admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Cosmetic

Browse source 
fix : count_by_modele
This commit is contained in:
sparkyx 2021-01-26 00:36:58 +01:00
parent 957a19247b
commit 1fd5f41662
5 changed files with 30 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

11
html/style-classic7.css
View file

@ -279,16 +279,15 @@ td.mtitle {
}
}
td.mtitle a.mtitle {
color : lightgray;
color : lightblue;
display:block;
font-size:1rem;
font-family:OpenSansRegular;
/*! width:100%; */
padding:0px;
margin:0px;
height:100%;
height:42px;
padding:4px 0px 0px 0px;
border-radius:4px;
}
@media only screen and (max-width:1280px) {
td.mtitle a.mtitle {
@ -368,7 +367,7 @@ a.mtitle {
text-decoration:none;
display:inline;
color: #0000FF;
pointer:cursor;
cursor: pointer;
background-color: transparent;
}
a.mtitle:hover {
@ -754,7 +753,7 @@ a#anchorbutton:hover, .button:hover,a.button:hover,div.content a.button:hover {
}
a#smallanchorbutton, .smallbutton, a.smallbutton,div.content a.smallbutton {
color:#FFFFFF;
font-weight: bold;
font-weight: normal;
text-decoration:none;
font-family: arial,verdana,sans-serif,helvetica;
/*! background-image: url("image/bg-submit2.gif"); */

4
include/class/fiche.class.php
View file

@ -291,6 +291,8 @@ class Fiche
*/
function count_by_modele($p_frd_id,$p_search="",$p_sql="")
{
// Scan for SQL inject
$this->cn->search_sql_inject($p_sql);
if ( $p_search != "" )
{
@ -305,7 +307,7 @@ class Fiche
$result = $this->cn->get_value("select count(*)
from
fiche join fiche_Def using (fd_id)
where frd_id=$1 ".sql_string($p_sql)
where frd_id=$1 ".$p_sql
,[$p_frd_id]);
return $result;
}

1
include/constant.php
View file

@ -314,6 +314,7 @@ define ('EMAIL_LIMIT',1002);
define ('EXC_PARAM_VALUE',1005);
define ('EXC_PARAM_TYPE',1006);
define ('EXC_DUPLICATE',1200);
define ('EXC_INVALID',1400);
define ("UNPINDG","");
define ("PINDG","");

18
include/lib/database_core.class.php
View file

@ -956,6 +956,24 @@ class DatabaseCore
static function nb_column($p_ret) {
return pg_num_fields($p_ret);
}
/**
* FInd if a SQL Select has a SQL stmt to inject or damage Data
* When a SELECT SQL string is build, this string could contain a SQL attempt to damage data,
*so the statement DELETE TRUNCATE ... are forbidden. Throw an exception EXC_INVALID
*
*/
function search_sql_inject($p_sql)
{
$forbid_sql=array("update","delete","truncate","insert");
// protect against SQL inject
foreach ($forbid_sql as $forbid_key) {
if (stripos($p_sql,$forbid_key) !== false)
{
throw new Exception(_("Possible SQL inject",EXC_INVALID));
}
}
}
}

8
unit-test/include/class/fiche.Test.php
View file

@ -35,7 +35,6 @@ class FicheTest extends TestCase
/**
* @covers Fiche::cmp_name
* @todo Implement testCmp_name().
*/
public function testCmp_name()
{
@ -47,7 +46,6 @@ class FicheTest extends TestCase
/**
* @covers Fiche::get_bk_account
* @todo Implement testGet_bk_account().
*/
public function testGet_bk_account()
{
@ -106,10 +104,10 @@ class FicheTest extends TestCase
$this->assertEquals(7,$nb,"Purchase cards ");
// attempt to inject SQL command, you must get an error
try {
$nb=@$this->object->count_by_modele(3,""," and 1';delete from jrn;");
$this->assertFalse(true,"Inject SQL command");
$nb=@$this->object->count_by_modele(3,""," ;delete from jrn;");
$this->assertFalse(true,"Inject SQL command not found");
} catch(Exception $e) {
$this->assertTrue(true,"Inject SQL command");
$this->assertTrue(true,"Inject SQL command found");
}
}
}