dolibarr/htdocs/bookcal
MDW f551727df9
Qual/Sec: Use db->sanitize instead of db->escape when not quoted, fix some quoting (#39286)
* FIX phpstan: Societe::$client (int<0,3>) does not accept -1 (#39244)

Societe::$client is annotated @var int<0,3> (domain 0=no customer,
1=customer, 2=prospect, 3=both) in societe.class.php, but the create
form in societe/card.php pre-set it to -1 as a transient "nothing
pre-selected" placeholder, tripping PHPStan level 10 on develop.

The value is never persisted (save paths compute 0..3) and the only
reader, the switch() building the form, treats -1 and 0 identically via
its default case. Use 0 (the property's own default) so the assignment
matches the declared type. No behavior change.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* Qual: Fix entity handling in bonprelevement.class.php

The variable name 'entities' was changed to 'entity' to better reflect the singular nature of the value being retrieved.
It was also casted to an int instead of using an unquoted db->escape.

* Qual: Improve SQL query construction in company.lib.php

By escaping the concatenated string, injection verification does not identify a false positive.

* Qual: Avoid void positive, sanitize instead of escape

* Qual: Avoid false positive, sanitize instead of escape

* Sec: Fix potential injection with cast to int (timespent_duration)

* Qual: Avoid false positive, sanitize instead of escape

* Qual: Avoid false positive, sanitize instead of escape

* fix: Replace escape() with sanitize() in SQL queries

# FIX: Replace escape() with sanitize() in SQL queries

- Replace escape() with sanitize() in SQL queries to ensure proper SQL injection protection
- Update SQL queries in multiple files to use sanitize() instead of escape()
- Ensure consistent use of sanitize() across the codebase for better security

* fix(sql): Replace escape with sanitize in SQL queries

# FIX: Replace escape with sanitize in SQL queries

- Replace `escape` with `sanitize` in SQL queries to ensure proper SQL injection prevention

* Qual: Improve field escaping/quoting

# Qual: Qual: Improve field escaping/quoting

---------

Co-authored-by: Jam Balaya <jambalaya.pyoncafe@outlook.jp>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-27 13:00:33 +02:00
..
admin clean code (#38265) 2026-05-18 02:43:24 +02:00
class Qual: Fix 'SqlInjection' notices (#39224) 2026-07-20 02:51:54 +02:00
lib Debug v23 2025-10-13 21:57:19 +02:00
availabilities_agenda.php fix phpstan (#38038) 2026-05-11 01:19:35 +02:00
availabilities_card.php fix phpstan (#38038) 2026-05-11 01:19:35 +02:00
availabilities_contact.php fix phpstan (#38038) 2026-05-11 01:19:35 +02:00
availabilities_document.php fix phpstan (#38038) 2026-05-11 01:19:35 +02:00
availabilities_list.php Qual/Sec: Use db->sanitize instead of db->escape when not quoted, fix some quoting (#39286) 2026-07-27 13:00:33 +02:00
availabilities_note.php fix phpstan (#38038) 2026-05-11 01:19:35 +02:00
bookcalindex.php fix phpstan (#38038) 2026-05-11 01:19:35 +02:00
booking_list.php Fix some phpstan warnings (#38583) 2026-06-09 03:09:14 +02:00
calendar_agenda.php fix phpstan (#38038) 2026-05-11 01:19:35 +02:00
calendar_card.php fix phpstan (#38038) 2026-05-11 01:19:35 +02:00
calendar_contact.php fix phpstan (#38038) 2026-05-11 01:19:35 +02:00
calendar_document.php fix phpstan (#38038) 2026-05-11 01:19:35 +02:00
calendar_list.php Qual/Sec: Use db->sanitize instead of db->escape when not quoted, fix some quoting (#39286) 2026-07-27 13:00:33 +02:00
calendar_note.php fix phpstan (#38038) 2026-05-11 01:19:35 +02:00
modulebuilder.txt Clean files 2026-01-07 19:01:54 +01:00
README.md Debug v19 2023-11-04 16:02:24 +01:00

ONLINE APPOINTMENT FOR DOLIBARR ERP CRM

Features

Provides an online appointment booking system. This allow anyone to book rendez-vous, according to predefined ranges or availabilities.