GPCsolutions / dolibarr

Dolibarr ERP/CRM is a modern software to manage your company or foundation activity (contacts, suppliers, invoices, orders, stocks, agenda, ...).It's an opensource software (wrote with PHP language) designed for small and medium companies, foundation and freelances. You can freely install, use and distribute it as a standalone application or as a web application to use it from every internet access and media.
http://www.dolibarr.org
GNU General Public License v3.0
2 stars 0 forks source link

Missing sanitization in supplier price #56

Closed rdoursenaud closed 9 years ago

rdoursenaud commented 10 years ago

If you don't fill the (required) VAT field in supplier price creation, you get this nice error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' fk_availability = 0, entity = 1, info_bits = 0, charges = 0 WHERE rowid = 217' at line 1 sql=UPDATE llx_product_fournisseur_price SET fk_user = 3 , ref_fourn = '1UBRK-200', price = 17, quantity = 1, remise_percent = 0, remise = 0, unitprice = 17, unitcharges = 0, tva_tx = , fk_availability = 0, entity = 1, info_bits = 0, charges = 0 WHERE rowid = 217

Should have a required field error instead or simply use 0 rather than nothing.

rdoursenaud commented 9 years ago

Fixed