* QUAL: Add SqlInjectionPlugin to detect unsafe SQL variable usage
# QUAL: Add SqlInjectionPlugin to detect unsafe SQL variable usage
This commit adds a new SqlInjectionPlugin to the Phan configuration, which helps detect unsafe SQL variable usage in the Dolibarr codebase. The plugin checks for variables used in sql expressions that are not properly escaped, cast, or protected by safe methods.
* Qual: Add SqlInjection exceptions to Phan baseline
* Qual: Add SqlInjection exceptions to Phan baseline
* Qual: Update baseline.txt to remove SqlInjection suppressions
The SqlInjection suppressions have been removed from the baseline.txt file.
This reenables the notification of "unfixed" cases.
* Qual: SQL injection detection for missing quotes on escaped strings
# Qual: SQL injection detection for missing quotes on escaped strings
In summary: report lines with missing quotes as in `" WHERE ".$db->escape($value)." OR "`.
* Qual: Fix code for SqlInjection analysis
# Qual: Fix code for SqlInjection analysis
Rewrite some escape calls, change escape() in sanitize(), rename variable, ignore SqlInjection notices.
* Qual: Update baseline
Allow some SqlInjection* notices, to be fixed later or already fixed in develop.
* FIX: Do not quote NULL for fk_user_author & fk_element on insert
* Qual: Remove unnecessary quotes around integer values in SQL queries
# Qual: Remove unnecessary quotes around integer values in SQL queries
Removed unnecessary single quotes around integer values in SQL queries across multiple files.
* Qual: Fix phpstan notice with cast
* Qual: Fix initialiser (phpstan) and narrow some types
* Qual: Fix typing for object->type field (phpstan)
* Qual: Update preg_quote usage in step2.php
# Qual: Ignore false phpstan positive for preg_match
Add comment to ignore phpstan warning for preg_match argument
* Qual: Extend accepted types for arrayoptions (phpstan)
* Qual: Fix type hint typo
* Qual: Fix type for contact_id assignment
* Qual: Add menuonly as allowed reloadmode
* Qual: Add PHPStan ignore comments for argument.type
* Qual: Ignore unused parameter in constructors (PHPStan)
* Qual: Add type hint for $TMsg (PHPStan)
* Qual: Cast array values to match expected type (PHPStan)
* Qual: Cast $remise_percent_ligne to float (PHPStan)
* Qual: Add array specifier to GETPOST for correct type (PHPStan)
* Qual: Update sumSituation() argument types
* Qual: Cast value to string for printStdColumnContent (PHPStan)
* Qual: Ignore PHPStan notice for autoload function return value
* Qual: Fix type of argument to Menubase::recur (PHPStan)
* Qual: Fix return type hint (PHPStan)
* Qual: Add $dolibarr_main_db_type as default global
* Qual: Update Phan baseline (due to PHPStan fix)
* Qual: Ignore PhanUndeclaredProperty for specific lines
* Fix: Update payment mode reference in PDF generation
# Fix: Update payment mode reference in PDF generation
The payment mode reference in the PDF generation was incorrectly using `type_payment_code`, an unknown property in Salary.
It has been updated to use `type_code` as used elsewhere for the same purpose.
* Qual: Typing of several DDLUpdateField field_desc items made optional
# Qual: Typing of several DDLUpdateField field_desc items made optional
Not all fields are required for updateing the DB typing, and ExtraFields was not providing all of them.
* Qual: Update typing for phan notices
# Qual: Update typing for phan notices
Fix typing mismatches
* Qual: Fix extrafields typing in objectline_create.tpl.php
# Qual: Fix extrafields typing in objectline_create.tpl.php
- Update typing for phan
* Qual: Fix typing for Phan & re-use encrypted password when requested
# Qual: Fix typing for Phan & re-use encrypted password when requested
- Added a cast to string for the crypted password to hint phan that it returns the string version (not the array)
- Added a check to ensure the password is not already crypted before generating a new password.
- Updated the type hints for parameters `$changelater`, `$notrigger`, `$nosyncmember`, and `$passwordalreadycrypted` to include the range of possible values.
- Updated the return type hint for the `setPassword` method to include the range of possible error values.
* Qual: Fix file argument to showPreview() calls
# Qual: Fix file argument to showPreview() calls
Fix argument type mismatches by adjusting '$file' arguments in showPreview calls.
* Qual: Update login_c type to string
# Qual: Update login_c type to string
login_c is username from db.
* Qual: Update type hints in treeview.lib.php
# Qual: Update type hints in treeview.lib.php
Update type hints for static analysis.
* Qual: Add null check for objecttmp in selectForFormsList
# Qual: Add null check for objecttmp in selectForFormsList
Add null check for objecttmp before calling selectForFormsList to ensure static analysis
* Qual: Fix phan through null check on object argument
# Qual: Fix phan through null check on object argument
- Do null check to avoid null parameter (fix phan);
- Set more specific type for argument.
* Qual: Change type hint of $remise_percent parameter to float
# Qual: Change type hint of $remise_percent parameter to float
DB type is float, so correct arg type to fix phan notice.
* Qual: Ignore some phan notices
The descriptions for the linkedObjectsFullLoaded and oldcopy properties have been updated to avoid modification by code formatting tools
* Qual: Update phan baseline
* Qual: Cast remise_percent to float to match typing requirements
* Qual: Cast label to string to help static analysis
* Qual: Update date_cancel property type and assignment
To fix phan notices:
- The date_cancel property type was changed from 'int|string' to 'int|""' to match return type from jdate().
- Additionally, the assignment of date_cancel was updated to use dol_now() instead of $this->db->idate(dol_now()).
* Qual: Provide the expected user_id instead of the User object
Changed the user fetch logic from using `user_author` to `user_creation_id`
* Qual: Correct bool argument from 0 to false ($fill)
* Qual/Fix: Correct date converted to dol_print_date
* Qual: Fix argument type for addline()
* Qual: Update Phan baseline.txt
# Qual: Update fields phpdoc to include fields that are defined/used in some cases
comment, copytoclipboard, autofocusoncreated are documented and used in some cases for the
$fields definition
* Qual: Enable & fix or ignore Invalid DimOffset
# Qual: Enable & fix or ignore Invalid DimOffset
The Invalid DimOffset notices occur when array keys are defined and
the index used is not amongst the known array keys.
This PR enables these notices and fixes array definitions when needed,
or ignores the notices locally if it's a false positive, or in the
baseline.txt when it does not seem to be a false positive so that
it can be fixed later
* Nullable object typing in function signature not ok for 7.0/8.4
Can't user '?User' as argument type for PHP7.0 which is required by PHP8.4.
Therefore, removing the typing specification in the function definition
---------
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* Qual: Fix PhanTypeMismatchProperty and some other phan notices
* Qual: Phan fixes for BOM
* Phan - fix fields
* fixup! Qual: Phan fixes for BOM
* Fix phpstan double array keys for syslog
* Fix $fields phpdoc
* Fix phan typing issues with intermediate var and ??
* Fix phan typing issue with ?? operator
* Ignore htdocs/install/install.forced.php for git
* Qual: Revert to original code, ignore notice
When changing the method to avoid one notice type, another one
appears. So simply ignoring this error.
* Qual: Revert to original code, ignore notice
When changing the method to avoid one notice type, another one
appears. So simply ignoring this error.
* Update baseline
* Qual: Phan fixes for BOM
* fixup! Qual: Phan fixes for BOM
* Fix phpstan double array keys for syslog
* Qual: Revert to original code, ignore notice
When changing the method to avoid one notice type, another one
appears. So simply ignoring this error.
* Ignore PhanTypeSuspiciousNonTraversableForeach to allow integration
* Fix typing hints (phpstan)
---------
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
* Fix int<0> typing to int<0,0> for phpstan
* Fix phpdoc for phpstan
* Fix phpdoc for phpstan
* Qual: Several phpstan notice fixes
* Fix phpdoc
* Qual: totalpaid is never null, remove null test
* improve phpdoc typing
* Also return null to statisfy phpstan
* Allow null value for $var
* object->Object to make it meaningful
* Type EvalMathStack properties
* Comment out unused private methods (phpstan)
* Changes for phpstan (return values, phpdoc, code)
* Change order of tests for phpstan
* phpdoc object to Object for correct typing
* Typing hing for phpstan
* UPdate test for phpstan
* Change phpdoc position for phpstan
* Update phpdoc for phpstan
This needs further improvement
* Change $op to $ope to fix phpstan
* Update sqlite3.class.php
---------
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
# Fix return type by cast or typing update
Fix most PhanTypeMismatchReturn notifications.
The remaining ones are likely real bugs or need more Dolibarr
knowledge to fix them efficiently
