vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Qual: Fix casting/quoting of SQL fields (#38718)

Browse source 
# Qual: Fix casting/quoting of SQL fields

Fix several fields that were missing casts
This commit is contained in:
MDW 2026-06-11 23:44:12 +02:00 committed by GitHub
parent ceea1077a1
commit fc0369f8bd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
8 changed files with 21 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
htdocs/comm/propal/class/propaleligne.class.php
View file

@ -19,7 +19,7 @@
* Copyright (C) 2022 OpenDSI <support@open-dsi.fr>
* Copyright (C) 2022 Gauthier VERDOL <gauthier.verdol@atm-consulting.fr>
* Copyright (C) 2023 William Mead <william.mead@manchenumerique.fr>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -801,7 +801,7 @@ class PropaleLigne extends CommonObjectLine
}
$sql .= ", date_start=".(!empty($this->date_start) ? "'".$this->db->idate($this->date_start)."'" : "null");
$sql .= ", date_end=".(!empty($this->date_end) ? "'".$this->db->idate($this->date_end)."'" : "null");
$sql .= ", fk_unit=".(!$this->fk_unit ? 'NULL' : $this->fk_unit);
$sql .= ", fk_unit=".(!$this->fk_unit ? 'NULL' : ((int) $this->fk_unit));
// Multicurrency
$sql .= ", multicurrency_subprice=".price2num($this->multicurrency_subprice);

2
htdocs/commande/class/orderline.class.php
View file

@ -664,7 +664,7 @@ class OrderLine extends CommonOrderLine
if (!empty($this->rang)) {
$sql .= ", rang=".((int) $this->rang);
}
$sql .= " , fk_unit=".(!$this->fk_unit ? 'NULL' : $this->fk_unit);
$sql .= " , fk_unit=".(!$this->fk_unit ? 'NULL' : ((int) $this->fk_unit));
// Multicurrency
$sql .= " , multicurrency_subprice=".price2num($this->multicurrency_subprice);

4
htdocs/compta/facture/class/facture.class.php
View file

@ -5814,7 +5814,7 @@ class Facture extends CommonInvoice
$sql = 'SELECT rowid FROM '.MAIN_DB_PREFIX.'facture';
$sql .= ' WHERE situation_cycle_ref = '.((int) $this->situation_cycle_ref);
$sql .= ' AND situation_counter < '.((int) $this->situation_counter);
$sql .= ' AND entity = '.($this->entity > 0 ? $this->entity : $conf->entity);
$sql .= ' AND entity = '.($this->entity > 0 ? ((int) $this->entity) : ((int) $conf->entity));
$resql = $this->db->query($sql);
$res = array();
if ($resql && $this->db->num_rows($resql) > 0) {
@ -5892,7 +5892,7 @@ class Facture extends CommonInvoice
// No point in testing anything if we're not inside a cycle
$sql = 'SELECT max(situation_counter) FROM '.MAIN_DB_PREFIX.'facture';
$sql .= ' WHERE situation_cycle_ref = '.((int) $this->situation_cycle_ref);
$sql .= ' AND entity = '.($this->entity > 0 ? $this->entity : $conf->entity);
$sql .= ' AND entity = '.($this->entity > 0 ? ((int) $this->entity) : ((int) $conf->entity));
$resql = $this->db->query($sql);
if ($resql && $this->db->num_rows($resql) > 0 && $res = $this->db->fetch_array($resql)) {

6
htdocs/compta/facture/class/factureligne.class.php
View file

@ -527,7 +527,7 @@ class FactureLigne extends CommonInvoiceLine
$sql .= ' '.((int) $this->fk_code_ventilation).',';
$sql .= ' '.((int) $this->rang).',';
$sql .= ' '.((int) $this->special_code).',';
$sql .= ' '.(!empty($this->fk_fournprice) ? $this->fk_fournprice : "null").',';
$sql .= ' '.(!empty($this->fk_fournprice) ? ((int) $this->fk_fournprice) : "null").',';
$sql .= ' '.price2num($this->pa_ht).',';
$sql .= " '".$this->db->escape((string) $this->info_bits)."',";
$sql .= " ".price2num($this->total_ht).",";
@ -536,8 +536,8 @@ class FactureLigne extends CommonInvoiceLine
$sql .= " ".price2num($this->total_localtax1).",";
$sql .= " ".price2num($this->total_localtax2);
$sql .= ", ".((float) $this->situation_percent);
$sql .= ", ".(!empty($this->fk_prev_id) ? $this->fk_prev_id : "null");
$sql .= ", ".(!$this->fk_unit ? 'NULL' : $this->fk_unit);
$sql .= ", ".(!empty($this->fk_prev_id) ? ((int) $this->fk_prev_id) : "null");
$sql .= ", ".(!$this->fk_unit ? 'NULL' : ((int) $this->fk_unit));
$sql .= ", ".((int) $user->id);
$sql .= ", ".((int) $user->id);
$sql .= ", ".(int) $this->fk_multicurrency;

4
htdocs/contrat/class/contratligne.class.php
View file

@ -705,8 +705,8 @@ class ContratLigne extends CommonObjectLine
$sql .= " fk_user_ouverture = ".($this->fk_user_ouverture > 0 ? $this->fk_user_ouverture : "NULL").",";
$sql .= " fk_user_cloture = ".($this->fk_user_cloture > 0 ? $this->fk_user_cloture : "NULL").",";
$sql .= " commentaire = '".$this->db->escape($this->commentaire)."',";
$sql .= " fk_unit = ".(!$this->fk_unit ? 'NULL' : $this->fk_unit).",";
$sql .= " rang = ".(empty($this->rang) ? '0' : (int) $this->rang);
$sql .= " fk_unit = ".(!$this->fk_unit ? 'NULL' : ((int) $this->fk_unit)).",";
$sql .= " rang = ".(empty($this->rang) ? '0' : ((int) $this->rang));
$sql .= " WHERE rowid = ".((int) $this->id);
dol_syslog(get_class($this)."::update", LOG_DEBUG);

4
htdocs/core/class/extrafields.class.php
View file

@ -951,7 +951,7 @@ class ExtraFields
// We don't want on all entities, we delete all and current
$sql_del = "DELETE FROM ".$this->db->prefix()."extrafields";
$sql_del .= " WHERE name = '".$this->db->escape($attrname)."'";
$sql_del .= " AND entity IN (0, ".($entity === '' ? $conf->entity : $entity).")";
$sql_del .= " AND entity IN (0, ".($entity === '' ? ((int) $conf->entity) : ((int) $entity)).")";
$sql_del .= " AND elementtype = '".$this->db->escape($elementtype)."'";
} else {
// We want on all entities ($entities = '0'), we delete on all only (we keep setup specific to each entity)
@ -995,7 +995,7 @@ class ExtraFields
$sql .= " personal_data";
$sql .= ") VALUES (";
$sql .= "'".$this->db->escape($attrname)."',";
$sql .= " ".($entity === '' ? $conf->entity : $entity).",";
$sql .= " ".($entity === '' ? ((int) $conf->entity) : ((int) $entity)).",";
$sql .= " '".$this->db->escape($label)."',";
$sql .= " '".$this->db->escape($type)."',";
$sql .= " '".$this->db->escape($size)."',";

16
htdocs/ecm/class/ecmfiles.class.php
View file

@ -5,7 +5,7 @@
* Copyright (C) 2015 Raphaël Doursenaud <rdoursenaud@gpcsolutions.fr>
* Copyright (C) 2018 Francis Appels <francis.appels@yahoo.com>
* Copyright (C) 2019-2025 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
* Copyright (C) 2024-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -352,12 +352,12 @@ class EcmFiles extends CommonObject
$sql .= ' '.(!isset($extraparams) ? 'NULL' : "'".$this->db->escape($extraparams)."'").',';
$sql .= " '".$this->db->idate($this->date_c)."',";
$sql .= ' '.(!isset($this->date_m) || dol_strlen((string) $this->date_m) == 0 ? 'NULL' : "'".$this->db->idate($this->date_m)."'").',';
$sql .= ' '.(!isset($this->fk_user_c) ? $user->id : $this->fk_user_c).',';
$sql .= ' '.(!isset($this->fk_user_m) ? 'NULL' : $this->fk_user_m).',';
$sql .= ' '.(!isset($this->fk_user_c) ? ((int) $user->id) : ((int) $this->fk_user_c)).',';
$sql .= ' '.(!isset($this->fk_user_m) ? 'NULL' : ((int) $this->fk_user_m)).',';
$sql .= ' '.(!isset($this->acl) ? 'NULL' : "'".$this->db->escape($this->acl)."'").',';
$sql .= ' '.(!isset($this->src_object_type) ? 'NULL' : "'".$this->db->escape($this->src_object_type)."'").',';
$sql .= ' '.(!isset($this->src_object_id) ? 'NULL' : $this->src_object_id).',';
$sql .= ' '.(empty($this->agenda_id) ? 'NULL' : (int) $this->agenda_id);
$sql .= ' '.(!isset($this->src_object_id) ? 'NULL' : ((int) $this->src_object_id)).',';
$sql .= ' '.(empty($this->agenda_id) ? 'NULL' : ((int) $this->agenda_id));
$sql .= ')';
$this->db->begin();
@ -784,11 +784,11 @@ class EcmFiles extends CommonObject
$sql .= ' extraparams = '.(isset($extraparams) ? "'".$this->db->escape($extraparams)."'" : "null").',';
$sql .= ' date_c = '.(!isset($this->date_c) || dol_strlen($this->date_c) != 0 ? "'".$this->db->idate($this->date_c)."'" : 'null').',';
//$sql .= ' tms = '.(! isset($this->date_m) || dol_strlen((string) $this->date_m) != 0 ? "'".$this->db->idate($this->date_m)."'" : 'null').','; // Field automatically updated
$sql .= ' fk_user_m = '.($this->fk_user_m > 0 ? $this->fk_user_m : $user->id).',';
$sql .= ' fk_user_m = '.($this->fk_user_m > 0 ? ((int) $this->fk_user_m) : ((int) $user->id)).',';
$sql .= ' acl = '.(isset($this->acl) ? "'".$this->db->escape($this->acl)."'" : "null").',';
$sql .= ' src_object_id = '.($this->src_object_id > 0 ? $this->src_object_id : "null").',';
$sql .= ' src_object_id = '.($this->src_object_id > 0 ? ((int) $this->src_object_id) : "null").',';
$sql .= ' src_object_type = '.(isset($this->src_object_type) ? "'".$this->db->escape($this->src_object_type)."'" : "null").',';
$sql .= ' agenda_id = '.($this->agenda_id > 0 ? (int) $this->agenda_id : "null");
$sql .= ' agenda_id = '.($this->agenda_id > 0 ? ((int) $this->agenda_id) : "null");
$sql .= ' WHERE rowid='.((int) $this->id);
$this->db->begin();

2
htdocs/fourn/class/fournisseur.facture.ligne.class.php
View file

@ -734,7 +734,7 @@ class SupplierInvoiceLine extends CommonObjectLine
$sql .= " ".price2num($this->total_ttc).",";
$sql .= " ".price2num($this->total_localtax1).",";
$sql .= " ".price2num($this->total_localtax2);
$sql .= ", ".(!$this->fk_unit ? 'NULL' : $this->fk_unit);
$sql .= ", ".(!$this->fk_unit ? 'NULL' : ((int) $this->fk_unit));
$sql .= ", ".(int) $this->fk_multicurrency;
$sql .= ", '".$this->db->escape($this->multicurrency_code)."'";
$sql .= ", ".price2num($this->multicurrency_subprice);