diff --git a/htdocs/accountancy/admin/categories_list.php b/htdocs/accountancy/admin/categories_list.php index 848ccc1f0f6..85c19429c0f 100644 --- a/htdocs/accountancy/admin/categories_list.php +++ b/htdocs/accountancy/admin/categories_list.php @@ -261,7 +261,7 @@ if (GETPOST('actionadd', 'alpha') || GETPOST('actionmodify', 'alpha')) { // List of values if ($tabrowid[$id] && !in_array($tabrowid[$id], $listfieldinsert)) { - $sql .= $newid.","; + $sql .= ((int) $newid).","; } $i = 0; foreach ($listfieldinsert as $f => $value) { diff --git a/htdocs/admin/website.php b/htdocs/admin/website.php index fcc04d8f66d..ef9faadc821 100644 --- a/htdocs/admin/website.php +++ b/htdocs/admin/website.php @@ -205,7 +205,7 @@ if (GETPOST('actionadd', 'alpha') || GETPOST('actionmodify', 'alpha')) { // List of values if ($tabrowid[$id] && !in_array($tabrowid[$id], $listfieldinsert)) { - $sql .= $newid.","; + $sql .= ((int) $newid).","; } $i = 0; foreach ($listfieldinsert as $f => $value) { diff --git a/htdocs/ai/tools/categories.class.php b/htdocs/ai/tools/categories.class.php index 949580adfc9..f27004bf2ac 100644 --- a/htdocs/ai/tools/categories.class.php +++ b/htdocs/ai/tools/categories.class.php @@ -287,7 +287,7 @@ class ToolCategories extends McpTool * Executes the requested tool function based on its name. * * @param string $name The name of the tool to execute. - * @param array $args The arguments for the tool (key-value pairs). + * @param array $args The arguments for the tool (key-value pairs). Only SQL safe arguments! * @return mixed The result of the tool execution (usually an array) or an error array. */ public function execute(string $name, array $args) @@ -406,6 +406,8 @@ class ToolCategories extends McpTool /** * Searches for categories based on a query and type. * + * Note: Only call with sql safe parameters + * * @param array $args Array containing 'query' (string), 'scope' (string), 'limit' (int), 'offset' (int). * @return array{error:string}|array{count:int}|list> A list of found categories or an error array. */ @@ -442,9 +444,9 @@ class ToolCategories extends McpTool $sql .= " WHERE c.entity IN (" . getEntity('category') . ")"; if (!empty($query)) { - $query_lower = strtolower($query); + $sqlSearchText = $this->db->escape(strtolower($query)); - $sql .= " AND (LOWER(c.label) LIKE '%" . $this->db->escape($query_lower) . "%' OR LOWER(c.description) LIKE '%" . $this->db->escape($query_lower) . "%')"; + $sql .= " AND (LOWER(c.label) LIKE '%" . $sqlSearchText . "%' OR LOWER(c.description) LIKE '%" . $sqlSearchText . "%')"; } if (!empty($scope_filter)) { diff --git a/htdocs/asset/class/asset.class.php b/htdocs/asset/class/asset.class.php index bc4ee8939ef..78e6755f467 100644 --- a/htdocs/asset/class/asset.class.php +++ b/htdocs/asset/class/asset.class.php @@ -1765,14 +1765,14 @@ class Asset extends CommonObject if (preg_match('/^[\(]?PROV/i', $this->ref)) { // Now we rename also files into index $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'asset/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'bom/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'bom/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; $this->error = $this->db->lasterror(); } $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'asset/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filepath = 'asset/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filepath = 'asset/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; diff --git a/htdocs/comm/mailing/list.php b/htdocs/comm/mailing/list.php index 6cfe5abf85a..e77f12035e2 100644 --- a/htdocs/comm/mailing/list.php +++ b/htdocs/comm/mailing/list.php @@ -1,7 +1,7 @@ * Copyright (C) 2005-2010 Regis Houssin - * Copyright (C) 2024 MDW + * Copyright (C) 2024-2026 MDW * Copyright (C) 2024 Alexandre Spangaro * Copyright (C) 2024-2026 Frédéric France * Copyright (C) 2025 Jon Bendtsen @@ -197,7 +197,7 @@ if ($filteremail) { $sql .= " FROM ".MAIN_DB_PREFIX."mailing as m, ".MAIN_DB_PREFIX."mailing_cibles as mc"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."projet as pr ON pr.rowid = m.fk_project"; - $sql .= " WHERE m.rowid = mc.fk_mailing AND m.entity = ".$conf->entity; + $sql .= " WHERE m.rowid = mc.fk_mailing AND m.entity = ".((int) $conf->entity); $sql .= " AND mc.email = '".$db->escape($filteremail)."'"; if ($search_ref) { $sql .= natural_search("m.rowid", $search_ref, 1); diff --git a/htdocs/compta/bank/bankentries_list.php b/htdocs/compta/bank/bankentries_list.php index 74c3be9913f..832eb7d8904 100644 --- a/htdocs/compta/bank/bankentries_list.php +++ b/htdocs/compta/bank/bankentries_list.php @@ -10,7 +10,7 @@ * Copyright (C) 2018 Ferran Marcet * Copyright (C) 2018-2026 Frédéric France * Copyright (C) 2021 Gauthier VERDOL - * Copyright (C) 2024-2025 MDW + * Copyright (C) 2024-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -1340,7 +1340,7 @@ if ($resql) { $sqlforbalance .= " AND ba.entity IN (".getEntity('bank_account').")"; $sqlforbalance .= " AND b.fk_account = ".((int) $search_account); // To limit record on the page - $sqlforbalance .= " AND (b.datev < '".$db->idate($db->jdate($objp->dv))."' OR (b.datev = '".$db->idate($db->jdate($objp->dv))."' AND (b.dateo < '".$db->idate($db->jdate($objp->do))."' OR (b.dateo = '".$db->idate($db->jdate($objp->do))."' AND b.rowid < ".$objp->rowid."))))"; + $sqlforbalance .= " AND (b.datev < '".$db->idate($db->jdate($objp->dv))."' OR (b.datev = '".$db->idate($db->jdate($objp->dv))."' AND (b.dateo < '".$db->idate($db->jdate($objp->do))."' OR (b.dateo = '".$db->idate($db->jdate($objp->do))."' AND b.rowid < ".((int) $objp->rowid)."))))"; $resqlforbalance = $db->query($sqlforbalance); //print $sqlforbalance; diff --git a/htdocs/compta/bank/class/bankcateg.class.php b/htdocs/compta/bank/class/bankcateg.class.php index c97fb2e4416..ce6a4b95d4f 100644 --- a/htdocs/compta/bank/class/bankcateg.class.php +++ b/htdocs/compta/bank/class/bankcateg.class.php @@ -3,7 +3,7 @@ * Copyright (C) 2009 Regis Houssin * Copyright (C) 2016 Marcos García * Copyright (C) 2024 Frédéric France - * Copyright (C) 2024 MDW + * Copyright (C) 2024-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -159,7 +159,7 @@ class BankCateg // extends CommonObject $sql .= " t.label"; $sql .= " FROM ".MAIN_DB_PREFIX."categorie as t"; $sql .= " WHERE t.rowid = ".((int) $id); - $sql .= " AND t.entity = ".$conf->entity." AND t.type = " . ((int) $catTypeID); + $sql .= " AND t.entity = ".((int) $conf->entity)." AND t.type = " . ((int) $catTypeID); dol_syslog(get_class($this)."::fetch", LOG_DEBUG); $resql = $this->db->query($sql); @@ -203,7 +203,7 @@ class BankCateg // extends CommonObject $sql = "UPDATE ".MAIN_DB_PREFIX."categorie SET"; $sql .= " label=".(isset($this->label) ? "'".$this->db->escape($this->label)."'" : "null"); $sql .= " WHERE rowid=".((int) $this->id); - $sql .= " AND entity = ".$conf->entity; + $sql .= " AND entity = ".((int) $conf->entity); $this->db->begin(); @@ -349,7 +349,7 @@ class BankCateg // extends CommonObject $return = array(); - $sql = "SELECT rowid, label FROM ".MAIN_DB_PREFIX."categorie WHERE entity = ".$conf->entity." AND type = ".((int) $catTypeID)." ORDER BY label"; + $sql = "SELECT rowid, label FROM ".MAIN_DB_PREFIX."categorie WHERE entity = ".((int) $conf->entity)." AND type = ".((int) $catTypeID)." ORDER BY label"; $resql = $this->db->query($sql); if ($resql) { diff --git a/htdocs/compta/cashcontrol/class/cashcontrol.class.php b/htdocs/compta/cashcontrol/class/cashcontrol.class.php index b3aa0965896..136608105ad 100644 --- a/htdocs/compta/cashcontrol/class/cashcontrol.class.php +++ b/htdocs/compta/cashcontrol/class/cashcontrol.class.php @@ -3,7 +3,7 @@ * Copyright (C) 2009 Regis Houssin * Copyright (C) 2016 Marcos García * Copyright (C) 2018 Andreu Bisquerra - * Copyright (C) 2024-2025 MDW + * Copyright (C) 2024-2026 MDW * Copyright (C) 2024-2025 Frédéric France * * This program is free software; you can redistribute it and/or modify @@ -300,8 +300,8 @@ class CashControl extends CommonObject $sql .= ", '".$this->db->idate(dol_now())."'"; $sql .= ", '".$this->db->escape($this->posmodule)."'"; $sql .= ", '".$this->db->escape($this->posnumber)."'"; - $sql .= ", ".($this->day_close > 0 ? $this->day_close : "null"); - $sql .= ", ".($this->month_close > 0 ? $this->month_close : "null"); + $sql .= ", ".($this->day_close > 0 ? ((int) $this->day_close) : "null"); + $sql .= ", ".($this->month_close > 0 ? ((int) $this->month_close) : "null"); $sql .= ", ".((int) $this->year_close); $sql .= ", ".(isset($this->hour_close) ? (int) $this->hour_close : 23); $sql .= ", ".(isset($this->min_close) ? (int) $this->min_close : 59); diff --git a/htdocs/compta/prelevement/stats.php b/htdocs/compta/prelevement/stats.php index 63f761eb269..480a0b5f21c 100644 --- a/htdocs/compta/prelevement/stats.php +++ b/htdocs/compta/prelevement/stats.php @@ -4,7 +4,7 @@ * Copyright (C) 2005-2009 Regis Houssin * Copyright (C) 2010-2011 Juanjo Menent * Copyright (C) 2024-2026 Frédéric France - * Copyright (C) 2024 MDW + * Copyright (C) 2024-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -91,7 +91,7 @@ print_barre_liste($title, 0, $_SERVER["PHP_SELF"], $param, '', '', $massactionbu $sql = "SELECT sum(pb.amount) as amount, count(pb.amount) as nb"; //$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_lignes as pl"; $sql .= " FROM ".MAIN_DB_PREFIX."prelevement_bons as pb"; -$sql .= " WHERE pb.entity = ".$conf->entity; +$sql .= " WHERE pb.entity = ".((int) $conf->entity); if ($type == 'bank-transfer') { $sql .= " AND pb.type = 'bank-transfer'"; } else { @@ -127,7 +127,7 @@ $sql = "SELECT COUNT(pb.rowid) as nb, SUM(pb.amount) as amount, pb.statut as sta //$sql .= " FROM ".MAIN_DB_PREFIX."prelevement_lignes as pl"; $sql .= " FROM ".MAIN_DB_PREFIX."prelevement_bons as pb"; //$sql .= " WHERE pl.fk_prelevement_bons = pb.rowid"; -$sql .= " WHERE pb.entity = ".$conf->entity; +$sql .= " WHERE pb.entity = ".((int) $conf->entity); if ($type == 'bank-transfer') { $sql .= " AND pb.type = 'bank-transfer'"; } else { @@ -211,7 +211,7 @@ $sql = "SELECT sum(pl.amount), count(pl.amount)"; $sql .= " FROM ".MAIN_DB_PREFIX."prelevement_lignes as pl"; $sql .= ", ".MAIN_DB_PREFIX."prelevement_bons as pb"; $sql .= " WHERE pl.fk_prelevement_bons = pb.rowid"; -$sql .= " AND pb.entity = ".$conf->entity; +$sql .= " AND pb.entity = ".((int) $conf->entity); $sql .= " AND pl.statut = 3"; if ($type == 'bank-transfer') { $sql .= " AND pb.type = 'bank-transfer'"; @@ -235,7 +235,7 @@ $sql .= " FROM ".MAIN_DB_PREFIX."prelevement_lignes as pl"; $sql .= ", ".MAIN_DB_PREFIX."prelevement_bons as pb"; $sql .= ", ".MAIN_DB_PREFIX."prelevement_rejet as pr"; $sql .= " WHERE pl.fk_prelevement_bons = pb.rowid"; -$sql .= " AND pb.entity = ".$conf->entity; +$sql .= " AND pb.entity = ".((int) $conf->entity); $sql .= " AND pl.statut = 3"; $sql .= " AND pr.fk_prelevement_lignes = pl.rowid"; if ($type == 'bank-transfer') { diff --git a/htdocs/compta/sociales/class/cchargesociales.class.php b/htdocs/compta/sociales/class/cchargesociales.class.php index 8cf52817b85..3a6e0721204 100644 --- a/htdocs/compta/sociales/class/cchargesociales.class.php +++ b/htdocs/compta/sociales/class/cchargesociales.class.php @@ -4,7 +4,7 @@ * Copyright (C) 2015 Florian Henry * Copyright (C) 2015 Raphaël Doursenaud * Copyright (C) 2024-2025 Frédéric France - * Copyright (C) 2024 MDW + * Copyright (C) 2024-2026 MDW * Copyright (C) 2026 Vincent de Grandpré * * This program is free software; you can redistribute it and/or modify @@ -153,10 +153,10 @@ class Cchargesociales $sql .= 'accountancy_code'; $sql .= ') VALUES ('; $sql .= ' '.(!isset($this->libelle) ? 'NULL' : "'".$this->db->escape($this->libelle)."'").','; - $sql .= ' '.(!isset($this->deductible) ? 'NULL' : $this->deductible).','; + $sql .= ' '.(!isset($this->deductible) ? 'NULL' : "'".$this->db->escape($this->deductible)."'").','; $sql .= ' ' . (int) $this->active . ','; $sql .= ' '.(!isset($this->code) ? 'NULL' : "'".$this->db->escape($this->code)."'").','; - $sql .= ' '.(!isset($this->fk_pays) ? 'NULL' : $this->fk_pays).','; + $sql .= ' '.(!isset($this->fk_pays) ? 'NULL' : ((int) $this->fk_pays)).','; $sql .= ' '.(!isset($this->module) ? 'NULL' : "'".$this->db->escape($this->module)."'").','; $sql .= ' '.(!isset($this->accountancy_code) ? 'NULL' : "'".$this->db->escape($this->accountancy_code)."'"); $sql .= ')'; diff --git a/htdocs/compta/sociales/class/paymentsocialcontribution.class.php b/htdocs/compta/sociales/class/paymentsocialcontribution.class.php index f58ad04e1e1..b6ce1956755 100644 --- a/htdocs/compta/sociales/class/paymentsocialcontribution.class.php +++ b/htdocs/compta/sociales/class/paymentsocialcontribution.class.php @@ -232,10 +232,10 @@ class PaymentSocialContribution extends CommonObject if ($totalamount != 0) { $sql = "INSERT INTO ".MAIN_DB_PREFIX."paiementcharge (fk_charge, datec, datep, amount,"; $sql .= " fk_typepaiement, num_paiement, note, fk_user_creat, fk_bank)"; - $sql .= " VALUES ($this->chid, '".$this->db->idate($now)."',"; + $sql .= " VALUES (".((int) $this->chid).", '".$this->db->idate($now)."',"; $sql .= " '".$this->db->idate($this->datepaye)."',"; $sql .= " ".((float) $totalamount).","; - $sql .= " ".((int) $this->paiementtype).", '".$this->db->escape($this->num_payment)."', '".$this->db->escape($this->note)."', ".$user->id.","; + $sql .= " ".((int) $this->paiementtype).", '".$this->db->escape($this->num_payment)."', '".$this->db->escape($this->note)."', ".((int) $user->id).","; $sql .= " 0)"; $resql = $this->db->query($sql); diff --git a/htdocs/core/class/html.formbarcode.class.php b/htdocs/core/class/html.formbarcode.class.php index 4ad533efa6c..d063c1c7a82 100644 --- a/htdocs/core/class/html.formbarcode.class.php +++ b/htdocs/core/class/html.formbarcode.class.php @@ -143,7 +143,7 @@ class FormBarCode $sql = "SELECT rowid, code, libelle as label"; $sql .= " FROM ".$this->db->prefix()."c_barcode_type"; $sql .= " WHERE coder <> '0'"; - $sql .= " AND entity = ".$conf->entity; + $sql .= " AND entity = ".((int) $conf->entity); $sql .= " ORDER BY code"; $result = $this->db->query($sql); diff --git a/htdocs/core/class/infobox.class.php b/htdocs/core/class/infobox.class.php index 9f1ff93c0e0..6b08c756c38 100644 --- a/htdocs/core/class/infobox.class.php +++ b/htdocs/core/class/infobox.class.php @@ -3,7 +3,7 @@ * Copyright (C) 2004-2012 Laurent Destailleur * Copyright (C) 2005-2012 Regis Houssin * Copyright (C) 2019 Nicolas ZABOURI - * Copyright (C) 2024 MDW + * Copyright (C) 2024-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -105,12 +105,12 @@ class InfoBox $sql .= " d.rowid as box_id, d.file, d.note, d.tms"; $sql .= " FROM ".$dbs->prefix()."boxes as b, ".$dbs->prefix()."boxes_def as d"; $sql .= " WHERE b.box_id = d.rowid"; - $sql .= " AND b.entity IN (0,".$conf->entity.")"; + $sql .= " AND b.entity IN (0,".((int) $conf->entity).")"; if ($zone >= 0) { $sql .= " AND b.position = ".((int) $zone); } if (is_object($user)) { - $sql .= " AND b.fk_user IN (0,".$user->id.")"; + $sql .= " AND b.fk_user IN (0,".((int) $user->id).")"; } else { $sql .= " AND b.fk_user = 0"; } @@ -118,7 +118,7 @@ class InfoBox } else { // available $sql = "SELECT d.rowid as box_id, d.file, d.note, d.tms"; $sql .= " FROM ".$dbs->prefix()."boxes_def as d"; - $sql .= " WHERE d.entity IN (0, ".$conf->entity.")"; + $sql .= " WHERE d.entity IN (0, ".((int) $conf->entity).")"; } dol_syslog(self::class."::listBoxes get default box list for mode=".$mode." userid=".(is_object($user) ? $user->id : ''), LOG_DEBUG); @@ -260,7 +260,7 @@ class InfoBox // Delete all lines $sql = "DELETE FROM ".$dbs->prefix()."boxes"; - $sql .= " WHERE entity = ".$conf->entity; + $sql .= " WHERE entity = ".((int) $conf->entity); $sql .= " AND fk_user = ".((int) $userid); $sql .= " AND position = ".((int) $zone); diff --git a/htdocs/core/modules/modFacture.class.php b/htdocs/core/modules/modFacture.class.php index d371b163f02..a15c42a38e7 100644 --- a/htdocs/core/modules/modFacture.class.php +++ b/htdocs/core/modules/modFacture.class.php @@ -7,6 +7,7 @@ * Copyright (C) 2021-2024 Alexandre Spangaro * Copyright (C) 2022-2026 Frédéric France * Copyright (C) 2024 William Mead + * Copyright (C) 2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -274,7 +275,7 @@ class modFacture extends DolibarrModules } // Add extra fields $import_extrafield_sample = array(); - $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE elementtype = 'facture' AND entity IN (0, ".$conf->entity.")"; + $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE elementtype = 'facture' AND entity IN (0, ".((int) $conf->entity).")"; $resql = $this->db->query($sql); if ($resql) { while ($obj = $this->db->fetch_object($resql)) { @@ -402,7 +403,7 @@ class modFacture extends DolibarrModules } // Add extra fields $import_extrafield_sample = array(); - $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE elementtype = 'facture_det' AND entity IN (0, ".$conf->entity.")"; + $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE elementtype = 'facture_det' AND entity IN (0, ".((int) $conf->entity).")"; $resql = $this->db->query($sql); if ($resql) { while ($obj = $this->db->fetch_object($resql)) { @@ -466,7 +467,7 @@ class modFacture extends DolibarrModules $this->import_updatekeys_array[$r] = array( 'fd.rowid' => 'Row Id', 'fd.fk_facture' => 'Invoice Id', - 'fd.fk_product'=> 'ProductRef' + 'fd.fk_product' => 'ProductRef' ); $this->import_convertvalue_array[$r] = array( 'fd.fk_facture' => array( @@ -477,11 +478,11 @@ class modFacture extends DolibarrModules 'element' => 'facture' ), 'fd.fk_product' => array( - 'rule'=>'fetchidfromref', - 'classfile'=>'/product/class/product.class.php', - 'class'=>'Product', - 'method'=>'fetch', - 'element'=>'Product' + 'rule' => 'fetchidfromref', + 'classfile' => '/product/class/product.class.php', + 'class' => 'Product', + 'method' => 'fetch', + 'element' => 'Product' ), 'fd.fk_projet' => array( 'rule' => 'fetchidfromref', @@ -666,7 +667,7 @@ class modFacture extends DolibarrModules $this->export_sql_end[$r] .= ' WHERE f.fk_soc = s.rowid AND f.rowid = fd.fk_facture'; $this->export_sql_end[$r] .= ' AND f.entity IN ('.getEntity('invoice').')'; if (!empty($user) && !$user->hasRight('societe', 'client', 'voir')) { - $this->export_sql_end[$r] .= ' AND sc.fk_user = '.(empty($user) ? 0 : $user->id); + $this->export_sql_end[$r] .= ' AND sc.fk_user = '.(empty($user) ? 0 : ((int) $user->id)); } $r++; @@ -758,7 +759,7 @@ class modFacture extends DolibarrModules $this->export_sql_end[$r] .= ' WHERE f.fk_soc = s.rowid'; $this->export_sql_end[$r] .= ' AND f.entity IN ('.getEntity('invoice').')'; if (!empty($user) && !$user->hasRight('societe', 'client', 'voir')) { - $this->export_sql_end[$r] .= ' AND sc.fk_user = '.(empty($user) ? 0 : $user->id); + $this->export_sql_end[$r] .= ' AND sc.fk_user = '.(empty($user) ? 0 : ((int) $user->id)); } $r++; } diff --git a/htdocs/core/modules/modFournisseur.class.php b/htdocs/core/modules/modFournisseur.class.php index c38324135c0..ac68eae095d 100644 --- a/htdocs/core/modules/modFournisseur.class.php +++ b/htdocs/core/modules/modFournisseur.class.php @@ -457,7 +457,7 @@ if (!getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD')) { $this->export_sql_end[$r] .= ' WHERE f.fk_soc = s.rowid AND f.rowid = fd.fk_facture_fourn'; $this->export_sql_end[$r] .= ' AND f.entity IN (' . getEntity('supplier_invoice') . ')'; if (is_object($user) && !$user->hasRight('societe', 'client', 'voir')) { - $this->export_sql_end[$r] .= ' AND sc.fk_user = ' . ( (int) $user->id); + $this->export_sql_end[$r] .= ' AND sc.fk_user = ' . ((int) $user->id); } // Invoices and payments @@ -540,7 +540,7 @@ if (!getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD')) { $this->export_sql_end[$r] .= ' WHERE f.fk_soc = s.rowid'; $this->export_sql_end[$r] .= ' AND f.entity IN (' . getEntity('supplier_invoice') . ')'; if (is_object($user) && !$user->hasRight('societe', 'client', 'voir')) { - $this->export_sql_end[$r] .= ' AND sc.fk_user = ' . ( (int) $user->id); + $this->export_sql_end[$r] .= ' AND sc.fk_user = ' . ((int) $user->id); } // Order @@ -620,7 +620,7 @@ if (!getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD')) { $this->export_sql_end[$r] .= ' WHERE f.fk_soc = s.rowid AND f.rowid = fd.fk_commande'; $this->export_sql_end[$r] .= ' AND f.entity IN (' . getEntity('supplier_order') . ')'; if (is_object($user) && !$user->hasRight('societe', 'client', 'voir')) { - $this->export_sql_end[$r] .= ' AND sc.fk_user = ' . ( (int) $user->id); + $this->export_sql_end[$r] .= ' AND sc.fk_user = ' . ((int) $user->id); } //Import Supplier Invoice @@ -668,7 +668,7 @@ if (!getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD')) { } // Add extra fields $import_extrafield_sample = array(); - $sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE type <> 'separate' AND elementtype = 'facture_fourn' AND entity IN (0, " . $conf->entity . ")"; + $sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE type <> 'separate' AND elementtype = 'facture_fourn' AND entity IN (0, " . ((int) $conf->entity) . ")"; $resql = $this->db->query($sql); if ($resql) { while ($obj = $this->db->fetch_object($resql)) { @@ -763,7 +763,7 @@ if (!getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD')) { } // Add extra fields $import_extrafield_sample = array(); - $sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE type <> 'separate' AND elementtype = 'facture_fourn_det' AND entity IN (0, " . $conf->entity . ")"; + $sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE type <> 'separate' AND elementtype = 'facture_fourn_det' AND entity IN (0, " . ((int) $conf->entity) . ")"; $resql = $this->db->query($sql); if ($resql) { while ($obj = $this->db->fetch_object($resql)) { @@ -850,7 +850,7 @@ if (!getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD')) { // Add extra fields $import_extrafield_sample = array(); - $sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE type <> 'separate' AND elementtype = 'commande_fournisseur' AND entity IN (0, " . $conf->entity . ")"; + $sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE type <> 'separate' AND elementtype = 'commande_fournisseur' AND entity IN (0, " . ((int) $conf->entity) . ")"; $resql = $this->db->query($sql); if ($resql) { @@ -932,7 +932,7 @@ if (!getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD')) { } // Add extra fields - $sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE type <> 'separate' AND elementtype = 'commande_fournisseurdet' AND entity IN (0, " . $conf->entity . ")"; + $sql = "SELECT name, label, fieldrequired FROM " . MAIN_DB_PREFIX . "extrafields WHERE type <> 'separate' AND elementtype = 'commande_fournisseurdet' AND entity IN (0, " . ((int) $conf->entity) . ")"; $resql = $this->db->query($sql); if ($resql) { while ($obj = $this->db->fetch_object($resql)) { @@ -995,8 +995,8 @@ if (!getDolGlobalString('MAIN_USE_NEW_SUPPLIERMOD')) { } $sql_order = array( - "DELETE FROM " . MAIN_DB_PREFIX . "document_model WHERE nom = '" . $this->db->escape($this->const[0][2]) . "' AND type = 'order_supplier' AND entity = " . ( (int) $conf->entity), - "INSERT INTO " . MAIN_DB_PREFIX . "document_model (nom, type, entity) VALUES('" . $this->db->escape($this->const[0][2]) . "', 'order_supplier', " . ( (int) $conf->entity) . ")", + "DELETE FROM " . MAIN_DB_PREFIX . "document_model WHERE nom = '" . $this->db->escape($this->const[0][2]) . "' AND type = 'order_supplier' AND entity = " . ((int) $conf->entity), + "INSERT INTO " . MAIN_DB_PREFIX . "document_model (nom, type, entity) VALUES('" . $this->db->escape($this->const[0][2]) . "', 'order_supplier', " . ((int) $conf->entity) . ")", ); //ODT template for Supplier Invoice diff --git a/htdocs/core/modules/modStock.class.php b/htdocs/core/modules/modStock.class.php index 7187671add6..b50315301ef 100644 --- a/htdocs/core/modules/modStock.class.php +++ b/htdocs/core/modules/modStock.class.php @@ -4,7 +4,7 @@ * Copyright (C) 2005-2009 Regis Houssin * Copyright (C) 2012 Juanjo Menent * Copyright (C) 2021 Ferran Marcet - * Copyright (C) 2024 MDW + * Copyright (C) 2024-2026 MDW * Copyright (C) 2024-2026 Frédéric France * * This program is free software; you can redistribute it and/or modify @@ -320,7 +320,7 @@ class modStock extends DolibarrModules 'e.rowid' => 'IdWarehouse', 'e.ref' => 'LocationSummary', 'e.description' => 'DescWareHouse', 'e.lieu' => 'LieuWareHouse', 'e.address' => 'Address', 'e.zip' => 'Zip', 'e.town' => 'Town', 'p.rowid' => "ProductId", 'p.ref' => "Ref", 'p.fk_product_type' => "Type", 'p.label' => "Label", 'p.description' => "Description", 'p.note' => "Note", 'p.price' => "Price", 'p.tva_tx' => 'VAT', 'p.tosell' => "OnSell", 'p.tobuy' => 'OnBuy', 'p.duration' => "Duration", - 'p.datec' => 'DateCreation', 'p.tms' => 'DateModification', 'p.pmp' => 'PMPValue', 'p.cost_price' => 'CostPrice', 'lcpn.label'=>'Nature', + 'p.datec' => 'DateCreation', 'p.tms' => 'DateModification', 'p.pmp' => 'PMPValue', 'p.cost_price' => 'CostPrice', 'lcpn.label' => 'Nature', 'pb.rowid' => 'Id', 'pb.batch' => 'Batch', 'pb.qty' => 'Qty', 'pl.eatby' => 'EatByDate', 'pl.sellby' => 'SellByDate', 'none.dateLastMovement' => 'LastMovement' ); @@ -331,7 +331,7 @@ class modStock extends DolibarrModules 'e.rowid' => 'List:entrepot:ref::stock', 'e.ref' => 'Text', 'e.lieu' => 'Text', 'e.description' => 'Text', 'e.address' => 'Text', 'e.zip' => 'Text', 'e.town' => 'Text', 'p.rowid' => "Numeric", 'p.ref' => "Text", 'p.fk_product_type' => "Text", 'p.label' => "Text", 'p.description' => "Text", 'p.note' => "Text", 'p.price' => "Numeric", 'p.tva_tx' => 'Numeric', 'p.tosell' => "Boolean", 'p.tobuy' => "Boolean", 'p.duration' => "Duree", - 'p.datec' => 'Date', 'p.tms' => 'Date', 'p.pmp' => 'PMPValue', 'p.cost_price' => 'CostPrice', 'lcpn.label'=>'Text', + 'p.datec' => 'Date', 'p.tms' => 'Date', 'p.pmp' => 'PMPValue', 'p.cost_price' => 'CostPrice', 'lcpn.label' => 'Text', 'pb.batch' => 'Text', 'pb.qty' => 'Numeric', 'pl.eatby' => 'Date', 'pl.sellby' => 'Date', 'none.dateLastMovement' => 'Date' ); @@ -341,12 +341,12 @@ class modStock extends DolibarrModules $this->export_entities_array[$r] = array( 'p.rowid' => "product", 'p.ref' => "product", 'p.fk_product_type' => "product", 'p.label' => "product", 'p.description' => "product", 'p.note' => "product", 'p.price' => "product", 'p.tva_tx' => 'product', 'p.tosell' => "product", 'p.tobuy' => "product", 'p.duration' => "product", - 'p.datec' => 'product', 'p.tms' => 'product', 'p.pmp' => 'product', 'p.cost_price' => 'product', 'lcpn.label'=>'product', + 'p.datec' => 'product', 'p.tms' => 'product', 'p.pmp' => 'product', 'p.cost_price' => 'product', 'lcpn.label' => 'product', 'pb.rowid' => 'batch', 'pb.batch' => 'batch', 'pb.qty' => 'batch', 'none.dateLastMovement' => 'movement', 'pl.eatby' => 'batch', 'pl.sellby' => 'batch' ); // We define here only fields that use another icon that the one defined into export_icon $this->export_special_array[$r] = array( - 'none.dateLastMovement'=>array('rule'=>'compute', 'classfile'=>'/product/stock/class/mouvementstock.class.php', 'class'=>'MouvementStock', 'method'=>'getDateLastMovementProductBatch', 'method_params'=>['e_rowid', 'p_rowid', 'pb_batch']), + 'none.dateLastMovement' => array('rule' => 'compute', 'classfile' => '/product/stock/class/mouvementstock.class.php', 'class' => 'MouvementStock', 'method' => 'getDateLastMovementProductBatch', 'method_params' => ['e_rowid', 'p_rowid', 'pb_batch']), ); if (isModEnabled('barcode')) { $this->export_entities_array[$r] = array_merge($this->export_entities_array[$r], array('p.barcode' => 'product')); @@ -502,7 +502,7 @@ class modStock extends DolibarrModules $this->import_regex_array[$r] = array('e.statut' => '^[0|1]'); // Add extra fields $import_extrafield_sample = []; - $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'entrepot' AND entity IN (0, ".$conf->entity.")"; + $sql = "SELECT name, label, fieldrequired FROM ".MAIN_DB_PREFIX."extrafields WHERE type <> 'separate' AND elementtype = 'entrepot' AND entity IN (0, ".((int) $conf->entity).")"; $resql = $this->db->query($sql); if ($resql) { // This can fail when class is used on old database (during migration for example) while ($obj = $this->db->fetch_object($resql)) { diff --git a/htdocs/cron/list.php b/htdocs/cron/list.php index d83253743c1..f93fc3beff8 100644 --- a/htdocs/cron/list.php +++ b/htdocs/cron/list.php @@ -3,7 +3,7 @@ * Copyright (C) 2013 Florian Henry * Copyright (C) 2013-2021 Laurent Destailleur * Copyright (C) 2019-2024 Frédéric France - * Copyright (C) 2024-2025 MDW + * Copyright (C) 2024-2026 MDW * Copyright (C) 2024 Alexandre Spangaro * * This program is free software; you can redistribute it and/or modify @@ -347,7 +347,7 @@ $sql .= " t.nbrun,"; $sql .= " t.libname,"; $sql .= " t.test"; $sql .= " FROM ".MAIN_DB_PREFIX."cronjob as t"; -$sql .= " WHERE entity IN (0,".$conf->entity.")"; +$sql .= " WHERE entity IN (0,".((int) $conf->entity).")"; if (!empty($TTestNotAllowed)) { $sql .= ' AND t.rowid NOT IN ('.$db->sanitize(implode(',', $TTestNotAllowed)).')'; } @@ -888,7 +888,7 @@ if ($num > 0) { if ($user->hasRight('cron', 'execute')) { if (!empty($obj->status)) { print '".img_picto($langs->trans('CronExecute'), "play", '', 0, 0, 0, '', 'marginleftonly').''; diff --git a/htdocs/expedition/class/expeditionligne.class.php b/htdocs/expedition/class/expeditionligne.class.php index da05933ba17..e2dba7b4dda 100644 --- a/htdocs/expedition/class/expeditionligne.class.php +++ b/htdocs/expedition/class/expeditionligne.class.php @@ -13,7 +13,7 @@ * Copyright (C) 2018 Nicolas ZABOURI * Copyright (C) 2018-2025 Frédéric France * Copyright (C) 2020 Lenin Rivas - * Copyright (C) 2024-2025 MDW + * Copyright (C) 2024-2026 MDW * Copyright (C) 2025 Nick Fragoulis * * This program is free software; you can redistribute it and/or modify @@ -437,11 +437,11 @@ class ExpeditionLigne extends CommonObjectLine $sql .= ", description"; $sql .= ", rang"; $sql .= ") VALUES ("; - $sql .= $this->fk_expedition; - $sql .= ", ".(empty($this->entrepot_id) ? 'NULL' : $this->entrepot_id); - $sql .= ", ".(empty($this->fk_elementdet) ? 'NULL' : $this->fk_elementdet); - $sql .= ", ".(empty($this->fk_parent) ? 'NULL' : $this->fk_parent); - $sql .= ", ".(empty($this->fk_product) ? 'NULL' : $this->fk_product); + $sql .= ((int) $this->fk_expedition); + $sql .= ", ".(empty($this->entrepot_id) ? 'NULL' : ((int) $this->entrepot_id)); + $sql .= ", ".(empty($this->fk_elementdet) ? 'NULL' : ((int) $this->fk_elementdet)); + $sql .= ", ".(empty($this->fk_parent) ? 'NULL' : ((int) $this->fk_parent)); + $sql .= ", ".(empty($this->fk_product) ? 'NULL' : ((int) $this->fk_product)); $sql .= ", '".(empty($this->element_type) ? 'order' : $this->db->escape($this->element_type))."'"; $sql .= ", ".price2num($this->qty, 'MS'); $sql .= ", ".((int) $this->fk_unit); @@ -817,7 +817,7 @@ class ExpeditionLigne extends CommonObjectLine if (!$error) { // update line $sql = "UPDATE ".MAIN_DB_PREFIX.$this->table_element." SET"; - $sql .= " fk_entrepot = ".($this->entrepot_id > 0 ? $this->entrepot_id : 'null'); + $sql .= " fk_entrepot = ".($this->entrepot_id > 0 ? ((int) $this->entrepot_id) : 'null'); $sql .= " , qty = ".((float) price2num($qty, 'MS')); $sql .= " , fk_unit = ".((int) $this->fk_unit); $sql .= " WHERE rowid = ".((int) $this->id); diff --git a/htdocs/hrm/class/skill.class.php b/htdocs/hrm/class/skill.class.php index 87190b6a4f4..de2c1133af6 100644 --- a/htdocs/hrm/class/skill.class.php +++ b/htdocs/hrm/class/skill.class.php @@ -641,14 +641,14 @@ class Skill extends CommonObject if (preg_match('/^[\(]?PROV/i', $this->ref)) { // Now we rename also files into index $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'skill/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'skill/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'skill/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; $this->error = $this->db->lasterror(); } $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'skill/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filepath = 'skill/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filepath = 'skill/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; diff --git a/htdocs/modulebuilder/template/core/modules/mymodule/mod_myobject_standard.php b/htdocs/modulebuilder/template/core/modules/mymodule/mod_myobject_standard.php index 93391afe2a3..35b9a6c5905 100644 --- a/htdocs/modulebuilder/template/core/modules/mymodule/mod_myobject_standard.php +++ b/htdocs/modulebuilder/template/core/modules/mymodule/mod_myobject_standard.php @@ -97,14 +97,14 @@ class mod_myobject_standard extends ModeleNumRefMyObject $max = ''; $posindice = strlen($this->prefix) + 6; - $sql = "SELECT MAX(CAST(SUBSTRING(t.ref FROM ".$posindice.") AS SIGNED)) as max"; + $sql = "SELECT MAX(CAST(SUBSTRING(t.ref FROM ".((int) $posindice).") AS SIGNED)) as max"; $sql .= " FROM ".$db->prefix()."mymodule_myobject as t"; $sql .= " WHERE t.ref LIKE '".$db->escape($this->prefix)."____-%'"; if ($object->ismultientitymanaged == 1) { $sql .= " AND t.entity = ".((int) $conf->entity); } elseif (preg_match('/^\w+@\w+$/', (string) $object->ismultientitymanaged)) { $tmparray = explode('@', (string) $object->ismultientitymanaged); - $sql .= " LEFT JOIN ".$db->prefix().$tmparray[1]." as pt ON t.".$db->sanitize($tmparray[0])." = pt.rowid"; + $sql .= " LEFT JOIN ".$db->prefix().$db->sanitize($tmparray[1])." as pt ON t.".$db->sanitize($tmparray[0])." = pt.rowid"; $sql .= " WHERE pt.entity IN (".getEntity($object->element).")"; } @@ -137,14 +137,14 @@ class mod_myobject_standard extends ModeleNumRefMyObject // first we get the max value $posindice = strlen($this->prefix) + 6; - $sql = "SELECT MAX(CAST(SUBSTRING(t.ref FROM ".$posindice.") AS SIGNED)) as max"; + $sql = "SELECT MAX(CAST(SUBSTRING(t.ref FROM ".((int) $posindice).") AS SIGNED)) as max"; $sql .= " FROM ".$db->prefix()."mymodule_myobject as t"; $sql .= " WHERE t.ref LIKE '".$db->escape($this->prefix)."____-%'"; if ($object->ismultientitymanaged == 1) { $sql .= " AND t.entity = ".((int) $conf->entity); } elseif (preg_match('/^\w+@\w+$/', (string) $object->ismultientitymanaged)) { $tmparray = explode('@', (string) $object->ismultientitymanaged); - $sql .= " LEFT JOIN ".$db->prefix().$tmparray[1]." as pt ON t.".$db->sanitize($tmparray[0])." = pt.rowid"; + $sql .= " LEFT JOIN ".$db->prefix().$db->sanitize($tmparray[1])." as pt ON t.".$db->sanitize($tmparray[0])." = pt.rowid"; $sql .= " WHERE pt.entity IN (".getEntity($object->element).")"; } diff --git a/htdocs/product/class/productcustomerprice.class.php b/htdocs/product/class/productcustomerprice.class.php index 70af1c509e8..f903491367e 100644 --- a/htdocs/product/class/productcustomerprice.class.php +++ b/htdocs/product/class/productcustomerprice.class.php @@ -360,7 +360,7 @@ class ProductCustomerPrice extends CommonObject $sql .= " ".(empty($this->price_min_ttc) ? '0' : "'".$this->db->escape($this->price_min_ttc)."'").","; $sql .= " ".(!isset($this->price_base_type) ? 'NULL' : "'".$this->db->escape($this->price_base_type)."'").","; $sql .= " ".($this->default_vat_code ? "'".$this->db->escape($this->default_vat_code)."'" : "null").","; - $sql .= " ".(!isset($this->tva_tx) ? 'NULL' : (empty($this->tva_tx) ? 0 : $this->tva_tx)).","; + $sql .= " ".(!isset($this->tva_tx) ? 'NULL' : (empty($this->tva_tx) ? 0 : ((float) $this->tva_tx))).","; $sql .= " ".(!isset($this->recuperableonly) ? 'NULL' : "'".$this->db->escape($this->recuperableonly)."'").","; $sql .= " ".(empty($this->localtax1_type) ? "'0'" : "'".$this->db->escape($this->localtax1_type)."'").","; $sql .= " ".(!isset($this->localtax1_tx) ? 'NULL' : (empty($this->localtax1_tx) ? "'0'" : "'".$this->db->escape($this->localtax1_tx)."'")).","; @@ -930,17 +930,17 @@ class ProductCustomerPrice extends CommonObject $sql .= " entity=".((int) $conf->entity).","; $sql .= " datec='".$this->db->idate($now)."',"; $sql .= " tms=".(dol_strlen((string) $this->tms) != 0 ? "'".$this->db->idate($this->tms)."'" : 'null').","; - $sql .= " fk_product=".(isset($this->fk_product) ? $this->fk_product : "null").","; - $sql .= " fk_soc=".(isset($this->fk_soc) ? $this->fk_soc : "null").","; + $sql .= " fk_product=".(isset($this->fk_product) ? ((int) $this->fk_product) : "null").","; + $sql .= " fk_soc=".(isset($this->fk_soc) ? ((int) $this->fk_soc) : "null").","; $sql .= " ref_customer=".(isset($this->ref_customer) ? "'".$this->db->escape($this->ref_customer)."'" : "null").","; - $sql .= " price=".(isset($this->price) ? $this->price : "null").","; - $sql .= " price_ttc=".(isset($this->price_ttc) ? $this->price_ttc : "null").","; - $sql .= " price_min=".(isset($this->price_min) ? $this->price_min : "null").","; - $sql .= " price_min_ttc=".(isset($this->price_min_ttc) ? $this->price_min_ttc : "null").","; + $sql .= " price=".(isset($this->price) ? ((float) $this->price) : "null").","; + $sql .= " price_ttc=".(isset($this->price_ttc) ? ((float) $this->price_ttc) : "null").","; + $sql .= " price_min=".(isset($this->price_min) ? ((float) $this->price_min) : "null").","; + $sql .= " price_min_ttc=".(isset($this->price_min_ttc) ? ((float) $this->price_min_ttc) : "null").","; $sql .= " price_base_type=".(isset($this->price_base_type) ? "'".$this->db->escape($this->price_base_type)."'" : "null").","; $sql .= " default_vat_code = ".($this->default_vat_code ? "'".$this->db->escape($this->default_vat_code)."'" : "null").","; - $sql .= " tva_tx=".(isset($this->tva_tx) ? (empty($this->tva_tx) ? 0 : $this->tva_tx) : "null").","; - $sql .= " recuperableonly=".(isset($this->recuperableonly) ? $this->recuperableonly : "null").","; + $sql .= " tva_tx=".(isset($this->tva_tx) ? (empty($this->tva_tx) ? 0 : ((float) $this->tva_tx)) : "null").","; + $sql .= " recuperableonly=".(isset($this->recuperableonly) ? ((int) $this->recuperableonly) : "null").","; $sql .= " localtax1_tx=".(isset($this->localtax1_tx) ? (empty($this->localtax1_tx) ? "'0'" : "'".$this->db->escape($this->localtax1_tx)."'") : "null").","; $sql .= " localtax2_tx=".(isset($this->localtax2_tx) ? (empty($this->localtax2_tx) ? "'0'" : "'".$this->db->escape($this->localtax2_tx)."'") : "null").","; $sql .= " localtax1_type=".(!empty($this->localtax1_type) ? "'".$this->db->escape($this->localtax1_type)."'" : "'0'").","; diff --git a/htdocs/product/class/productfournisseurprice.class.php b/htdocs/product/class/productfournisseurprice.class.php index aff7a77a4c0..f8346401733 100644 --- a/htdocs/product/class/productfournisseurprice.class.php +++ b/htdocs/product/class/productfournisseurprice.class.php @@ -613,14 +613,14 @@ class ProductFournisseurPrice extends CommonObject if (preg_match('/^[\(]?PROV/i', $this->ref)) { // Now we rename also files into index $sql = 'UPDATE '.$this->db->prefix()."ecm_files set filename = CONCAT('".$this->db->escape($this->newref)."', SUBSTR(filename, ".(strlen($this->ref) + 1).")), filepath = 'productfournisseurprice/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'productfournisseurprice/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filename LIKE '".$this->db->escape($this->ref)."%' AND filepath = 'productfournisseurprice/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; $this->error = $this->db->lasterror(); } $sql = 'UPDATE '.MAIN_DB_PREFIX."ecm_files set filepath = 'productfournisseurprice/".$this->db->escape($this->newref)."'"; - $sql .= " WHERE filepath = 'productfournisseurprice/".$this->db->escape($this->ref)."' and entity = ".$conf->entity; + $sql .= " WHERE filepath = 'productfournisseurprice/".$this->db->escape($this->ref)."' and entity = ".((int) $conf->entity); $resql = $this->db->query($sql); if (!$resql) { $error++; diff --git a/htdocs/product/inventory/inventory.php b/htdocs/product/inventory/inventory.php index 6cd7cfc1d5f..a597e9e04f7 100644 --- a/htdocs/product/inventory/inventory.php +++ b/htdocs/product/inventory/inventory.php @@ -1,7 +1,7 @@ * Copyright (C) 2024-2025 Frédéric France - * Copyright (C) 2025 MDW + * Copyright (C) 2025-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -267,7 +267,7 @@ if (empty($reshook)) { // is the accountancy-codes flag; using it to gate the pmp write here means we // silently write into a row that fetch never looks at (#37773). if (getDolGlobalString('MULTICOMPANY_PRODUCT_SHARING_ENABLED') && getDolGlobalString('MULTICOMPANY_PMP_PER_ENTITY_ENABLED')) { - $sqlpmp = 'UPDATE '.MAIN_DB_PREFIX.'product_perentity SET pmp = '.((float) $line->pmp_real).' WHERE fk_product = '.((int) $line->fk_product).' AND entity='.$conf->entity; + $sqlpmp = 'UPDATE '.MAIN_DB_PREFIX.'product_perentity SET pmp = '.((float) $line->pmp_real).' WHERE fk_product = '.((int) $line->fk_product).' AND entity='.((int) $conf->entity); $resqlpmp = $db->query($sqlpmp); if (! $resqlpmp) { $error++; diff --git a/htdocs/webportal/class/html.formlistwebportal.class.php b/htdocs/webportal/class/html.formlistwebportal.class.php index b642525092d..45c679f3845 100644 --- a/htdocs/webportal/class/html.formlistwebportal.class.php +++ b/htdocs/webportal/class/html.formlistwebportal.class.php @@ -418,7 +418,7 @@ class FormListWebPortal } $field_spec = $this->object->fields[$key]; // @phpstan-ignore-next-line - $alias = $field_spec['alias'] ?? 't.'; + $sanitized_alias = $field_spec['alias'] ?? 't.'; // @phan-suppress-current-line SqlInjection $mode_search = (($this->object->isInt($field_spec) || $this->object->isFloat($field_spec)) ? 1 : 0); if ((strpos($field_spec['type'], 'integer:') === 0) || (strpos($field_spec['type'], 'sellist:') === 0) || !empty($field_spec['arrayofkeyval'])) { if ($val == "$this->emptyValueKey" || ($val === '0' && (empty($field_spec['arrayofkeyval']) || !array_key_exists('0', $field_spec['arrayofkeyval'])))) { @@ -435,11 +435,11 @@ class FormListWebPortal // @phpstan-ignore-next-line if (empty($field_spec['searchmulti'])) { if (!is_array($val) && $val != '') { - $this->sql_body .= natural_search($alias . $this->db->escape($key), $val, (($key == 'status') ? 2 : $mode_search)); + $this->sql_body .= natural_search($sanitized_alias . $this->db->escape($key), $val, (($key == 'status') ? 2 : $mode_search)); } } else { if (is_array($val) && !empty($val)) { - $this->sql_body .= natural_search($alias . $this->db->escape($key), implode(',', $val), (($key == 'status') ? 2 : $mode_search)); + $this->sql_body .= natural_search($sanitized_alias . $this->db->escape($key), implode(',', $val), (($key == 'status') ? 2 : $mode_search)); } } } elseif (preg_match('/(_dtstart|_dtend)$/', $key) && $val != '') { @@ -447,13 +447,13 @@ class FormListWebPortal if (array_key_exists($columnName, $this->object->fields)) { $field_spec = $this->object->fields[$columnName]; // @phpstan-ignore-next-line - $alias = $field_spec['alias'] ?? 't.'; + $sanitized_alias = $field_spec['alias'] ?? 't.'; // @phan-suppress-current-line SqlInjection if (preg_match('/^(date|timestamp|datetime)/', $field_spec['type'])) { if (preg_match('/_dtstart$/', $key)) { - $this->sql_body .= " AND " . $alias . $this->db->sanitize($columnName) . " >= '" . $this->db->idate((int) $val) . "'"; + $this->sql_body .= " AND " . $sanitized_alias . $this->db->sanitize($columnName) . " >= '" . $this->db->idate((int) $val) . "'"; } if (preg_match('/_dtend$/', $key)) { - $this->sql_body .= " AND " . $alias . $this->db->sanitize($columnName) . " <= '" . $this->db->idate((int) $val) . "'"; + $this->sql_body .= " AND " . $sanitized_alias . $this->db->sanitize($columnName) . " <= '" . $this->db->idate((int) $val) . "'"; } } } @@ -475,6 +475,7 @@ class FormListWebPortal } $this->offset = $this->limit * ($this->page - 1); + // Supposed GETPOST(...,"az09comma") is sql protection for sortfield @phan-suppress-next-line SqlInjection $this->sql_order = $this->db->order($this->sortfield, $this->sortorder); $this->sql_order .= $sqlOrder; // Add order by from hooks diff --git a/htdocs/webservices/server_user.php b/htdocs/webservices/server_user.php index ef18542a818..e6e777a5293 100644 --- a/htdocs/webservices/server_user.php +++ b/htdocs/webservices/server_user.php @@ -452,7 +452,7 @@ function getListOfGroups($authentication) if (isModEnabled('multicompany') && $conf->entity == 1 && (getDolGlobalString('MULTICOMPANY_TRANSVERSE_MODE') || ($user->admin && !$user->entity))) { $sql .= " WHERE g.entity IS NOT NULL"; } else { - $sql .= " WHERE g.entity IN (0,".$conf->entity.")"; + $sql .= " WHERE g.entity IN (0,".((int) $conf->entity).")"; } $sql .= " GROUP BY g.rowid, g.nom, g.entity, g.datec"; $resql = $db->query($sql); @@ -531,7 +531,7 @@ function createUserFromThirdparty($authentication, $thirdpartywithuser) // If a contact / company already exists with the email, return the corresponding socid $sql = "SELECT s.rowid as socid FROM ".MAIN_DB_PREFIX."societe as s"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."socpeople as sp ON sp.fk_soc = s.rowid"; - $sql .= " WHERE s.entity=".$conf->entity; + $sql .= " WHERE s.entity=".((int) $conf->entity); $sql .= " AND s.email='".$db->escape($thirdpartywithuser['email'])."'"; $sql .= " OR sp.email='".$db->escape($thirdpartywithuser['email'])."'"; $sql .= $db->plimit(1);