From e8acd5062690a3dccbce59e69360be14dd54496f Mon Sep 17 00:00:00 2001 From: NextGestion Date: Fri, 5 May 2023 17:15:49 +0100 Subject: [PATCH 1/5] Object line : Prevent adding Free line when the option "MAIN_DISABLE_FREE_LINES" is activated (Proposal, invoice, order, contract) --- htdocs/comm/propal/card.php | 5 +++++ htdocs/commande/card.php | 5 +++++ htdocs/compta/facture/card-rec.php | 5 +++++ htdocs/compta/facture/card.php | 5 +++++ htdocs/contrat/card.php | 5 +++++ htdocs/fourn/facture/card-rec.php | 7 ++++++- 6 files changed, 31 insertions(+), 1 deletion(-) diff --git a/htdocs/comm/propal/card.php b/htdocs/comm/propal/card.php index e31b43f5a43..ce1fde2979e 100644 --- a/htdocs/comm/propal/card.php +++ b/htdocs/comm/propal/card.php @@ -976,6 +976,11 @@ if (empty($reshook)) { $idprod = 0; } else { $idprod = GETPOST('idprod', 'int'); + + if(!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { + setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("ProductOrService")), null, 'errors'); + $error++; + } } $tva_tx = GETPOST('tva_tx', 'alpha'); diff --git a/htdocs/commande/card.php b/htdocs/commande/card.php index c6ebb04eb03..2c34503ff4c 100644 --- a/htdocs/commande/card.php +++ b/htdocs/commande/card.php @@ -686,6 +686,11 @@ if (empty($reshook)) { $idprod = 0; } else { $idprod = GETPOST('idprod', 'int'); + + if(!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { + setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("ProductOrService")), null, 'errors'); + $error++; + } } $tva_tx = GETPOST('tva_tx', 'alpha'); diff --git a/htdocs/compta/facture/card-rec.php b/htdocs/compta/facture/card-rec.php index a2a87d6d64a..8abdbeac120 100644 --- a/htdocs/compta/facture/card-rec.php +++ b/htdocs/compta/facture/card-rec.php @@ -433,6 +433,11 @@ if (empty($reshook)) { } else { $idprod = GETPOST('idprod', 'int'); $tva_tx = ''; + + if(!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { + setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("ProductOrService")), null, 'errors'); + $error++; + } } $qty = price2num(GETPOST('qty'.$predef, 'alpha'), 'MS', 2); diff --git a/htdocs/compta/facture/card.php b/htdocs/compta/facture/card.php index afff624102b..6775be3e822 100644 --- a/htdocs/compta/facture/card.php +++ b/htdocs/compta/facture/card.php @@ -2042,6 +2042,11 @@ if (empty($reshook)) { $idprod = 0; } else { $idprod = GETPOST('idprod', 'int'); + + if(!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { + setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("ProductOrService")), null, 'errors'); + $error++; + } } $tva_tx = GETPOST('tva_tx', 'alpha'); diff --git a/htdocs/contrat/card.php b/htdocs/contrat/card.php index 0b45cb88215..bffe0aba0cb 100644 --- a/htdocs/contrat/card.php +++ b/htdocs/contrat/card.php @@ -441,6 +441,11 @@ if (empty($reshook)) { $idprod = 0; } else { $idprod = GETPOST('idprod', 'int'); + + if(!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { + setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("ProductOrService")), null, 'errors'); + $error++; + } } $tva_tx = GETPOST('tva_tx', 'alpha'); diff --git a/htdocs/fourn/facture/card-rec.php b/htdocs/fourn/facture/card-rec.php index 1e08deb7fd0..683f9c87259 100644 --- a/htdocs/fourn/facture/card-rec.php +++ b/htdocs/fourn/facture/card-rec.php @@ -428,8 +428,13 @@ if (empty($reshook)) { $tva_tx = (GETPOST('tva_tx', 'alpha') ? GETPOST('tva_tx', 'alpha') : 0); $ref_fournisseur = (GETPOSTISSET('fourn_ref') ? GETPOST('fourn_ref', 'restricthtml') : ''); } else { - $idprod = GETPOST('idprod', 'int'); + $idprod = GETPOST('idprodfournprice', 'int'); $tva_tx = ''; + + if(!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { + setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("ProductOrService")), null, 'errors'); + $error++; + } } $qty = price2num(GETPOST('qty' . $predef, 'alpha'), 'MS', 2); From 13348ede59cee89548b2a2b403b7a6db92803015 Mon Sep 17 00:00:00 2001 From: stickler-ci Date: Fri, 5 May 2023 16:22:49 +0000 Subject: [PATCH 2/5] Fixing style errors. --- htdocs/comm/propal/card.php | 4 ++-- htdocs/commande/card.php | 2 +- htdocs/compta/facture/card-rec.php | 2 +- htdocs/compta/facture/card.php | 2 +- htdocs/contrat/card.php | 2 +- htdocs/fourn/facture/card-rec.php | 2 +- 6 files changed, 7 insertions(+), 7 deletions(-) diff --git a/htdocs/comm/propal/card.php b/htdocs/comm/propal/card.php index ce1fde2979e..6ec18e6d808 100644 --- a/htdocs/comm/propal/card.php +++ b/htdocs/comm/propal/card.php @@ -976,8 +976,8 @@ if (empty($reshook)) { $idprod = 0; } else { $idprod = GETPOST('idprod', 'int'); - - if(!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { + + if (!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("ProductOrService")), null, 'errors'); $error++; } diff --git a/htdocs/commande/card.php b/htdocs/commande/card.php index 2c34503ff4c..0c9795ae9ec 100644 --- a/htdocs/commande/card.php +++ b/htdocs/commande/card.php @@ -687,7 +687,7 @@ if (empty($reshook)) { } else { $idprod = GETPOST('idprod', 'int'); - if(!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { + if (!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("ProductOrService")), null, 'errors'); $error++; } diff --git a/htdocs/compta/facture/card-rec.php b/htdocs/compta/facture/card-rec.php index 8abdbeac120..4efbabbaf49 100644 --- a/htdocs/compta/facture/card-rec.php +++ b/htdocs/compta/facture/card-rec.php @@ -434,7 +434,7 @@ if (empty($reshook)) { $idprod = GETPOST('idprod', 'int'); $tva_tx = ''; - if(!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { + if (!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("ProductOrService")), null, 'errors'); $error++; } diff --git a/htdocs/compta/facture/card.php b/htdocs/compta/facture/card.php index 6775be3e822..e904a11283c 100644 --- a/htdocs/compta/facture/card.php +++ b/htdocs/compta/facture/card.php @@ -2043,7 +2043,7 @@ if (empty($reshook)) { } else { $idprod = GETPOST('idprod', 'int'); - if(!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { + if (!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("ProductOrService")), null, 'errors'); $error++; } diff --git a/htdocs/contrat/card.php b/htdocs/contrat/card.php index bffe0aba0cb..b89dea64cc7 100644 --- a/htdocs/contrat/card.php +++ b/htdocs/contrat/card.php @@ -442,7 +442,7 @@ if (empty($reshook)) { } else { $idprod = GETPOST('idprod', 'int'); - if(!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { + if (!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("ProductOrService")), null, 'errors'); $error++; } diff --git a/htdocs/fourn/facture/card-rec.php b/htdocs/fourn/facture/card-rec.php index 683f9c87259..7e6bd8d9b65 100644 --- a/htdocs/fourn/facture/card-rec.php +++ b/htdocs/fourn/facture/card-rec.php @@ -431,7 +431,7 @@ if (empty($reshook)) { $idprod = GETPOST('idprodfournprice', 'int'); $tva_tx = ''; - if(!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { + if (!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("ProductOrService")), null, 'errors'); $error++; } From cb11b6c4a781651a81230a4e12b41bd3ec1dd7c5 Mon Sep 17 00:00:00 2001 From: NextGestion Date: Sat, 6 May 2023 09:59:46 +0100 Subject: [PATCH 3/5] Avoid the msg "Found non quoted or not casted var into sql request" --- htdocs/core/boxes/box_project.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/core/boxes/box_project.php b/htdocs/core/boxes/box_project.php index a6b0c74e97a..c88752ca3a8 100644 --- a/htdocs/core/boxes/box_project.php +++ b/htdocs/core/boxes/box_project.php @@ -106,7 +106,7 @@ class box_project extends ModeleBoxes $sql .= " FROM ".MAIN_DB_PREFIX."projet as p"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe as s on p.fk_soc = s.rowid"; $sql .= " WHERE p.entity IN (".getEntity('project').")"; // Only current entity or severals if permission ok - $sql .= " AND p.fk_statut = ".$projectstatic::STATUS_VALIDATED; // Only open projects + $sql .= " AND p.fk_statut = ".(int) $projectstatic::STATUS_VALIDATED; // Only open projects if (empty($user->rights->projet->all->lire)) { $sql .= " AND p.rowid IN (".$this->db->sanitize($projectsListId).")"; // public and assigned to, or restricted to company for external users } From d40a0ff32a1abf61688c90147551274ae0415d11 Mon Sep 17 00:00:00 2001 From: NextGestion Date: Sat, 6 May 2023 10:19:08 +0100 Subject: [PATCH 4/5] box_project_opportunities.php : Sanitize a string for SQL forging --- htdocs/core/boxes/box_project.php | 2 +- htdocs/core/boxes/box_project_opportunities.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/core/boxes/box_project.php b/htdocs/core/boxes/box_project.php index c88752ca3a8..1208ab4f95d 100644 --- a/htdocs/core/boxes/box_project.php +++ b/htdocs/core/boxes/box_project.php @@ -106,7 +106,7 @@ class box_project extends ModeleBoxes $sql .= " FROM ".MAIN_DB_PREFIX."projet as p"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe as s on p.fk_soc = s.rowid"; $sql .= " WHERE p.entity IN (".getEntity('project').")"; // Only current entity or severals if permission ok - $sql .= " AND p.fk_statut = ".(int) $projectstatic::STATUS_VALIDATED; // Only open projects + $sql .= " AND p.fk_statut = ".((int) $projectstatic::STATUS_VALIDATED); // Only open projects if (empty($user->rights->projet->all->lire)) { $sql .= " AND p.rowid IN (".$this->db->sanitize($projectsListId).")"; // public and assigned to, or restricted to company for external users } diff --git a/htdocs/core/boxes/box_project_opportunities.php b/htdocs/core/boxes/box_project_opportunities.php index c3a9dbec215..68161c78821 100644 --- a/htdocs/core/boxes/box_project_opportunities.php +++ b/htdocs/core/boxes/box_project_opportunities.php @@ -111,7 +111,7 @@ class box_project_opportunities extends ModeleBoxes $sql .= " WHERE p.entity IN (".getEntity('project').")"; // Only current entity or severals if permission ok $sql .= " AND p.usage_opportunity = 1"; $sql .= " AND p.fk_opp_status > 0"; - $sql .= " AND p.fk_statut IN (".$projectstatic::STATUS_DRAFT.", ".$projectstatic::STATUS_VALIDATED.")"; // draft and open projects + $sql .= " AND p.fk_statut IN (".$this->db->sanitize($projectstatic::STATUS_DRAFT.", ".$projectstatic::STATUS_VALIDATED).")"; // draft and open projects //$sql .= " AND p.fk_statut = ".((int) $projectstatic::STATUS_VALIDATED); // Only open projects if (empty($user->rights->projet->all->lire)) { $sql .= " AND p.rowid IN (".$this->db->sanitize($projectsListId).")"; // public and assigned to, or restricted to company for external users From 7c6e2891c9acd957dede28709daba7e954e21f8c Mon Sep 17 00:00:00 2001 From: NextGestion Date: Mon, 8 May 2023 17:19:10 +0100 Subject: [PATCH 5/5] Cancel customisation in htdocs/fourn/facture/card-rec.php file --- htdocs/fourn/facture/card-rec.php | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/htdocs/fourn/facture/card-rec.php b/htdocs/fourn/facture/card-rec.php index 7e6bd8d9b65..1e08deb7fd0 100644 --- a/htdocs/fourn/facture/card-rec.php +++ b/htdocs/fourn/facture/card-rec.php @@ -428,13 +428,8 @@ if (empty($reshook)) { $tva_tx = (GETPOST('tva_tx', 'alpha') ? GETPOST('tva_tx', 'alpha') : 0); $ref_fournisseur = (GETPOSTISSET('fourn_ref') ? GETPOST('fourn_ref', 'restricthtml') : ''); } else { - $idprod = GETPOST('idprodfournprice', 'int'); + $idprod = GETPOST('idprod', 'int'); $tva_tx = ''; - - if (!empty($conf->global->MAIN_DISABLE_FREE_LINES) && $idprod <= 0) { - setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("ProductOrService")), null, 'errors'); - $error++; - } } $qty = price2num(GETPOST('qty' . $predef, 'alpha'), 'MS', 2);