isabelle/ws_customerspecialty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(main): validate specialty exists, fix double-escaped title filter

Browse Source
This commit is contained in:
isabelle
2026-07-10 17:17:49 +02:00
parent 4bf081dd66
commit 274fa6c0e7
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ws_customerspecialty/src/Grid/Query/CustomerSpecialtyQueryBuilder.php
+1 -1
View File
@@ -78,7 +78,7 @@ class CustomerSpecialtyQueryBuilder extends AbstractDoctrineQueryBuilder
switch ($filterName) {
case 'title':
$queryBuilder->andWhere('csl.title LIKE :title')
->setParameter('title', '%' . pSQL($filterValue) . '%');
->setParameter('title', '%' . $filterValue . '%');
break;
case 'active':
$queryBuilder->andWhere('cs.active = :active')
ws_customerspecialty/src/Module/DisplayHooks.php
+9 -1
View File
@@ -91,7 +91,7 @@ trait DisplayHooks
$idCustomer = (int) $customer->id;
$specialization = (int) Tools::getValue('specialization');
if ($idCustomer <= 0 || $specialization <= 0) {
if ($idCustomer <= 0 || $specialization <= 0 || !$this->customerSpecialtyExists($specialization)) {
return;
}
@@ -108,6 +108,14 @@ trait DisplayHooks
);
}
private function customerSpecialtyExists(int $idCustomerSpecialty): bool
{
return (bool) Db::getInstance()->getValue(
'SELECT `id_ws_customerspecialty` FROM `' . _DB_PREFIX_ . 'ws_customerspecialty`
WHERE `id_ws_customerspecialty` = ' . $idCustomerSpecialty . ' AND `active` = 1'
);
}
private function loadOrderCustomerSpecialization(int $idOrder): ?string
{
$idCustomer = (int) Db::getInstance()->getValue(