From fc0369f8bd0c5fa86b07375fa76864eb575ff32a Mon Sep 17 00:00:00 2001 From: MDW Date: Thu, 11 Jun 2026 23:44:12 +0200 Subject: [PATCH] Qual: Fix casting/quoting of SQL fields (#38718) # Qual: Fix casting/quoting of SQL fields Fix several fields that were missing casts --- htdocs/comm/propal/class/propaleligne.class.php | 4 ++-- htdocs/commande/class/orderline.class.php | 2 +- htdocs/compta/facture/class/facture.class.php | 4 ++-- .../compta/facture/class/factureligne.class.php | 6 +++--- htdocs/contrat/class/contratligne.class.php | 4 ++-- htdocs/core/class/extrafields.class.php | 4 ++-- htdocs/ecm/class/ecmfiles.class.php | 16 ++++++++-------- .../class/fournisseur.facture.ligne.class.php | 2 +- 8 files changed, 21 insertions(+), 21 deletions(-) diff --git a/htdocs/comm/propal/class/propaleligne.class.php b/htdocs/comm/propal/class/propaleligne.class.php index d590db506c6..fbe86899e48 100644 --- a/htdocs/comm/propal/class/propaleligne.class.php +++ b/htdocs/comm/propal/class/propaleligne.class.php @@ -19,7 +19,7 @@ * Copyright (C) 2022 OpenDSI * Copyright (C) 2022 Gauthier VERDOL * Copyright (C) 2023 William Mead - * Copyright (C) 2024-2025 MDW + * Copyright (C) 2024-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -801,7 +801,7 @@ class PropaleLigne extends CommonObjectLine } $sql .= ", date_start=".(!empty($this->date_start) ? "'".$this->db->idate($this->date_start)."'" : "null"); $sql .= ", date_end=".(!empty($this->date_end) ? "'".$this->db->idate($this->date_end)."'" : "null"); - $sql .= ", fk_unit=".(!$this->fk_unit ? 'NULL' : $this->fk_unit); + $sql .= ", fk_unit=".(!$this->fk_unit ? 'NULL' : ((int) $this->fk_unit)); // Multicurrency $sql .= ", multicurrency_subprice=".price2num($this->multicurrency_subprice); diff --git a/htdocs/commande/class/orderline.class.php b/htdocs/commande/class/orderline.class.php index d62931effa7..8d9beccded9 100644 --- a/htdocs/commande/class/orderline.class.php +++ b/htdocs/commande/class/orderline.class.php @@ -664,7 +664,7 @@ class OrderLine extends CommonOrderLine if (!empty($this->rang)) { $sql .= ", rang=".((int) $this->rang); } - $sql .= " , fk_unit=".(!$this->fk_unit ? 'NULL' : $this->fk_unit); + $sql .= " , fk_unit=".(!$this->fk_unit ? 'NULL' : ((int) $this->fk_unit)); // Multicurrency $sql .= " , multicurrency_subprice=".price2num($this->multicurrency_subprice); diff --git a/htdocs/compta/facture/class/facture.class.php b/htdocs/compta/facture/class/facture.class.php index dde8ef144d1..613982ded75 100644 --- a/htdocs/compta/facture/class/facture.class.php +++ b/htdocs/compta/facture/class/facture.class.php @@ -5814,7 +5814,7 @@ class Facture extends CommonInvoice $sql = 'SELECT rowid FROM '.MAIN_DB_PREFIX.'facture'; $sql .= ' WHERE situation_cycle_ref = '.((int) $this->situation_cycle_ref); $sql .= ' AND situation_counter < '.((int) $this->situation_counter); - $sql .= ' AND entity = '.($this->entity > 0 ? $this->entity : $conf->entity); + $sql .= ' AND entity = '.($this->entity > 0 ? ((int) $this->entity) : ((int) $conf->entity)); $resql = $this->db->query($sql); $res = array(); if ($resql && $this->db->num_rows($resql) > 0) { @@ -5892,7 +5892,7 @@ class Facture extends CommonInvoice // No point in testing anything if we're not inside a cycle $sql = 'SELECT max(situation_counter) FROM '.MAIN_DB_PREFIX.'facture'; $sql .= ' WHERE situation_cycle_ref = '.((int) $this->situation_cycle_ref); - $sql .= ' AND entity = '.($this->entity > 0 ? $this->entity : $conf->entity); + $sql .= ' AND entity = '.($this->entity > 0 ? ((int) $this->entity) : ((int) $conf->entity)); $resql = $this->db->query($sql); if ($resql && $this->db->num_rows($resql) > 0 && $res = $this->db->fetch_array($resql)) { diff --git a/htdocs/compta/facture/class/factureligne.class.php b/htdocs/compta/facture/class/factureligne.class.php index 3eb4a0f9ded..0e8ae79e140 100644 --- a/htdocs/compta/facture/class/factureligne.class.php +++ b/htdocs/compta/facture/class/factureligne.class.php @@ -527,7 +527,7 @@ class FactureLigne extends CommonInvoiceLine $sql .= ' '.((int) $this->fk_code_ventilation).','; $sql .= ' '.((int) $this->rang).','; $sql .= ' '.((int) $this->special_code).','; - $sql .= ' '.(!empty($this->fk_fournprice) ? $this->fk_fournprice : "null").','; + $sql .= ' '.(!empty($this->fk_fournprice) ? ((int) $this->fk_fournprice) : "null").','; $sql .= ' '.price2num($this->pa_ht).','; $sql .= " '".$this->db->escape((string) $this->info_bits)."',"; $sql .= " ".price2num($this->total_ht).","; @@ -536,8 +536,8 @@ class FactureLigne extends CommonInvoiceLine $sql .= " ".price2num($this->total_localtax1).","; $sql .= " ".price2num($this->total_localtax2); $sql .= ", ".((float) $this->situation_percent); - $sql .= ", ".(!empty($this->fk_prev_id) ? $this->fk_prev_id : "null"); - $sql .= ", ".(!$this->fk_unit ? 'NULL' : $this->fk_unit); + $sql .= ", ".(!empty($this->fk_prev_id) ? ((int) $this->fk_prev_id) : "null"); + $sql .= ", ".(!$this->fk_unit ? 'NULL' : ((int) $this->fk_unit)); $sql .= ", ".((int) $user->id); $sql .= ", ".((int) $user->id); $sql .= ", ".(int) $this->fk_multicurrency; diff --git a/htdocs/contrat/class/contratligne.class.php b/htdocs/contrat/class/contratligne.class.php index cf681b8d414..877f99d501d 100644 --- a/htdocs/contrat/class/contratligne.class.php +++ b/htdocs/contrat/class/contratligne.class.php @@ -705,8 +705,8 @@ class ContratLigne extends CommonObjectLine $sql .= " fk_user_ouverture = ".($this->fk_user_ouverture > 0 ? $this->fk_user_ouverture : "NULL").","; $sql .= " fk_user_cloture = ".($this->fk_user_cloture > 0 ? $this->fk_user_cloture : "NULL").","; $sql .= " commentaire = '".$this->db->escape($this->commentaire)."',"; - $sql .= " fk_unit = ".(!$this->fk_unit ? 'NULL' : $this->fk_unit).","; - $sql .= " rang = ".(empty($this->rang) ? '0' : (int) $this->rang); + $sql .= " fk_unit = ".(!$this->fk_unit ? 'NULL' : ((int) $this->fk_unit)).","; + $sql .= " rang = ".(empty($this->rang) ? '0' : ((int) $this->rang)); $sql .= " WHERE rowid = ".((int) $this->id); dol_syslog(get_class($this)."::update", LOG_DEBUG); diff --git a/htdocs/core/class/extrafields.class.php b/htdocs/core/class/extrafields.class.php index 43a70482a71..1cc07e56023 100644 --- a/htdocs/core/class/extrafields.class.php +++ b/htdocs/core/class/extrafields.class.php @@ -951,7 +951,7 @@ class ExtraFields // We don't want on all entities, we delete all and current $sql_del = "DELETE FROM ".$this->db->prefix()."extrafields"; $sql_del .= " WHERE name = '".$this->db->escape($attrname)."'"; - $sql_del .= " AND entity IN (0, ".($entity === '' ? $conf->entity : $entity).")"; + $sql_del .= " AND entity IN (0, ".($entity === '' ? ((int) $conf->entity) : ((int) $entity)).")"; $sql_del .= " AND elementtype = '".$this->db->escape($elementtype)."'"; } else { // We want on all entities ($entities = '0'), we delete on all only (we keep setup specific to each entity) @@ -995,7 +995,7 @@ class ExtraFields $sql .= " personal_data"; $sql .= ") VALUES ("; $sql .= "'".$this->db->escape($attrname)."',"; - $sql .= " ".($entity === '' ? $conf->entity : $entity).","; + $sql .= " ".($entity === '' ? ((int) $conf->entity) : ((int) $entity)).","; $sql .= " '".$this->db->escape($label)."',"; $sql .= " '".$this->db->escape($type)."',"; $sql .= " '".$this->db->escape($size)."',"; diff --git a/htdocs/ecm/class/ecmfiles.class.php b/htdocs/ecm/class/ecmfiles.class.php index 3a38e1a0c8f..3dbfc6f401e 100644 --- a/htdocs/ecm/class/ecmfiles.class.php +++ b/htdocs/ecm/class/ecmfiles.class.php @@ -5,7 +5,7 @@ * Copyright (C) 2015 Raphaël Doursenaud * Copyright (C) 2018 Francis Appels * Copyright (C) 2019-2025 Frédéric France - * Copyright (C) 2024-2025 MDW + * Copyright (C) 2024-2026 MDW * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -352,12 +352,12 @@ class EcmFiles extends CommonObject $sql .= ' '.(!isset($extraparams) ? 'NULL' : "'".$this->db->escape($extraparams)."'").','; $sql .= " '".$this->db->idate($this->date_c)."',"; $sql .= ' '.(!isset($this->date_m) || dol_strlen((string) $this->date_m) == 0 ? 'NULL' : "'".$this->db->idate($this->date_m)."'").','; - $sql .= ' '.(!isset($this->fk_user_c) ? $user->id : $this->fk_user_c).','; - $sql .= ' '.(!isset($this->fk_user_m) ? 'NULL' : $this->fk_user_m).','; + $sql .= ' '.(!isset($this->fk_user_c) ? ((int) $user->id) : ((int) $this->fk_user_c)).','; + $sql .= ' '.(!isset($this->fk_user_m) ? 'NULL' : ((int) $this->fk_user_m)).','; $sql .= ' '.(!isset($this->acl) ? 'NULL' : "'".$this->db->escape($this->acl)."'").','; $sql .= ' '.(!isset($this->src_object_type) ? 'NULL' : "'".$this->db->escape($this->src_object_type)."'").','; - $sql .= ' '.(!isset($this->src_object_id) ? 'NULL' : $this->src_object_id).','; - $sql .= ' '.(empty($this->agenda_id) ? 'NULL' : (int) $this->agenda_id); + $sql .= ' '.(!isset($this->src_object_id) ? 'NULL' : ((int) $this->src_object_id)).','; + $sql .= ' '.(empty($this->agenda_id) ? 'NULL' : ((int) $this->agenda_id)); $sql .= ')'; $this->db->begin(); @@ -784,11 +784,11 @@ class EcmFiles extends CommonObject $sql .= ' extraparams = '.(isset($extraparams) ? "'".$this->db->escape($extraparams)."'" : "null").','; $sql .= ' date_c = '.(!isset($this->date_c) || dol_strlen($this->date_c) != 0 ? "'".$this->db->idate($this->date_c)."'" : 'null').','; //$sql .= ' tms = '.(! isset($this->date_m) || dol_strlen((string) $this->date_m) != 0 ? "'".$this->db->idate($this->date_m)."'" : 'null').','; // Field automatically updated - $sql .= ' fk_user_m = '.($this->fk_user_m > 0 ? $this->fk_user_m : $user->id).','; + $sql .= ' fk_user_m = '.($this->fk_user_m > 0 ? ((int) $this->fk_user_m) : ((int) $user->id)).','; $sql .= ' acl = '.(isset($this->acl) ? "'".$this->db->escape($this->acl)."'" : "null").','; - $sql .= ' src_object_id = '.($this->src_object_id > 0 ? $this->src_object_id : "null").','; + $sql .= ' src_object_id = '.($this->src_object_id > 0 ? ((int) $this->src_object_id) : "null").','; $sql .= ' src_object_type = '.(isset($this->src_object_type) ? "'".$this->db->escape($this->src_object_type)."'" : "null").','; - $sql .= ' agenda_id = '.($this->agenda_id > 0 ? (int) $this->agenda_id : "null"); + $sql .= ' agenda_id = '.($this->agenda_id > 0 ? ((int) $this->agenda_id) : "null"); $sql .= ' WHERE rowid='.((int) $this->id); $this->db->begin(); diff --git a/htdocs/fourn/class/fournisseur.facture.ligne.class.php b/htdocs/fourn/class/fournisseur.facture.ligne.class.php index 5e744047fbf..e2fdaa94edc 100644 --- a/htdocs/fourn/class/fournisseur.facture.ligne.class.php +++ b/htdocs/fourn/class/fournisseur.facture.ligne.class.php @@ -734,7 +734,7 @@ class SupplierInvoiceLine extends CommonObjectLine $sql .= " ".price2num($this->total_ttc).","; $sql .= " ".price2num($this->total_localtax1).","; $sql .= " ".price2num($this->total_localtax2); - $sql .= ", ".(!$this->fk_unit ? 'NULL' : $this->fk_unit); + $sql .= ", ".(!$this->fk_unit ? 'NULL' : ((int) $this->fk_unit)); $sql .= ", ".(int) $this->fk_multicurrency; $sql .= ", '".$this->db->escape($this->multicurrency_code)."'"; $sql .= ", ".price2num($this->multicurrency_subprice);