vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix sanitize

Browse source
This commit is contained in:
Laurent Destailleur 2026-06-02 11:04:30 +02:00
parent 47ad274b0b
commit fcfff02f5e
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
htdocs/compta/cashcontrol/cashcontrol_card.php
View file

@ -350,7 +350,7 @@ if ($action == "valid" && $permissiontoadd) { // validate = close
$sql .= " ".MAIN_DB_PREFIX."c_paiement as cp";
$sql .= " WHERE pf.fk_facture = f.rowid AND p.rowid = pf.fk_paiement AND cp.id = p.fk_paiement";
$sql .= " AND ".$db->sanitize($modulesourcefilter)." = '".$db->escape($posmodule)."'";
$sql .= " AND ".$possource." = '".$db->escape($terminalid)."'";
$sql .= " AND ".$db->sanitize($possource)." = '".$db->escape($terminalid)."'";
$sql .= " AND ".$db->sanitize($fieldentity)." = ".((int) $conf->entity); // Never share entities for features related to accountancy
$sql .= " AND ".$db->sanitize($datefilter)." <= '".$db->idate((int) $datee)."'";
if ($key == 'cash') {

2
htdocs/compta/cashcontrol/report.php
View file

@ -147,7 +147,7 @@ $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."bank as b ON p.fk_bank = b.rowid,";
$sql .= " ".MAIN_DB_PREFIX."c_paiement as cp";
$sql .= " WHERE pf.fk_facture = f.rowid AND p.rowid = pf.fk_paiement AND cp.id = p.fk_paiement";
$sql .= " AND ".$db->sanitize($modulesourcefilter)." = '".$db->escape($posmodule)."'";
$sql .= " AND ".$possource." = '".$db->escape($terminalid)."'";
$sql .= " AND ".$db->sanitize($possource)." = '".$db->escape($terminalid)."'";
$sql .= " AND ".$db->sanitize($datefilter)." BETWEEN '".$db->idate($dates)."' AND '".$db->idate($datee)."'";
$sql .= " AND ".$db->sanitize($fieldentity)." = ".((int) $conf->entity); // Never share entities for features related to accountancy
$sql .= " ORDER BY ".$db->sanitize($datefilter)." ASC, rowid ASC"; // Required so later we can use the parameter $previoushash of checkSignature()