4') {
$collation = 'utf8mb4_general_ci';
}
$sql = "ALTER TABLE ".$db->sanitize($table)." MODIFY ".$db->sanitize($row[0])." ".$row[1]." COLLATE ".$db->sanitize($collation); // We must not sanitize the $row[1]
$sql = "ALTER TABLE ".$db->sanitize($table)." MODIFY ".$db->sanitize($row[0])." ".$row[1]." COLLATE ".$db->sanitize($collation); // We must not sanitize the $row[1] @phan-suppress-current-line SqlInjection
$logsql .= $sql.'<br>';
$resql2 = $db->query($sql);

17
htdocs/ai/tools/navigation.class.php
View file

@ -1,6 +1,7 @@
<?php
/* Copyright (C) 2026 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2026 Nick Fragoulis
* Copyright (C) 2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -134,25 +135,25 @@ class ToolNavigation extends McpTool
}
// Build Query Parameters
$queryParams = [];
$getQueryParams = [];
// Handle Action/ID logic
if ($id > 0) {
$queryParams['id'] = $id;
$getQueryParams['id'] = $id;
} elseif (!empty($ref)) {
$queryParams['ref'] = $ref;
$getQueryParams['ref'] = $ref;
}
// Set action for create view
if ($view === 'create') {
$queryParams['action'] = 'create';
$getQueryParams['action'] = 'create';
}
// Handle Status Filtering
if ($view === 'list' && !empty($statusFilter)) {
$statusParam = $this->mapStatusToFilter($elementType, $statusFilter);
if ($statusParam) {
$queryParams = array_merge($queryParams, $statusParam);
$getQueryParams = array_merge($getQueryParams, $statusParam);
} else {
return ["error" => "Unknown status filter '$statusFilter' for object type '$rawType'."];
}
@ -162,15 +163,15 @@ class ToolNavigation extends McpTool
// Merge extra params
if (!empty($params) && is_array($params)) {
$queryParams = array_merge($queryParams, $params);
$getQueryParams = array_merge($getQueryParams, $params);
}
// Generate Native URL
$baseUrl = dol_buildpath($relativePath, 1);
$finalUrl = $baseUrl;
if (!empty($queryParams)) {
$finalUrl .= '?' . http_build_query($queryParams);
if (!empty($getQueryParams)) {
$finalUrl .= '?' . http_build_query($getQueryParams);
}
return [

4
htdocs/compta/bank/budget.php
View file

@ -3,7 +3,7 @@
* Copyright (C) 2004-2010 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2009 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2015 Jean-François Ferry <jfefe@aternatik.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -74,7 +74,7 @@ $sql = "SELECT sum(d.amount) as somme, count(*) as nombre, c.label, c.rowid ";
$sql .= " FROM ".MAIN_DB_PREFIX."categorie as c";
$sql .= ", ".MAIN_DB_PREFIX."category_bankline as l";
$sql .= ", ".MAIN_DB_PREFIX."bank as d";
$sql .= " WHERE c.entity = ".$conf->entity;
$sql .= " WHERE c.entity = ".((int) $conf->entity);
$sql .= " AND c.rowid = l.fk_categ";
$sql .= " AND d.rowid = l.lineid";
$sql .= " GROUP BY c.label, c.rowid";

4
htdocs/compta/bank/categ.php
View file

@ -6,7 +6,7 @@
* Copyright (C) 2015 Jean-François Ferry <jfefe@aternatik.fr>
* Copyright (C) 2016 Marcos García <marcosgdf@gmail.com>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2025-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -144,7 +144,7 @@ $catTypeID = $cats->getMapId()[Categorie::TYPE_BANK_LINE];
$sql = "SELECT rowid, label";
$sql .= " FROM ".MAIN_DB_PREFIX."categorie";
$sql .= " WHERE entity = ".$conf->entity." AND type = " . ((int) $catTypeID);
$sql .= " WHERE entity = ".((int) $conf->entity)." AND type = " . ((int) $catTypeID);
$sql .= " ORDER BY rowid";
$result = $db->query($sql);

7
htdocs/compta/localtax/index.php
View file

@ -3,7 +3,7 @@
* Copyright (C) 2014 Ferran Marcet <fmarcet@2byte.es>
* Copyright (C) 2018 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2018-2024 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -444,6 +444,7 @@ while ((($y < $yend) || ($y == $yend && $m <= $mend)) && $mcursor < 1000) { // $
$action = "tva";
$object = array(&$x_coll, &$x_paye, &$x_both);
$parameters = array();
$parameters["mode"] = $modetax;
$parameters["year"] = $y;
$parameters["month"] = $m;
@ -581,7 +582,7 @@ $sql = '';
$sql .= "SELECT SUM(amount) as mm, date_format(f.datev,'%Y-%m') as dm, 'claimed' as mode";
$sql .= " FROM ".MAIN_DB_PREFIX."localtax as f";
$sql .= " WHERE f.entity = ".$conf->entity;
$sql .= " WHERE f.entity = ".((int) $conf->entity);
$sql .= " AND (f.datev >= '".$db->idate($date_start)."' AND f.datev <= '".$db->idate($date_end)."')";
$sql .= " AND localtaxtype=".((int) $localTaxType);
$sql .= " GROUP BY dm";
@ -590,7 +591,7 @@ $sql .= " UNION ";
$sql .= "SELECT SUM(amount) as mm, date_format(f.datep,'%Y-%m') as dm, 'paid' as mode";
$sql .= " FROM ".MAIN_DB_PREFIX."localtax as f";
$sql .= " WHERE f.entity = ".$conf->entity;
$sql .= " WHERE f.entity = ".((int) $conf->entity);
$sql .= " AND (f.datep >= '".$db->idate($date_start)."' AND f.datep <= '".$db->idate($date_end)."')";
$sql .= " AND localtaxtype=".((int) $localTaxType);
$sql .= " GROUP BY dm";

4
htdocs/compta/payment_sc/card.php
View file

@ -4,7 +4,7 @@
* Copyright (C) 2005 Marc Barilley / Ocebo <marc@ocebo.com>
* Copyright (C) 2005-2009 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2022 Alexandre Spangaro <aspangaro@open-dsi.fr>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -181,7 +181,7 @@ $disable_delete = 0;
$sql = 'SELECT f.rowid as scid, f.libelle as label, f.paye, f.amount as sc_amount, pf.amount, pc.libelle as sc_type';
$sql .= ' FROM '.MAIN_DB_PREFIX.'paiementcharge as pf,'.MAIN_DB_PREFIX.'chargesociales as f, '.MAIN_DB_PREFIX.'c_chargesociales as pc';
$sql .= ' WHERE pf.fk_charge = f.rowid AND f.fk_type = pc.id';
$sql .= ' AND f.entity = '.$conf->entity;
$sql .= ' AND f.entity = '.((int) $conf->entity);
$sql .= ' AND pf.rowid = '.((int) $object->id);
dol_syslog("compta/payment_sc/card.php", LOG_DEBUG);

4
htdocs/compta/payment_vat/card.php
View file

@ -4,7 +4,7 @@
* Copyright (C) 2005 Marc Barilley / Ocebo <marc@ocebo.com>
* Copyright (C) 2005-2009 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2021 Gauthier VERDOL <gauthier.verdol@atm-consulting.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -215,7 +215,7 @@ $disable_delete = 0;
$sql = 'SELECT f.rowid as scid, f.label as label, f.paye, f.amount as tva_amount, pf.amount';
$sql .= ' FROM '.MAIN_DB_PREFIX.'payment_vat as pf,'.MAIN_DB_PREFIX.'tva as f';
$sql .= ' WHERE pf.fk_tva = f.rowid';
$sql .= ' AND f.entity = '.$conf->entity;
$sql .= ' AND f.entity = '.((int) $conf->entity);
$sql .= ' AND pf.rowid = '.((int) $object->id);
dol_syslog("compta/payment_vat/card.php", LOG_DEBUG);

40
htdocs/compta/resultat/projects.php
View file

@ -450,17 +450,17 @@ if (isModEnabled('invoice') && ($modecompta == 'CREANCES-DETTES' || $modecompta
$sql .= " AND d.datedon <= '".$db->idate($date_end)."'";
}
$sql .= " GROUP BY p.rowid, p.ref";
$newsortfield = $sortfield;
if ($newsortfield == 's.nom, s.rowid') {
$newsortfield = 'p.ref';
$sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection
if ($sqlNewSortField == 's.nom, s.rowid') {
$sqlNewSortField = 'p.ref';
}
if ($newsortfield == 'amount_ht') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ht') {
$sqlNewSortField = 'amount';
}
if ($newsortfield == 'amount_ttc') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ttc') {
$sqlNewSortField = 'amount';
}
$sql .= $db->order($newsortfield, $sortorder);
$sql .= $db->order($sqlNewSortField, $sortorder);
dol_syslog("by project, get dunning");
$result = $db->query($sql);
@ -669,17 +669,17 @@ if (isModEnabled('invoice') && ($modecompta == 'CREANCES-DETTES' || $modecompta
$sql .= " GROUP BY rowid, project_ref";
$newsortfield = $sortfield;
if ($newsortfield == 's.nom, s.rowid') {
$newsortfield = 'project_ref';
$sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection
if ($sqlNewSortField == 's.nom, s.rowid') {
$sqlNewSortField = 'project_ref';
}
if ($newsortfield == 'amount_ht') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ht') {
$sqlNewSortField = 'amount';
}
if ($newsortfield == 'amount_ttc') {
$newsortfield = 'amount';
if ($sqlNewSortField == 'amount_ttc') {
$sqlNewSortField = 'amount';
}
$sql .= $db->order($newsortfield, $sortorder);
$sql .= $db->order($sqlNewSortField, $sortorder);
dol_syslog("by project, get salaries");
$result = $db->query($sql);
@ -775,11 +775,11 @@ if (isModEnabled('invoice') && ($modecompta == 'CREANCES-DETTES' || $modecompta
}
$sql .= " GROUP BY ed.rowid, ed.fk_projet, p.rowid, p.ref";
$newsortfield = $sortfield;
if ($newsortfield == 's.nom, s.rowid') {
$newsortfield = 'project_ref';
$sqlNewSortField = $sortfield; // @phan-suppress-current-line SqlInjection
if ($sqlNewSortField == 's.nom, s.rowid') {
$sqlNewSortField = 'project_ref';
}
$sql .= $db->order($newsortfield, $sortorder);
$sql .= $db->order($sqlNewSortField, $sortorder);
echo '<tr class="trforbreak"><td colspan="4">'.$langs->trans("ExpenseReport").'</td></tr>';

6
htdocs/compta/stats/byratecountry.php
View file

@ -2,7 +2,7 @@
/* Copyright (C) 2018 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2018-2026 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2022 Alexandre Spangaro <aspangaro@open-dsi.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -323,7 +323,7 @@ if ($modecompta == 'CREANCES-DETTES') {
$sql .= " fd.product_type AS product_type,";
$sql .= " cc.code, cc.label AS country,";
for ($i = 1; $i <= 12; $i++) {
$sql .= " SUM(".$db->ifsql("MONTH(f.datef)=".$i, "fd.total_ht", "0").") AS month".str_pad((string) $i, 2, "0", STR_PAD_LEFT).",";
$sql .= " SUM(".$db->ifsql("MONTH(f.datef)=".((int) $i), "fd.total_ht", "0").") AS month".str_pad((string) ((int) $i), 2, "0", STR_PAD_LEFT).",";
}
$sql .= " SUM(fd.total_ht) as total";
$sql .= " FROM ".MAIN_DB_PREFIX."facturedet as fd";
@ -410,7 +410,7 @@ if ($modecompta == 'CREANCES-DETTES') {
$sql2 .= " ffd.product_type AS product_type,";
$sql2 .= " cc.code, cc.label AS country,";
for ($i = 1; $i <= 12; $i++) {
$sql2 .= " SUM(".$db->ifsql("MONTH(ff.datef)=".$i, "ffd.total_ht", "0").") AS month".str_pad((string) $i, 2, "0", STR_PAD_LEFT).",";
$sql2 .= " SUM(".$db->ifsql("MONTH(ff.datef)=".((int) $i), "ffd.total_ht", "0").") AS month".str_pad((string) ((int) $i), 2, "0", STR_PAD_LEFT).",";
}
$sql2 .= " SUM(ffd.total_ht) as total";
$sql2 .= " FROM ".MAIN_DB_PREFIX."facture_fourn_det as ffd";

4
htdocs/compta/tva/class/paymentvat.class.php
View file

@ -3,7 +3,7 @@
* Copyright (C) 2004-2007 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2021 Gauthier VERDOL <gauthier.verdol@atm-consulting.fr>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -239,7 +239,7 @@ class PaymentVAT extends CommonObject
$sql .= " VALUES (".((int) $this->chid).", '".$this->db->idate($now)."',";
$sql .= " '".$this->db->idate($this->datepaye)."',";
$sql .= " ".((float) $totalamount).",";
$sql .= " ".((int) $this->paiementtype).", '".$this->db->escape($this->num_payment)."', '".$this->db->escape($this->note)."', ".$user->id.",";
$sql .= " ".((int) $this->paiementtype).", '".$this->db->escape($this->num_payment)."', '".$this->db->escape($this->note)."', ".((int) $user->id).",";
$sql .= " 0)";
$resql = $this->db->query($sql);

6
htdocs/core/class/cgenericdic.class.php
View file

@ -4,7 +4,7 @@
* Copyright (C) 2016 Florian Henry <florian.henry@atm-consulting.fr>
* Copyright (C) 2015 Raphaël Doursenaud <rdoursenaud@gpcsolutions.fr>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -110,7 +110,7 @@ class CGenericDic extends CommonDict
$sql .= ') VALUES (';
$sql .= ' '.(!isset($this->code) ? 'NULL' : "'".$this->db->escape($this->code)."'").',';
$sql .= ' '.(!isset($this->label) ? 'NULL' : "'".$this->db->escape($this->label)."'").',';
$sql .= ' '.(!isset($this->active) ? 'NULL' : $this->active);
$sql .= ' '.(!isset($this->active) ? 'NULL' : ((int) $this->active));
$sql .= ')';
$this->db->begin();
@ -345,7 +345,7 @@ class CGenericDic extends CommonDict
$sql = "UPDATE ".$this->db->prefix().$this->table_element.' SET';
$sql .= " code = ".(isset($this->code) ? "'".$this->db->escape($this->code)."'" : "null").',';
$sql .= " ".$this->db->sanitize($fieldlabel)." = ".(isset($this->label) ? "'".$this->db->escape($this->label)."'" : "null").',';
$sql .= " active = ".(isset($this->active) ? $this->active : "null");
$sql .= " active = ".(isset($this->active) ? ((int) $this->active) : "null");
$sql .= " WHERE ".$this->db->sanitize($fieldrowid)." = ".((int) $this->id);
$this->db->begin();

3
htdocs/core/class/html.formfiscalyear.class.php
View file

@ -1,5 +1,6 @@
<?php
/* Copyright (C) 2025 Alexandre Spangaro <alexandre@inovea-conseil.com>
* Copyright (C) 2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -65,7 +66,7 @@ class FormFiscalYear extends Form
$sql = "SELECT f.rowid, f.label, f.date_start, f.date_end, f.statut as status";
$sql .= " FROM ".$this->db->prefix()."accounting_fiscalyear as f";
$sql .= " WHERE f.entity = ".$conf->entity;
$sql .= " WHERE f.entity = ".((int) $conf->entity);
$sql .= " ORDER BY f.date_start ASC";
dol_syslog(get_class($this).'::'.__METHOD__, LOG_DEBUG);

4
htdocs/core/class/html.formintervention.class.php
View file

@ -1,6 +1,6 @@
<?php
/* Copyright (C) 2012-2013 Charles-Fr BENKE <charles.fr@benke.fr>
* Copyright (C) 2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2025-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2025 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -75,7 +75,7 @@ class FormIntervention
// Search all contacts
$sql = "SELECT f.rowid, f.ref, f.fk_soc, f.fk_statut as status";
$sql .= " FROM ".$this->db->prefix()."fichinter as f";
$sql .= " WHERE f.entity = ".$conf->entity;
$sql .= " WHERE f.entity = ".((int) $conf->entity);
if ($socid >= 0) {
if ($socid == '0') {
$sql .= " AND (f.fk_soc = 0 OR f.fk_soc IS NULL)";

4
htdocs/core/lib/sendings.lib.php
View file

@ -1,7 +1,7 @@
<?php
/* Copyright (C) 2008-2012 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2012 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2025 Frédéric France <frederic.france@free.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -335,7 +335,7 @@ function show_list_sending_receive($origin, $origin_id, $filter = '')
}
$sql .= " AND ed.fk_expedition = e.rowid";
if ($filter) {
$sql .= $filter;
$sql .= $filter; // @phan-suppress-current-line SqlInjection
}
$sql .= " ORDER BY obj.rowid, obj.fk_product";

6
htdocs/core/menus/standard/auguria.lib.php
View file

@ -1,7 +1,7 @@
<?php
/* Copyright (C) 2010-2022 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2010-2012 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2025 Alexandre Spangaro <alexandre@inovea-conseil.com>
*
@ -382,7 +382,7 @@ function print_left_auguria_menu($db, $menu_array_before, $menu_array_after, &$t
$sql = "SELECT rowid, label, courant, rappro, courant";
$sql .= " FROM ".MAIN_DB_PREFIX."bank_account";
$sql .= " WHERE entity = ".$conf->entity;
$sql .= " WHERE entity = ".((int) $conf->entity);
$sql .= " AND clos = 0";
$sql .= " ORDER BY label";
@ -415,7 +415,7 @@ function print_left_auguria_menu($db, $menu_array_before, $menu_array_after, &$t
// Multi journal
$sql = "SELECT rowid, code, label, nature";
$sql .= " FROM ".MAIN_DB_PREFIX."accounting_journal";
$sql .= " WHERE entity = ".$conf->entity;
$sql .= " WHERE entity = ".((int) $conf->entity);
if (getDolGlobalString('ACCOUNTING_MODE') == 'RECETTES-DEPENSES') {
$sql .= " AND nature = 4"; // only bank journal when using treasury accounting mode
}

10
htdocs/core/modules/asset/mod_asset_standard.php
View file

@ -2,7 +2,7 @@
/* Copyright (C) 2005-2010 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2009 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2022-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -93,11 +93,11 @@ class mod_asset_standard extends ModeleNumRefAsset
$max = '';
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."asset_asset";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
if ($object->ismultientitymanaged == 1) {
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
} elseif (!is_numeric($object->ismultientitymanaged)) {
// TODO
}
@ -132,11 +132,11 @@ class mod_asset_standard extends ModeleNumRefAsset
// first we get the max value
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."asset";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
if ($object->ismultientitymanaged == 1) {
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
} elseif (!is_numeric($object->ismultientitymanaged)) {
// TODO
}

10
htdocs/core/modules/bom/mod_bom_standard.php
View file

@ -2,7 +2,7 @@
/* Copyright (C) 2005-2010 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2009 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -92,10 +92,10 @@ class mod_bom_standard extends ModeleNumRefBoms
$max = '';
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."bom";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$resql = $db->query($sql);
if ($resql) {
@ -127,10 +127,10 @@ class mod_bom_standard extends ModeleNumRefBoms
// First we get the max value
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."bom_bom";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$resql = $db->query($sql);
if ($resql) {

8
htdocs/core/modules/cheque/mod_chequereceipt_mint.php
View file

@ -1,7 +1,7 @@
<?php
/* Copyright (C) 2015 Juanjo Menent <jmenent@2byte.es>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -89,10 +89,10 @@ class mod_chequereceipt_mint extends ModeleNumRefChequeReceipts
$max = '';
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."bordereau_cheque";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$resql = $db->query($sql);
if ($resql) {
@ -124,7 +124,7 @@ class mod_chequereceipt_mint extends ModeleNumRefChequeReceipts
// First, we get the max value
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."bordereau_cheque";
$sql .= " WHERE ref like '".$db->escape($this->prefix)."____-%'";
$sql .= " AND entity = ".((int) $conf->entity);

10
htdocs/core/modules/contract/mod_contract_serpis.php
View file

@ -1,7 +1,7 @@
<?php
/* Copyright (C) 2011 Juanjo Menent <jmenent@2byte.es>
* Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -87,10 +87,10 @@ class mod_contract_serpis extends ModelNumRefContracts
$max = '';
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."contrat";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$resql = $db->query($sql);
if ($resql) {
@ -121,10 +121,10 @@ class mod_contract_serpis extends ModelNumRefContracts
global $db, $conf;
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."contrat";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$resql = $db->query($sql);
if ($resql) {

10
htdocs/core/modules/delivery/mod_delivery_jade.php
View file

@ -3,7 +3,7 @@
* Copyright (C) 2004-2008 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2010 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -105,10 +105,10 @@ class mod_delivery_jade extends ModeleNumRefDeliveryOrder
$max = '';
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; // This is standard SQL
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max"; // This is standard SQL
$sql .= " FROM ".MAIN_DB_PREFIX."delivery";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$resql = $db->query($sql);
if ($resql) {
@ -140,10 +140,10 @@ class mod_delivery_jade extends ModeleNumRefDeliveryOrder
// First, we get the max value
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max"; // This is standard SQL
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max"; // This is standard SQL
$sql .= " FROM ".MAIN_DB_PREFIX."delivery";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$resql = $db->query($sql);
dol_syslog("mod_delivery_jade::getNextValue", LOG_DEBUG);

10
htdocs/core/modules/expedition/mod_expedition_safor.php
View file

@ -1,7 +1,7 @@
<?php
/* Copyright (C) 2011 Juanjo Menent <jmenent@2byte.es>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -97,10 +97,10 @@ class mod_expedition_safor extends ModelNumRefExpedition
$max = '';
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."expedition";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$resql = $db->query($sql);
if ($resql) {
@ -131,10 +131,10 @@ class mod_expedition_safor extends ModelNumRefExpedition
global $db, $conf;
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."expedition";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$resql = $db->query($sql);
if ($resql) {

10
htdocs/core/modules/expensereport/mod_expensereport_jade.php
View file

@ -1,7 +1,7 @@
<?php
/* Copyright (C) 2017 Maxime Kohlhaas <support@atm-consulting.fr>
* Copyright (C) 2024-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -98,10 +98,10 @@ class mod_expensereport_jade extends ModeleNumRefExpenseReport
$max = '';
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."expensereport";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$resql = $db->query($sql);
if ($resql) {
@ -183,10 +183,10 @@ class mod_expensereport_jade extends ModeleNumRefExpenseReport
// First we get the max value
$posindice = strlen($this->prefix) + 6;
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".$posindice.") AS SIGNED)) as max";
$sql = "SELECT MAX(CAST(SUBSTRING(ref FROM ".((int) $posindice).") AS SIGNED)) as max";
$sql .= " FROM ".MAIN_DB_PREFIX."expensereport";
$sql .= " WHERE ref LIKE '".$db->escape($this->prefix)."____-%'";
$sql .= " AND entity = ".$conf->entity;
$sql .= " AND entity = ".((int) $conf->entity);
$resql = $db->query($sql);
if ($resql) {