Fix #36480 timesheet date comparison accepts string and timestamp#38921
Open
pixodeo wants to merge 1 commit into
Open
Fix #36480 timesheet date comparison accepts string and timestamp#38921pixodeo wants to merge 1 commit into
pixodeo wants to merge 1 commit into
Conversation
…tamp addTimeSpent, updateTimeSpent and delTimeSpent compared $this->timespent_date (which can be a 'YYYY-MM-DD' string when called from some callers) directly with the integer timestamp returned by dol_time_plus_duree, so the PROJECT_TIMESHEET_PREVENT_AFTER_MONTHS restriction silently allowed past entries it should refuse. Normalize the left-hand side with a numeric/strtotime guard at the three comparison sites. Signed-off-by: Dolicraft <contact@dolicraft.com>
the-dolibear-bot
Bot
added
the
Issue for v18 maintenance Team
Contributor
|
mmmm such code is hard to read, so maybe you could have something more easy to read like that that's just an idea ... and it seems to be what @atm-jonathan do in #36480 ... i'm in trouble ... so maybe we could wait for #36480 merged into develop and make a cherry-pick ? |
Contributor
Author
|
Agreed, closing in favour of #36480 which fixes the same timesheet date comparison in |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #36480.
addTimeSpent, updateTimeSpent and delTimeSpent compare
$this->timespent_date(which is an int timestamp in the common path but can be a 'YYYY-MM-DD' string when set by some callers) directly with the integer timestamp returned by dol_time_plus_duree, so the PROJECT_TIMESHEET_PREVENT_AFTER_MONTHS guard silently allowed past entries it should refuse. Normalize the left-hand side with is_numeric / strtotime at the three comparison sites.