Skip to content

Commit ca748bc

Browse files
author
Dolicraft
committed
Fix Dolibarr#36480 timesheet date comparison accepts string and timestamp
addTimeSpent, updateTimeSpent and delTimeSpent compared $this->timespent_date (which can be a 'YYYY-MM-DD' string when called from some callers) directly with the integer timestamp returned by dol_time_plus_duree, so the PROJECT_TIMESHEET_PREVENT_AFTER_MONTHS restriction silently allowed past entries it should refuse. Normalize the left-hand side with a numeric/strtotime guard at the three comparison sites. Signed-off-by: Dolicraft <contact@dolicraft.com>
1 parent 5941291 commit ca748bc

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

htdocs/projet/class/task.class.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1315,7 +1315,7 @@ public function addTimeSpent($user, $notrigger = 0)
13151315
require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
13161316
$restrictBefore = dol_time_plus_duree(dol_now(), - $conf->global->PROJECT_TIMESHEET_PREVENT_AFTER_MONTHS, 'm');
13171317

1318-
if ($this->timespent_date < $restrictBefore) {
1318+
if ((is_numeric($this->timespent_date) ? (int) $this->timespent_date : (int) strtotime((string) $this->timespent_date)) < $restrictBefore) {
13191319
$this->error = $langs->trans('TimeRecordingRestrictedToNMonthsBack', $conf->global->PROJECT_TIMESHEET_PREVENT_AFTER_MONTHS);
13201320
$this->errors[] = $this->error;
13211321
return -1;
@@ -1763,7 +1763,7 @@ public function updateTimeSpent($user, $notrigger = 0)
17631763
require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
17641764
$restrictBefore = dol_time_plus_duree(dol_now(), - $conf->global->PROJECT_TIMESHEET_PREVENT_AFTER_MONTHS, 'm');
17651765

1766-
if ($this->timespent_date < $restrictBefore) {
1766+
if ((is_numeric($this->timespent_date) ? (int) $this->timespent_date : (int) strtotime((string) $this->timespent_date)) < $restrictBefore) {
17671767
$this->error = $langs->trans('TimeRecordingRestrictedToNMonthsBack', $conf->global->PROJECT_TIMESHEET_PREVENT_AFTER_MONTHS);
17681768
$this->errors[] = $this->error;
17691769
return -1;
@@ -1864,7 +1864,7 @@ public function delTimeSpent($user, $notrigger = 0)
18641864
require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
18651865
$restrictBefore = dol_time_plus_duree(dol_now(), - $conf->global->PROJECT_TIMESHEET_PREVENT_AFTER_MONTHS, 'm');
18661866

1867-
if ($this->timespent_date < $restrictBefore) {
1867+
if ((is_numeric($this->timespent_date) ? (int) $this->timespent_date : (int) strtotime((string) $this->timespent_date)) < $restrictBefore) {
18681868
$this->error = $langs->trans('TimeRecordingRestrictedToNMonthsBack', $conf->global->PROJECT_TIMESHEET_PREVENT_AFTER_MONTHS);
18691869
$this->errors[] = $this->error;
18701870
return -1;

0 commit comments

Comments
 (0)