vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SEC: Correct SQL escaping for signed_status (#38943)

Browse source 
* SEC: Correct SQL escaping for signed_status

# SEC: Correct SQL escaping for signed_status

Escape signed_status using $db->escape instead of urlencode.

* Update list.php

* Update list.php

---------

Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
This commit is contained in:
MDW 2026-06-21 16:52:51 +02:00 committed by GitHub
parent b5a8a01eae
commit edcde65dfc
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
htdocs/expedition/list.php
View file

@ -6,7 +6,7 @@
* Copyright (C) 2019 Nicolas ZABOURI <info@inovea-conseil.com>
* Copyright (C) 2020 Thibault FOUCART <support@ptibogxiv.net>
* Copyright (C) 2023 Christophe Battarel <christophe@altairis.fr>
* Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024 Benjamin Falière <benjamin.faliere@altairis.fr>
* Copyright (C) 2024 Vincent Maury <vmaury@timgroup.fr>
* Copyright (C) 2024 William Mead <william.mead@manchenumerique.fr>
@ -743,13 +743,13 @@ if ($search_status != '' && $search_status >= 0) {
$sql .= " AND e.fk_statut = ".((int) $search_status);
}
if ($search_signed_status != '' && $search_signed_status >= 0) {
$sql .= ' AND e.signed_status = '.urlencode($search_signed_status);
$sql .= " AND e.signed_status = ".((int) $search_signed_status);
}
if ($search_ref_customer != '') {
$sql .= natural_search('e.ref_customer', $search_ref_customer);
}
if ($search_billed != '' && $search_billed >= 0) {
$sql .= ' AND e.billed = '.((int) $search_billed);
$sql .= " AND e.billed = ".((int) $search_billed);
}
if ($search_town) {
$sql .= natural_search('s.town', $search_town);