vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix bad sanitization in advanced mailing target - Reported by Davide

Browse source 
Saladino
This commit is contained in:
Laurent Destailleur 2026-07-24 07:13:00 +02:00
parent bba7fe32d8
commit 7660df047a
3 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
htdocs/comm/mailing/advtargetemailing.php
View file

@ -203,7 +203,7 @@ if ($action == 'add' && $permissiontoadd) { // Add recipients
}
if (preg_match("/^contact_/", $key)) {
$array_query[$key] = GETPOST($key);
$array_query[$key] = GETPOSTISARRAY($key) ? GETPOST($key, 'array:int') : GETPOST($key);
$specials_date_key = array(
'contact_update_st_dt',
@ -232,7 +232,7 @@ if ($action == 'add' && $permissiontoadd) { // Add recipients
}
if (preg_match("/^type_of_target/", $key)) {
$array_query[$key] = GETPOST($key);
$array_query[$key] = GETPOSTINT($key);
}
}

2
htdocs/comm/mailing/class/advtargetemailing.class.php
View file

@ -764,7 +764,7 @@ class AdvanceTargetingMailing extends CommonObject
$sqlwhere[] = " (t.datec >= '".$this->db->idate($arrayquery['contact_create_st_dt'])."' AND t.datec <= '".$this->db->idate($arrayquery['contact_create_end_dt'])."')";
}
if (!empty($arrayquery['contact_categ']) && count($arrayquery['contact_categ']) > 0) {
$sqlwhere[] = " (contactcateg.fk_categorie IN (".$this->db->escape(implode(",", $arrayquery['contact_categ']))."))";
$sqlwhere[] = " (contactcateg.fk_categorie IN (".$this->db->sanitize(implode(",", $arrayquery['contact_categ']), 0, 0, 0, 0)."))";
}
//Standard Extrafield feature

2
htdocs/core/lib/functions.lib.php
View file

@ -1302,7 +1302,7 @@ function GETPOST($paramname, $check = 'alphanohtml', $method = 0, $filter = null
}
// Check type of variable and make sanitization according to this
if (preg_match('/^array/', $check)) { // If 'array' or 'array:restricthtml' or 'array:aZ09' or 'array:intcomma'
if (preg_match('/^array/', $check)) { // If 'array' or 'array:restricthtml' or 'array:aZ09' or 'array:int'
$tmpcheck = 'alphanohtml';
if ($out === null || $out === '') {
$out = array();