* QUAL: Add SqlInjectionPlugin to detect unsafe SQL variable usage
# QUAL: Add SqlInjectionPlugin to detect unsafe SQL variable usage
This commit adds a new SqlInjectionPlugin to the Phan configuration, which helps detect unsafe SQL variable usage in the Dolibarr codebase. The plugin checks for variables used in sql expressions that are not properly escaped, cast, or protected by safe methods.
* Qual: Add SqlInjection exceptions to Phan baseline
* Qual: Add SqlInjection exceptions to Phan baseline
* Qual: Update baseline.txt to remove SqlInjection suppressions
The SqlInjection suppressions have been removed from the baseline.txt file.
This reenables the notification of "unfixed" cases.
* Qual: SQL injection detection for missing quotes on escaped strings
# Qual: SQL injection detection for missing quotes on escaped strings
In summary: report lines with missing quotes as in `" WHERE ".$db->escape($value)." OR "`.
* Qual: Fix code for SqlInjection analysis
# Qual: Fix code for SqlInjection analysis
Rewrite some escape calls, change escape() in sanitize(), rename variable, ignore SqlInjection notices.
* Qual: Update baseline
Allow some SqlInjection* notices, to be fixed later or already fixed in develop.
# Qual: Add missing sqlite3 stub for Phan
About 43 Phan notices on https://cti.dolibarr.org are present
because of missing information about SQLite3.
This stub and configuration change adds the information.
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
# Qual: Update Phan baseline and config using global variables for dolibarr_*
- Add new global variables to config.php to improve static analysis
- Remove dolibarr_* global variable references in filefunc.inc.php
- Update Phan baseline
* Qual: Fix phpstan notice with cast
* Qual: Fix initialiser (phpstan) and narrow some types
* Qual: Fix typing for object->type field (phpstan)
* Qual: Update preg_quote usage in step2.php
# Qual: Ignore false phpstan positive for preg_match
Add comment to ignore phpstan warning for preg_match argument
* Qual: Extend accepted types for arrayoptions (phpstan)
* Qual: Fix type hint typo
* Qual: Fix type for contact_id assignment
* Qual: Add menuonly as allowed reloadmode
* Qual: Add PHPStan ignore comments for argument.type
* Qual: Ignore unused parameter in constructors (PHPStan)
* Qual: Add type hint for $TMsg (PHPStan)
* Qual: Cast array values to match expected type (PHPStan)
* Qual: Cast $remise_percent_ligne to float (PHPStan)
* Qual: Add array specifier to GETPOST for correct type (PHPStan)
* Qual: Update sumSituation() argument types
* Qual: Cast value to string for printStdColumnContent (PHPStan)
* Qual: Ignore PHPStan notice for autoload function return value
* Qual: Fix type of argument to Menubase::recur (PHPStan)
* Qual: Fix return type hint (PHPStan)
* Qual: Add $dolibarr_main_db_type as default global
* Qual: Update Phan baseline (due to PHPStan fix)
* Changes to follow mvc logic
* Reworked admin page and form to add lines
* Reworked adding line logic
* Adding options when editing subtotal lines
* Fix translations
* Fixed errors/displays and started pdf
* Color for subtotals pdf lines
* FIX display of subtotal totht
* Added pdf azur for propal
* Fix duplicate translation
* Added subtotal support for facture pdf
* Added subtotal support for commande pdf
* Improve UI/translations
* Restored old pdf
* Info to warn user for unsupported pdf
* Added title lines VAT rate and discount support
This is meant for future feature wich is block mass changing vat rate
and discount percentage
* Working on block apply vat and discount
* Added buttons for block actions
* Handle editing vat and discount for subtotal lines
* Editing vat and discount for subtotal lines bloc working
* Added possibility to move by block
* Updated adding and updating a subtotal line
* Improved vat and discount block update
* Improvement for block vat/discount and line edition
Editing a title line edits the corresponding subtotal line
* Improvement for moving by block
* Bad tile or st line placement managing
* Improved bad title or st line placement managing
* Adding subtotal line improved
Adding a subtotal line adds it right under its corresponding title
* Improved deleting subtotal line
Added possibility to choose if you want to delete the corresponding
subtotal line when deleting a title line
* Preventing too high level titles to be created
* Create and update line errors managing
* Improved bad title or st line placement managing
* Improved st line creation
* improve headers
* fix bad block placement managing
* fix adding st line not working if duplicates titles
* fix translations
* Fix block update
* FIX special chars bug
If special char like " ' " was used in title it could be converted to
special char entity.
* Prepare for pdf options
Pdf options like page break befor title should be shown as a picto if activated on a subtotal line on a document
* Added option managing
* Improved subtotal options and PDF integration
* Code refactor
* Action name/Error managment/PDF refreshing
When adding or updating a subtotal line
* Reformat
* Reworked subtotal options database managment
* Changed access to special code
* Remove unecessary call to php trait
* Changed definition of subtotals special code constant
* Reworked align on PDF
* Removed unecessary function and improved error managment
* Typo fix and removed treated todos
* Post typo changed for to better match subtotals names
* Disabled edit if status is not draft
* Changed way subtotals options are stored
* Added view managing when creating a document form an other
* Improved creating document from an other
Can check subtotals lines with table head checkbox and removed highlight
class for better UI.
* Make include of subtotals tpl more clear
* Manage centered or justified case
If user chose to center or justify, we don't change nothing
* Improved pdf
* Removed unecessary code block
* optimisation
* Code sniffer fix
* Code sniffer fix
* Code sniffer fix
* Code sniffer fix
* Code sniffer fix and added missing translation
* Fix php code sniffer
* Reload page when setup saved on subtotals admin page
* Fix php code sniffer
* pjan fix
* phan fix
* phan fix
* phan fix
* phan fix
* phan fix
* phan fix
* phan fix
* phan fix
* phan fix
* phan fix
* phan fix
* php warning fix
* php warning fix
* php phan fix
* php phan fix
* php phan fix
* Fix bug admin page not loading because of const not defined
* php phan fix
* php phan fix
* FIX subtotals admin page display
* php phan fix
* FIX php phan
* Fix bugs and langs
* Fix bug pdf align
* Replace include by require
* Add headers to avoid refreshing and adding unwanted lines
* Fix phan
* Add GETPOST check for security
* Fix phan
* Fix phan
* Fix phan
* Subtotal option when creating a document from another
* Fix phan
* Add field subtotal options for subtotal lines
* Fix phan
* Fix phan
* Fix phan
* Update to follow mvc
* Fix php phan
* Fix php phan
* Fix phpstan/phan
* Fix phpstan
* Fix phpstan
* Fix phpstan
* Fix phpstan
* Fix phpstan
* Update to switch to extraparams
* Update to switch to extraparams
* Retrieve extraparams from db to objectline
* Modified last things to switch to extraparams
* Cleaning unnecessary code lines
* Fix php-stan
* Section subtotal in extraparams to differentiate if needed for further devs
* Fix phan
* Keep extraparams when creating from another object
* Change default value to false when creating a subtotal line
* Fix clone would not keep extraparams in new object
* Fix dark subtotal line background color
Fix when a subtotal background color is too dark and edit pencil or
delete trash could not be seen
* Fix typo
* Fix typo
* Added subtotals for facturerec
* Fix precommit
* Added extraparams when creating rec from fac and other way
* Fix phan
* Fix objectline null
* Desactivating block vat / discount update for facturerec
* reformating code
* Added expeditions for subtotal
* Save extraparams for shipping lines
* Display of subtotals lines in shipments
* Display when creating facture from shipments
* Improve display of lines and invoice creation from shipments
* Fix error if missing line rang
* Deleted duplicate
* Added deletion of subtotal line in shipping documents
* Not including subtotal lines if there is no product line in between
* Update get subtotal lines in shipment docs to disable
* Delete possibility to edit subtotal lines in shipments
* Handle pdf for shipment
* Handle conf stock or shipment supporting services
* Fix precommit
* Fix duplicate name creating bug
* Fix bug where id could be changed by the line id and would create bug
* Deleted subtotal lines when STOCK_SUPPORTS_SERVICES is enabled and block would only have service lines
* Disable shipments in admin modules
Shimpements subtotals lines are only created from commands
* Fixing phan and stan
* Deleted unused template and phan fix
* Fix phan
* Fix phan
* Fix phan
* FIX: phan
* Fix template bug
If document was not in subtotal scope and would use a template used by
subtotal it would create an error.
* Fix php-stan
* Fix bad display when modules and confs were activated
* Fix php codesniffer
* Excluding subtotal lines when mass updating
* Fix shipments service lines exluded + showing subtotal line with specific configs
* Fix line display with situation invoices + bug block line update
* Added ODT managment
This works with invoices but has not been tested with other documents
* Fix bug when editing VAT/discount by block
* Fix error raised when subtotal line added
Subtotal line had no fk_product and raised the error but we want this
line to have no fk product
* Fix precommit
* Added ODT template for documents that uses subtotals
This template can be usefull to understand how to create an odt template
using subtotals module
* Fix phan
* Fix phan
* fix: buttons showing in bad document status
* clean: unwanted commited files
* add: table examples to use with subtotals on ODT templates
* fix: Unwanted print of value when creating a document from another
* feat: renaming for better understanding
* feat: Improved templates for documents related to subtotals
---------
Co-authored-by: Marc de Lima Lucio <68746600+marc-dll@users.noreply.github.com>
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
# Qual: Enable and fix phan notices for scripts
phpstan is already enable on scripts, so there is no reason to not
enable phan.
This enables phan and fixes the notices at the same time
# Qual: Update baseline, enable PhanTypeMismatchArgument
Update the baseline for fixes.
Enable PhanTypeMismatchArgument as this is being fixed and to avoid
that new cases occur in files where these are fixed.
Only about 3800 cases remain, was more than 12000 when starting with Phan.
* Qual: Fix FunctionArray phan notices
* Fix class name in typing of htdocs/modulebuilder/index.php
* Fix customreports phpdoc
* Adjust file type after completeFileArrayWithDatabaseInfo
* Further phpdoc typing improvements
* More phpdoc
* Improve typing with cast on position field
* Force phpstan version
* Add phpstan exception
* Fix array index type + adjust phan config comment
* Qual: fix commonstickergen..don.class
* Fix notifications for pdf_paiement...cronjob.class
* Qual: Fix notifications for emailcollector..price_parser.class
* Ensure that NULL is used in the database when fk's are 0/empty
* Fix notifications for pdf_paiement...cronjob.class
* Cope with updated phpstan, and make fk_origin_stock int in multiple locations
* Qual: Fix ticket.class notices
* Do not analyze custom
* Fix: Correct reference to cache (+phpdoc)
* Update baseline, ignore everything in custom
* Qual: Fix notices in files related to ticket class
# Qual: Ignore PhanTypeSuspiciousNonTraversableForeach
PhanTypeSuspiciousNonTraversableForeach reports on the use of
`foreach ($object as $key => value)` which is valid accross
tested php versions (at least since PHP7.0).
So suppressing this notice.
* Qual: Nullable mysoc hint
# Qual: Nullable mysoc hint
$mysoc can be nullable resulting in issues (#31387) so
it is best to detect these cases with static analysis
* Prevent null assignment
* Qual: Enable & fix or ignore Invalid DimOffset
# Qual: Enable & fix or ignore Invalid DimOffset
The Invalid DimOffset notices occur when array keys are defined and
the index used is not amongst the known array keys.
This PR enables these notices and fixes array definitions when needed,
or ignores the notices locally if it's a false positive, or in the
baseline.txt when it does not seem to be a false positive so that
it can be fixed later
* Nullable object typing in function signature not ok for 7.0/8.4
Can't user '?User' as argument type for PHP7.0 which is required by PHP8.4.
Therefore, removing the typing specification in the function definition
---------
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* Qual: 🛟 Fix typing
Qual: Fix typing
Fix some typing currently failing ci in develop.
* Fix typing for grabimages
* Qual: Fix new UndeclaredGlobalVariable notices & enable
# Qual: Fix new UndeclaredGlobalVariable notices & enable
This fixes several new notices regarding 'undeclared globals' which
mostly correspond to missing initialisations in views and some real
bugs where the variable name was incorrect.
Some less obvious cases are unsolved and ignored (adherents/list,
and fourn/commande/card).
This is in preparation of fixing the notices in the other files
where the baseline was already set to ignore them where most just
need a phan-var-force declaration which will help with verifying
type compatibity and object member verifications
* Qual: Disable global CommonObject $obj type (phan)
# Qual: Disable global CommonObject $obj type (phan)
This removes the global typing hint for $obj from the phan configuration
* Fix issues with undeclared $obj
* Fix issues with undeclared $obj
* Fix issues with undeclared $obj
# Qual: Enable phan notices regarding array definitions
This configuration change in phan will report NEW array types in phpdoc
that are not specific about the array members.
At level 6, phpstan also expects this.
The exceptions in baseline.txt ensure this is only reported on new files
or files were these missing typing directives are already fixed.
* Allow null for buyer, and force '' for in printObjectLine(s)
* Allow null for Contact in show_actions_done
* Qual: Enable phan on modulebuilder
# Qual: Enable phan on modulebuilder
Most files of the modulebuilder template can be checked as regular files.
It will help improve the template
* Update baseline (enable modulebuilder notices)
* Add properties that are expected to exist on modules_boxes
* Qual: Ignore false positive (phan)
* Set phpdoc type to include null on formAddObjectLine
* Qual: Fixes for modulebuilder (phan, phpstan, bugs, format)
* Fix phpcs for intracom
* Make ModeleBoxes:showBox() signature match child class's
* Fix *box::showBox() phpdoc types
* Update index.php
---------
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
