diff --git a/modules/Accounts/models/Module.php b/modules/Accounts/models/Module.php index 853d5e5fca447bfd61dbd7970210ba346ba98ed1..5dad3ba8684c418381cd2828a619b9ca782ad484 100644 --- a/modules/Accounts/models/Module.php +++ b/modules/Accounts/models/Module.php @@ -48,17 +48,22 @@ class Accounts_Module_Model extends Vtiger_Module_Model { if (($sourceModule == 'Accounts' && $field == 'account_id' && $record) || in_array($sourceModule, array('Campaigns', 'Products', 'Services', 'Emails'))) { + $db = PearDatabase::getInstance(); + $params = array($record); if ($sourceModule === 'Campaigns') { - $condition = " vtiger_account.accountid NOT IN (SELECT accountid FROM vtiger_campaignaccountrel WHERE campaignid = '$record')"; + $condition = " vtiger_account.accountid NOT IN (SELECT accountid FROM vtiger_campaignaccountrel WHERE campaignid = ?)"; } elseif ($sourceModule === 'Products') { - $condition = " vtiger_account.accountid NOT IN (SELECT crmid FROM vtiger_seproductsrel WHERE productid = '$record')"; + $condition = " vtiger_account.accountid NOT IN (SELECT crmid FROM vtiger_seproductsrel WHERE productid = ?)"; } elseif ($sourceModule === 'Services') { - $condition = " vtiger_account.accountid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') "; - } elseif ($sourceModule === 'Emails') { + $condition = " vtiger_account.accountid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) "; + $params = array($record, $record); + } elseif ($sourceModule === 'Emails') { $condition = ' vtiger_account.emailoptout = 0'; + $params = array(); } else { - $condition = " vtiger_account.accountid != '$record'"; + $condition = " vtiger_account.accountid != ?"; } + $condition = $db->convert2Sql($condition, $params); $position = stripos($listQuery, 'where'); if($position) { diff --git a/modules/Campaigns/models/Module.php b/modules/Campaigns/models/Module.php index 67c050e0c131789105026ad796e749b329938c9a..d7547545fa8cc61d8f042bf9a39cf7aa44d6071f 100644 --- a/modules/Campaigns/models/Module.php +++ b/modules/Campaigns/models/Module.php @@ -46,8 +46,9 @@ class Campaigns_Module_Model extends Vtiger_Module_Model { case 'Accounts' : $tableName = 'vtiger_campaignaccountrel'; $relatedFieldName = 'accountid'; break; case 'Contacts' : $tableName = 'vtiger_campaigncontrel'; $relatedFieldName = 'contactid'; break; } - - $condition = " vtiger_campaign.campaignid NOT IN (SELECT campaignid FROM $tableName WHERE $relatedFieldName = '$record')"; + $db = PearDatabase::getInstance(); + $condition = " vtiger_campaign.campaignid NOT IN (SELECT campaignid FROM $tableName WHERE $relatedFieldName = ?)"; + $condition = $db->convert2Sql($condition, array($record)); $pos = stripos($listQuery, 'where'); if ($pos) { @@ -89,4 +90,4 @@ class Campaigns_Module_Model extends Vtiger_Module_Model { return array(); } -} \ No newline at end of file +} diff --git a/modules/Contacts/models/Module.php b/modules/Contacts/models/Module.php index 5817ded3164010f20c21ff5a49633eff213f6fa0..c2a6ad66a1851088acdf197f6fd2c7022289ea85 100644 --- a/modules/Contacts/models/Module.php +++ b/modules/Contacts/models/Module.php @@ -293,15 +293,19 @@ class Contacts_Module_Model extends Vtiger_Module_Model { case 'Products' : $tableName = 'vtiger_seproductsrel'; $fieldName = 'crmid'; $relatedFieldName ='productid'; break; } + $db = PearDatabase::getInstance(); + $params = array($record); if ($sourceModule === 'Services') { - $condition = " vtiger_contactdetails.contactid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') "; + $condition = " vtiger_contactdetails.contactid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) "; + $params = array($record , $record); } elseif ($sourceModule === 'Emails') { $condition = ' vtiger_contactdetails.emailoptout = 0'; } elseif ($sourceModule === 'Contacts' && $field === 'contact_id') { - $condition = " vtiger_contactdetails.contactid != '$record'"; + $condition = " vtiger_contactdetails.contactid != ?"; } else { - $condition = " vtiger_contactdetails.contactid NOT IN (SELECT $fieldName FROM $tableName WHERE $relatedFieldName = '$record')"; + $condition = " vtiger_contactdetails.contactid NOT IN (SELECT $fieldName FROM $tableName WHERE $relatedFieldName = ?)"; } + $condition = $db->convert2Sql($condition, $params); $position = stripos($listQuery, 'where'); if($position) { @@ -318,4 +322,4 @@ class Contacts_Module_Model extends Vtiger_Module_Model { return "lastname"; } -} \ No newline at end of file +} diff --git a/modules/Documents/models/Module.php b/modules/Documents/models/Module.php index 535d1c5e9ab55546ed2408949f6ec1125939c557..c1a601df2ca2eb8a7bea8fd25992e1cf943f0e32 100644 --- a/modules/Documents/models/Module.php +++ b/modules/Documents/models/Module.php @@ -62,7 +62,9 @@ class Documents_Module_Model extends Vtiger_Module_Model { if($sourceModule === 'Emails' && $field === 'composeEmail') { $condition = ' (( vtiger_notes.filelocationtype LIKE "%I%")) AND vtiger_notes.filename != "" AND vtiger_notes.filestatus = 1'; } else { - $condition = " vtiger_notes.notesid NOT IN (SELECT notesid FROM vtiger_senotesrel WHERE crmid = '$record') AND vtiger_notes.filestatus = 1"; + $db = PearDatabase::getInstance(); + $condition = " vtiger_notes.notesid NOT IN (SELECT notesid FROM vtiger_senotesrel WHERE crmid = ?) AND vtiger_notes.filestatus = 1"; + $condition = $db->convert2Sql($condition, array($record)); } $pos = stripos($listQuery, 'where'); if($pos) { diff --git a/modules/HelpDesk/models/Module.php b/modules/HelpDesk/models/Module.php index f933f9c3b1a04ea0c467dba2dbed736f110bb04a..e0b2c4acfad56cf225365c626216287bdc157833 100644 --- a/modules/HelpDesk/models/Module.php +++ b/modules/HelpDesk/models/Module.php @@ -187,7 +187,9 @@ class HelpDesk_Module_Model extends Vtiger_Module_Model { */ public function getQueryByModuleField($sourceModule, $field, $record, $listQuery) { if (in_array($sourceModule, array('Assets', 'Project', 'ServiceContracts', 'Services'))) { - $condition = " vtiger_troubletickets.ticketid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') "; + $condition = " vtiger_troubletickets.ticketid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) "; + $db = PearDatabase::getInstance(); + $condition = $db->convert2Sql($condition, array($record, $record)); $pos = stripos($listQuery, 'where'); if ($pos) { diff --git a/modules/Leads/models/Module.php b/modules/Leads/models/Module.php index d64ae21b5ca3b05152580ec7057ac341658fe0fc..08ba884402b00928f9b1247cd125a8eded5018f7 100644 --- a/modules/Leads/models/Module.php +++ b/modules/Leads/models/Module.php @@ -344,13 +344,18 @@ class Leads_Module_Model extends Vtiger_Module_Model { case 'Products' : $tableName = 'vtiger_seproductsrel'; $fieldName = 'crmid'; $relatedFieldName ='productid'; break; } + $db = PearDatabase::getInstance(); + $params = array($record); if ($sourceModule === 'Services') { - $condition = " vtiger_leaddetails.leadid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') "; + $condition = " vtiger_leaddetails.leadid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) "; + $params = array($record, $record); } elseif ($sourceModule === 'Emails') { $condition = ' vtiger_leaddetails.emailoptout = 0'; + $params = array(); } else { - $condition = " vtiger_leaddetails.leadid NOT IN (SELECT $fieldName FROM $tableName WHERE $relatedFieldName = '$record')"; + $condition = " vtiger_leaddetails.leadid NOT IN (SELECT $fieldName FROM $tableName WHERE $relatedFieldName = ?)"; } + $condition = $db->convert2Sql($condition, $params); $position = stripos($listQuery, 'where'); if($position) { @@ -373,4 +378,4 @@ class Leads_Module_Model extends Vtiger_Module_Model { public function getUtilityActionsNames() { return array('Import', 'Export', 'Merge', 'ConvertLead', 'DuplicatesHandling'); } -} \ No newline at end of file +} diff --git a/modules/Potentials/models/Module.php b/modules/Potentials/models/Module.php index 15616aa7cafd1bcaab982de5de4d787495cdbba0..d33ec91eb2dcd255324ad32d200910e48c93e665 100644 --- a/modules/Potentials/models/Module.php +++ b/modules/Potentials/models/Module.php @@ -331,11 +331,15 @@ class Potentials_Module_Model extends Vtiger_Module_Model { */ public function getQueryByModuleField($sourceModule, $field, $record, $listQuery) { if (in_array($sourceModule, array('Products', 'Services'))) { + $db = PearDatabase::getInstance(); + $params = array($record); if ($sourceModule === 'Products') { - $condition = " vtiger_potential.potentialid NOT IN (SELECT crmid FROM vtiger_seproductsrel WHERE productid = '$record')"; + $condition = " vtiger_potential.potentialid NOT IN (SELECT crmid FROM vtiger_seproductsrel WHERE productid = ?)"; } elseif ($sourceModule === 'Services') { - $condition = " vtiger_potential.potentialid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') "; + $condition = " vtiger_potential.potentialid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) "; + $params = array($record, $record); } + $condition = $db->convert2Sql($condition, $params); $pos = stripos($listQuery, 'where'); if ($pos) { @@ -390,4 +394,4 @@ class Potentials_Module_Model extends Vtiger_Module_Model { function getUtilityActionsNames() { return array('Import', 'Export', 'DuplicatesHandling'); } -} \ No newline at end of file +} diff --git a/modules/PriceBooks/models/Module.php b/modules/PriceBooks/models/Module.php index 34a78e9ed7fa34eb18e1a5071a250d0d035fc9c8..92e25cbc506bc6cd5223e83d138771a47b7a5620 100644 --- a/modules/PriceBooks/models/Module.php +++ b/modules/PriceBooks/models/Module.php @@ -67,13 +67,15 @@ class PriceBooks_Module_Model extends Vtiger_Module_Model { $relatedModulesList = array('Products', 'Services'); if (in_array($sourceModule, $relatedModulesList)) { $pos = stripos($listQuery, ' where '); + $db = PearDatabase::getInstance(); if ($currencyId && in_array($field, array('productid', 'serviceid'))) { - $condition = " vtiger_pricebook.pricebookid IN (SELECT pricebookid FROM vtiger_pricebookproductrel WHERE productid = $record) + $condition = " vtiger_pricebook.pricebookid IN (SELECT pricebookid FROM vtiger_pricebookproductrel WHERE productid = ?) AND vtiger_pricebook.currency_id = $currencyId AND vtiger_pricebook.active = 1"; } else if($field == 'productsRelatedList') { - $condition = "vtiger_pricebook.pricebookid NOT IN (SELECT pricebookid FROM vtiger_pricebookproductrel WHERE productid = $record) + $condition = "vtiger_pricebook.pricebookid NOT IN (SELECT pricebookid FROM vtiger_pricebookproductrel WHERE productid = ?) AND vtiger_pricebook.active = 1"; } + $condition = $db->convert2Sql($condition, array($record)); if ($pos) { $split = preg_split('/ where /i', $listQuery); $overRideQuery = $split[0] . ' WHERE ' . $split[1] . ' AND ' . $condition; diff --git a/modules/Products/models/Module.php b/modules/Products/models/Module.php index 6703da9eabdebe687d0e5da064a7021c8ac4e4ab..ec0493ad048972fbf487f2afffd6aae1c4438705 100644 --- a/modules/Products/models/Module.php +++ b/modules/Products/models/Module.php @@ -25,15 +25,21 @@ class Products_Module_Model extends Vtiger_Module_Model { || in_array($sourceModule, getInventoryModules())) { $condition = " vtiger_products.discontinued = 1 "; + $db = PearDatabase::getInstance(); + $params = array($record); if ($sourceModule === $this->getName()) { - $condition .= " AND vtiger_products.productid NOT IN (SELECT productid FROM vtiger_seproductsrel WHERE setype = '". $this->getName(). "' UNION SELECT crmid FROM vtiger_seproductsrel WHERE productid = '$record') AND vtiger_products.productid <> '$record' "; + $condition .= " AND vtiger_products.productid NOT IN (SELECT productid FROM vtiger_seproductsrel WHERE setype = '". $this->getName(). "' UNION SELECT crmid FROM vtiger_seproductsrel WHERE productid = ?) AND vtiger_products.productid <> ? "; + $params = array($record, $record); } elseif ($sourceModule === 'PriceBooks') { - $condition .= " AND vtiger_products.productid NOT IN (SELECT productid FROM vtiger_pricebookproductrel WHERE pricebookid = '$record') "; + $condition .= " AND vtiger_products.productid NOT IN (SELECT productid FROM vtiger_pricebookproductrel WHERE pricebookid = ?) "; } elseif ($sourceModule === 'Vendors') { - $condition .= " AND vtiger_products.vendor_id != '$record' "; + $condition .= " AND vtiger_products.vendor_id != ? "; } elseif (in_array($sourceModule, $supportedModulesList)) { - $condition .= " AND vtiger_products.productid NOT IN (SELECT productid FROM vtiger_seproductsrel WHERE crmid = '$record')"; + $condition .= " AND vtiger_products.productid NOT IN (SELECT productid FROM vtiger_seproductsrel WHERE crmid = ?)"; + } else { + $params = array(); } + $condition = $db->convert2Sql($condition, $params); $pos = stripos($listQuery, 'where'); if ($pos) { diff --git a/modules/Users/models/Module.php b/modules/Users/models/Module.php index 150d45865762eee27f72a4688f0578b9f8f42134..5658b32f4e435fc881d9d16cd73fcb45a94cce7d 100644 --- a/modules/Users/models/Module.php +++ b/modules/Users/models/Module.php @@ -21,8 +21,10 @@ class Users_Module_Model extends Vtiger_Module_Model { if($sourceModule == 'Users' && $field == 'reports_to_id') { $overRideQuery = $listQuery; if(!empty($record)){ + $db = PearDatabase::getInstance(); + $condition = $db->convert2Sql(' AND vtiger_users.id != ? ', array($record)); $currentUser = Users_Record_Model::getCurrentUserModel(); - $overRideQuery = $overRideQuery. " AND vtiger_users.id != ". $record; + $overRideQuery = $overRideQuery. $condition; $allSubordinates = $currentUser->getAllSubordinatesByReportsToField($record); if(count($allSubordinates) > 0) { $overRideQuery .= " AND vtiger_users.id NOT IN (". implode(',',$allSubordinates) .")"; // do not allow the subordinates diff --git a/packages/vtiger/mandatory/ServiceContracts.zip b/packages/vtiger/mandatory/ServiceContracts.zip index a1b53c07d50540611cdc1a5be5c707111424f86f..5053520885a4041540aec076d57277a5ea6b0044 100644 Binary files a/packages/vtiger/mandatory/ServiceContracts.zip and b/packages/vtiger/mandatory/ServiceContracts.zip differ diff --git a/packages/vtiger/mandatory/Services.zip b/packages/vtiger/mandatory/Services.zip index 3ac879a4b0605a462c915f8cd831c09f1bb37ed3..88e18feae69c9e004f828a33f535bc8456ba651c 100644 Binary files a/packages/vtiger/mandatory/Services.zip and b/packages/vtiger/mandatory/Services.zip differ diff --git a/packages/vtiger/optional/Assets.zip b/packages/vtiger/optional/Assets.zip index af8d02ed29d9344d2d93e77fca2f6461cd874068..8e0ec347b21d361b1f9ba7b6629006e55636c0d4 100644 Binary files a/packages/vtiger/optional/Assets.zip and b/packages/vtiger/optional/Assets.zip differ diff --git a/packages/vtiger/optional/Projects.zip b/packages/vtiger/optional/Projects.zip index d229cba4fe29fc6c33f3fd14185dd5b0fd87e196..c38ca829d839b7eb1f23894cb3796bce1d71a04c 100644 Binary files a/packages/vtiger/optional/Projects.zip and b/packages/vtiger/optional/Projects.zip differ diff --git a/pkg/vtiger/modules/Assets/modules/Assets/models/Module.php b/pkg/vtiger/modules/Assets/modules/Assets/models/Module.php index fd971c2516777f6019ac5758318bad795bd8e80f..3dcb5f63bc5a8bb13bb9819b6aa708c62aac87f8 100644 --- a/pkg/vtiger/modules/Assets/modules/Assets/models/Module.php +++ b/pkg/vtiger/modules/Assets/modules/Assets/models/Module.php @@ -12,7 +12,9 @@ class Assets_Module_Model extends Vtiger_Module_Model { public function getQueryByModuleField($sourceModule, $field, $record, $listQuery) { if ($sourceModule == 'HelpDesk') { - $condition = " vtiger_assets.assetsid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') "; + $condition = " vtiger_assets.assetsid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) "; + $db = PearDatabase::getInstance(); + $condition = $db->convert2Sql($condition, array($record, $record)); $pos = stripos($listQuery, 'where'); if ($pos) { diff --git a/pkg/vtiger/modules/Projects/Project/modules/Project/models/Module.php b/pkg/vtiger/modules/Projects/Project/modules/Project/models/Module.php index db54192133ba9facccee5d8436491a1e1b931a86..62d28531dcaf914f2033403e74e5792e2b2d191d 100644 --- a/pkg/vtiger/modules/Projects/Project/modules/Project/models/Module.php +++ b/pkg/vtiger/modules/Projects/Project/modules/Project/models/Module.php @@ -82,7 +82,9 @@ class Project_Module_Model extends Vtiger_Module_Model { */ public function getQueryByModuleField($sourceModule, $field, $record, $listQuery) { if ($sourceModule === 'HelpDesk') { - $condition = " vtiger_project.projectid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') "; + $condition = " vtiger_project.projectid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) "; + $db = PearDatabase::getInstance(); + $condition = $db->convert2Sql($condition, array($record, $record)); $pos = stripos($listQuery, 'where'); if ($pos) { @@ -95,4 +97,4 @@ class Project_Module_Model extends Vtiger_Module_Model { } } -} \ No newline at end of file +} diff --git a/pkg/vtiger/modules/ServiceContracts/modules/ServiceContracts/models/Module.php b/pkg/vtiger/modules/ServiceContracts/modules/ServiceContracts/models/Module.php index cb238c0fe9139a2f310f87ab6b125028916c6587..5deb84001deccf5af9b4083ed97e0ddbc457ddf5 100755 --- a/pkg/vtiger/modules/ServiceContracts/modules/ServiceContracts/models/Module.php +++ b/pkg/vtiger/modules/ServiceContracts/modules/ServiceContracts/models/Module.php @@ -35,7 +35,9 @@ class ServiceContracts_Module_Model extends Vtiger_Module_Model { */ public function getQueryByModuleField($sourceModule, $field, $record, $listQuery) { if ($sourceModule === 'HelpDesk') { - $condition = " vtiger_servicecontracts.servicecontractsid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') "; + $condition = " vtiger_servicecontracts.servicecontractsid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) "; + $db = PearDatabase::getInstance(); + $condition = $db->convert2Sql($condition, array($record, $record)); $pos = stripos($listQuery, 'where'); if ($pos) { diff --git a/pkg/vtiger/modules/Services/modules/Services/models/Module.php b/pkg/vtiger/modules/Services/modules/Services/models/Module.php index 86e8babf672573165694a9064ef8160524d05f4a..f21567290acac1e9933822bb25eb242308317665 100644 --- a/pkg/vtiger/modules/Services/modules/Services/models/Module.php +++ b/pkg/vtiger/modules/Services/modules/Services/models/Module.php @@ -26,11 +26,16 @@ class Services_Module_Model extends Products_Module_Model { $condition = " vtiger_service.discontinued = 1 "; + $db = PearDatabase::getInstance(); + $params = array(); if ($sourceModule == 'PriceBooks' && $field == 'priceBookRelatedList') { - $condition .= " AND vtiger_service.serviceid NOT IN (SELECT productid FROM vtiger_pricebookproductrel WHERE pricebookid = '$record') "; + $condition .= " AND vtiger_service.serviceid NOT IN (SELECT productid FROM vtiger_pricebookproductrel WHERE pricebookid = ?) "; + $params = array($record); } elseif (in_array($sourceModule, $supportedModulesList)) { - $condition .= " AND vtiger_service.serviceid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = '$record' UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = '$record') "; + $condition .= " AND vtiger_service.serviceid NOT IN (SELECT relcrmid FROM vtiger_crmentityrel WHERE crmid = ? UNION SELECT crmid FROM vtiger_crmentityrel WHERE relcrmid = ?) "; + $params = array($record, $record); } + $condition = $db->convert2Sql($condition, $params); $pos = stripos($listQuery, 'where'); if ($pos) { @@ -71,4 +76,4 @@ class Services_Module_Model extends Products_Module_Model { function getUtilityActionsNames() { return array('Import', 'Export', 'DuplicatesHandling'); } -} \ No newline at end of file +}