dolibarr/htdocs/workstation
MDW f551727df9
Qual/Sec: Use db->sanitize instead of db->escape when not quoted, fix some quoting (#39286)
* FIX phpstan: Societe::$client (int<0,3>) does not accept -1 (#39244)

Societe::$client is annotated @var int<0,3> (domain 0=no customer,
1=customer, 2=prospect, 3=both) in societe.class.php, but the create
form in societe/card.php pre-set it to -1 as a transient "nothing
pre-selected" placeholder, tripping PHPStan level 10 on develop.

The value is never persisted (save paths compute 0..3) and the only
reader, the switch() building the form, treats -1 and 0 identically via
its default case. Use 0 (the property's own default) so the assignment
matches the declared type. No behavior change.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* Qual: Fix entity handling in bonprelevement.class.php

The variable name 'entities' was changed to 'entity' to better reflect the singular nature of the value being retrieved.
It was also casted to an int instead of using an unquoted db->escape.

* Qual: Improve SQL query construction in company.lib.php

By escaping the concatenated string, injection verification does not identify a false positive.

* Qual: Avoid void positive, sanitize instead of escape

* Qual: Avoid false positive, sanitize instead of escape

* Sec: Fix potential injection with cast to int (timespent_duration)

* Qual: Avoid false positive, sanitize instead of escape

* Qual: Avoid false positive, sanitize instead of escape

* fix: Replace escape() with sanitize() in SQL queries

# FIX: Replace escape() with sanitize() in SQL queries

- Replace escape() with sanitize() in SQL queries to ensure proper SQL injection protection
- Update SQL queries in multiple files to use sanitize() instead of escape()
- Ensure consistent use of sanitize() across the codebase for better security

* fix(sql): Replace escape with sanitize in SQL queries

# FIX: Replace escape with sanitize in SQL queries

- Replace `escape` with `sanitize` in SQL queries to ensure proper SQL injection prevention

* Qual: Improve field escaping/quoting

# Qual: Qual: Improve field escaping/quoting

---------

Co-authored-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-27 13:00:33 +02:00
..
class clean code (#38472) 2026-06-10 19:31:35 +02:00
lib fix phpstan (#38038) 2026-05-11 01:19:35 +02:00
workstation_agenda.php clean code (#38745) 2026-06-13 02:36:03 +02:00
workstation_card.php fix phpstan (#38038) 2026-05-11 01:19:35 +02:00
workstation_document.php clean code (#38745) 2026-06-13 02:36:03 +02:00
workstation_list.php Qual/Sec: Use db->sanitize instead of db->escape when not quoted, fix some quoting (#39286) 2026-07-27 13:00:33 +02:00
workstation_note.php clean code (#38745) 2026-06-13 02:36:03 +02:00