-
-
Notifications
You must be signed in to change notification settings - Fork 2.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
NEW: Invoice subtypes for customers and vendors #26233
Conversation
if ($table === 'facture' || $table === 'facture_fourn') { | ||
$sql = "SELECT s.label FROM " . MAIN_DB_PREFIX . $table . " AS f"; | ||
$sql .= " INNER JOIN " . MAIN_DB_PREFIX . "c_invoice_subtype AS s ON f.subtype = s.rowid"; | ||
$sql .= " WHERE f.ref = \"$this->ref\""; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Possible SQL Injection here.
Use
$sql .= " WHERE f.ref = '".$this->db->escape($this->ref)."'";
The quotes for SQL must be ' and content must be escaped.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fixed
htdocs/fourn/facture/card.php
Outdated
break; | ||
} | ||
} | ||
if (in_array($selectedcode, array('5.1', '5.2', '11.4'))) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hard coded value are not allowed. I suggest to remove completely this check for the first version of the PR.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fixed
Any suggestion on how i could tackle this because it's about the most common mistake made by users having to choose between so many subtypes and is driving accountants crazy!?
fyi the hardcoded values i used are from the revenue ministry api and never gonna change.
htdocs/fourn/facture/card.php
Outdated
break; | ||
} | ||
} | ||
if (in_array($selectedcode, array('5.1', '5.2', '11.4'))) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Same here
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fixed
@eldy following code gives the error and it is actually used in /compta/facture/list.php with out errors.
|
Re up