CVE-2022-0174: Improper Validation of Specified Quantity in Input (CWE-1284)
value: Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr.
CWE description: The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CVSS v3 base score: 4.3
Published: 2022-01-10T18:15Z
Repository: https://github.com/dolibarr/dolibarr
Language: PHP
Files changed: htdocs/don/card.php, htdocs/don/class/don.class.php
Commit date: 2022-01-10 17:55:45 +0100
Commit message: Fix error management
Diff: diff --git a/htdocs/don/card.php b/htdocs/don/card.php
index 19da17f2be..960ff7e7b2 100644
--- a/htdocs/don/card.php
+++ b/htdocs/don/card.php
@@ -138,10 +138,11 @@ if (empty($reshook)) {
 
 			header("Location: ".$_SERVER["PHP_SELF"].'?id='.$object->id);
 			exit;
 		} else {
 			setEventMessages($object->error, $object->errors, 'errors');
+			$action = 'create';
 		}
 	}
 
 
 	// Action update object
@@ -170,11 +171,11 @@ if (empty($reshook)) {
 
 			$object->firstname = (string) GETPOST("firstname", 'alpha');
 			$object->lastname = (string) GETPOST("lastname", 'alpha');
 			$object->societe = (string) GETPOST("societe", 'alpha');
 			$object->address = (string) GETPOST("address", 'alpha');
-			$object->amount = price2num(GETPOST("amount", 'alpha'));
+			$object->amount = price2num(GETPOST("amount", 'alpha'), '', 2);
 			$object->town = (string) GETPOST("town", 'alpha');
 			$object->zip = (string) GETPOST("zipcode", 'alpha');
 			$object->country_id = (int) GETPOST('country_id', 'int');
 			$object->email = (string) GETPOST("email", 'alpha');
 			$object->date = $donation_date;
@@ -191,10 +192,13 @@ if (empty($reshook)) {
 			}
 
 			if ($object->update($user) > 0) {
 				header("Location: ".$_SERVER['PHP_SELF']."?id=".$object->id);
 				exit;
+			} else {
+				setEventMessages($object->error, $object->errors, 'errors');
+				$action = "create";
 			}
 		}
 	}
 
 
@@ -228,11 +232,11 @@ if (empty($reshook)) {
 			$object->socid = (int) GETPOST("socid", 'int');
 			$object->firstname = (string) GETPOST("firstname", 'alpha');
 			$object->lastname = (string) GETPOST("lastname", 'alpha');
 			$object->societe = (string) GETPOST("societe", 'alpha');
 			$object->address = (string) GETPOST("address", 'alpha');
-			$object->amount = price2num(GETPOST("amount", 'alpha'));
+			$object->amount = price2num(GETPOST("amount", 'alpha'), '', 2);
 			$object->zip = (string) GETPOST("zipcode", 'alpha');
 			$object->town = (string) GETPOST("town", 'alpha');
 			$object->country_id = (int) GETPOST('country_id', 'int');
 			$object->email = (string) GETPOST('email', 'alpha');
 			$object->date = $donation_date;
@@ -252,10 +256,11 @@ if (empty($reshook)) {
 			if ($res > 0) {
 				header("Location: ".$_SERVER['PHP_SELF'].'?id='.$res);
 				exit;
 			} else {
 				setEventMessages($object->error, $object->errors, 'errors');
+				$action = "create";
 			}
 		}
 	}
 
 	// Action delete object
diff --git a/htdocs/don/class/don.class.php b/htdocs/don/class/don.class.php
index 7ca70a31aa..cbd5a38635 100644
--- a/htdocs/don/class/don.class.php
+++ b/htdocs/don/class/don.class.php
@@ -351,10 +351,17 @@ class Don extends CommonObject
 		$this->address = ($this->address > 0 ? $this->address : $this->address);
 		$this->zip = ($this->zip > 0 ? $this->zip : $this->zip);
 		$this->town = ($this->town > 0 ? $this->town : $this->town);
 		$this->country_id = ($this->country_id > 0 ? $this->country_id : $this->country_id);
 		$this->country = ($this->country ? $this->country : $this->country);
+		$this->amount = price2num($this->amount);
+
+		// Check parameters
+		if ($this->amount < 0) {
+			$this->error = $langs->trans('FieldCannotBeNegative', $langs->transnoentitiesnoconv("Amount"));
+			return -1;
+		}
 
 		$this->db->begin();
 
 		$sql = "INSERT INTO ".MAIN_DB_PREFIX."don (";
 		$sql .= "datec";
@@ -380,11 +387,11 @@ class Don extends CommonObject
 		$sql .= ", phone";
 		$sql .= ", phone_mobile";
 		$sql .= ") VALUES (";
 		$sql .= "'".$this->db->idate($this->date ? $this->date : $now)."'";
 		$sql .= ", ".((int) $conf->entity);
-		$sql .= ", ".price2num($this->amount);
+		$sql .= ", ".((float) $this->amount);
 		$sql .= ", ".($this->modepaymentid ? $this->modepaymentid : "null");
 		$sql .= ", ".($this->socid > 0 ? $this->socid : "null");
 		$sql .= ", '".$this->db->escape($this->firstname)."'";
 		$sql .= ", '".$this->db->escape($this->lastname)."'";
 		$sql .= ", '".$this->db->escape($this->societe)."'";
@@ -462,33 +469,40 @@ class Don extends CommonObject
 		$this->address = ($this->address > 0 ? $this->address : $this->address);
 		$this->zip = ($this->zip > 0 ? $this->zip : $this->zip);
 		$this->town = ($this->town > 0 ? $this->town : $this->town);
 		$this->country_id = ($this->country_id > 0 ? $this->country_id : $this->country_id);
 		$this->country = ($this->country ? $this->country : $this->country);
+		$this->amount = price2num($this->amount);
+
+		// Check parameters
+		if ($this->amount < 0) {
+			$this->error = $langs->trans('FieldCannotBeNegative', $langs->transnoentitiesnoconv("Amount"));
+			return -1;
+		}
 
 		$this->db->begin();
 
-		$sql = "UPDATE ".MAIN_DB_PREFIX."don SET ";
-		$sql .= "amount = ".price2num($this->amount);
-		$sql .= ",fk_payment = ".($this->modepaymentid ? $this->modepaymentid : "null");
-		$sql .= ",firstname = '".$this->db->escape($this->firstname)."'";
-		$sql .= ",lastname='".$this->db->escape($this->lastname)."'";
-		$sql .= ",societe='".$this->db->escape($this->societe)."'";
-		$sql .= ",address='".$this->db->escape($this->address)."'";
-		$sql .= ",zip='".$this->db->escape($this->zip)."'";
-		$sql .= ",town='".$this->db->escape($this->town)."'";
-		$sql .= ",fk_country = ".($this->country_id > 0 ? ((int) $this->country_id) : '0');
-		$sql .= ",public=".((int) $this->public);
-		$sql .= ",fk_projet=".($this->fk_project > 0 ? $this->fk_project : 'null');
-		$sql .= ",note_private=".(!empty($this->note_private) ? ("'".$this->db->escape($this->note_private)."'") : "NULL");
-		$sql .= ",note_public=".(!empty($this->note_public) ? ("'".$this->db->escape($this->note_public)."'") : "NULL");
-		$sql .= ",datedon='".$this->db->idate($this->date)."'";
-		$sql .= ",date_valid=".($this->date_valid ? "'".$this->db->idate($this->date)."'" : "null");
-		$sql .= ",email='".$this->db->escape(trim($this->email))."'";
-		$sql .= ",phone='".$this->db->escape(trim($this->phone))."'";
-		$sql .= ",phone_mobile='".$this->db->escape(trim($this->phone_mobile))."'";
-		$sql .= ",fk_statut=".((int) $this->statut);
+		$sql = "UPDATE ".MAIN_DB_PREFIX."don SET";
+		$sql .= " amount = ".((float) $this->amount);
+		$sql .= ", fk_payment = ".($this->modepaymentid ? $this->modepaymentid : "null");
+		$sql .= ", firstname = '".$this->db->escape($this->firstname)."'";
+		$sql .= ", lastname='".$this->db->escape($this->lastname)."'";
+		$sql .= ", societe='".$this->db->escape($this->societe)."'";
+		$sql .= ", address='".$this->db->escape($this->address)."'";
+		$sql .= ", zip='".$this->db->escape($this->zip)."'";
+		$sql .= ", town='".$this->db->escape($this->town)."'";
+		$sql .= ", fk_country = ".($this->country_id > 0 ? ((int) $this->country_id) : '0');
+		$sql .= ", public=".((int) $this->public);
+		$sql .= ", fk_projet=".($this->fk_project > 0 ? $this->fk_project : 'null');
+		$sql .= ", note_private=".(!empty($this->note_private) ? ("'".$this->db->escape($this->note_private)."'") : "NULL");
+		$sql .= ", note_public=".(!empty($this->note_public) ? ("'".$this->db->escape($this->note_public)."'") : "NULL");
+		$sql .= ", datedon='".$this->db->idate($this->date)."'";
+		$sql .= ", date_valid=".($this->date_valid ? "'".$this->db->idate($this->date)."'" : "null");
+		$sql .= ", email='".$this->db->escape(trim($this->email))."'";
+		$sql .= ", phone='".$this->db->escape(trim($this->phone))."'";
+		$sql .= ", phone_mobile='".$this->db->escape(trim($this->phone_mobile))."'";
+		$sql .= ", fk_statut=".((int) $this->statut);
 		$sql .= " WHERE rowid = ".((int) $this->id);
 
 		dol_syslog(get_class($this)."::Update", LOG_DEBUG);
 		$resql = $this->db->query($sql);
 		if ($resql) {

Vulnerable code: 			$object->amount = price2num(GETPOST("amount", 'alpha'));
			$object->amount = price2num(GETPOST("amount", 'alpha'));
		$sql .= ", ".price2num($this->amount);
		$sql = "UPDATE ".MAIN_DB_PREFIX."don SET ";
		$sql .= "amount = ".price2num($this->amount);
		$sql .= ",fk_payment = ".($this->modepaymentid ? $this->modepaymentid : "null");
		$sql .= ",firstname = '".$this->db->escape($this->firstname)."'";
		$sql .= ",lastname='".$this->db->escape($this->lastname)."'";
		$sql .= ",societe='".$this->db->escape($this->societe)."'";
		$sql .= ",address='".$this->db->escape($this->address)."'";
		$sql .= ",zip='".$this->db->escape($this->zip)."'";
		$sql .= ",town='".$this->db->escape($this->town)."'";
		$sql .= ",fk_country = ".($this->country_id > 0 ? ((int) $this->country_id) : '0');
		$sql .= ",public=".((int) $this->public);
		$sql .= ",fk_projet=".($this->fk_project > 0 ? $this->fk_project : 'null');
		$sql .= ",note_private=".(!empty($this->note_private) ? ("'".$this->db->escape($this->note_private)."'") : "NULL");
		$sql .= ",note_public=".(!empty($this->note_public) ? ("'".$this->db->escape($this->note_public)."'") : "NULL");
		$sql .= ",datedon='".$this->db->idate($this->date)."'";
		$sql .= ",date_valid=".($this->date_valid ? "'".$this->db->idate($this->date)."'" : "null");
		$sql .= ",email='".$this->db->escape(trim($this->email))."'";
		$sql .= ",phone='".$this->db->escape(trim($this->phone))."'";
		$sql .= ",phone_mobile='".$this->db->escape(trim($this->phone_mobile))."'";
		$sql .= ",fk_statut=".((int) $this->statut);
Fixed code: 			$action = 'create';
			$object->amount = price2num(GETPOST("amount", 'alpha'), '', 2);
			} else {
				setEventMessages($object->error, $object->errors, 'errors');
				$action = "create";
			$object->amount = price2num(GETPOST("amount", 'alpha'), '', 2);
				$action = "create";
		$this->amount = price2num($this->amount);

		// Check parameters
		if ($this->amount < 0) {
			$this->error = $langs->trans('FieldCannotBeNegative', $langs->transnoentitiesnoconv("Amount"));
			return -1;
		}
		$sql .= ", ".((float) $this->amount);
		$this->amount = price2num($this->amount);

		// Check parameters
		if ($this->amount < 0) {
			$this->error = $langs->trans('FieldCannotBeNegative', $langs->transnoentitiesnoconv("Amount"));
			return -1;
		}
		$sql = "UPDATE ".MAIN_DB_PREFIX."don SET";
		$sql .= " amount = ".((float) $this->amount);
		$sql .= ", fk_payment = ".($this->modepaymentid ? $this->modepaymentid : "null");
		$sql .= ", firstname = '".$this->db->escape($this->firstname)."'";
		$sql .= ", lastname='".$this->db->escape($this->lastname)."'";
		$sql .= ", societe='".$this->db->escape($this->societe)."'";
		$sql .= ", address='".$this->db->escape($this->address)."'";
		$sql .= ", zip='".$this->db->escape($this->zip)."'";
		$sql .= ", town='".$this->db->escape($this->town)."'";
		$sql .= ", fk_country = ".($this->country_id > 0 ? ((int) $this->country_id) : '0');
		$sql .= ", public=".((int) $this->public);
		$sql .= ", fk_projet=".($this->fk_project > 0 ? $this->fk_project : 'null');
		$sql .= ", note_private=".(!empty($this->note_private) ? ("'".$this->db->escape($this->note_private)."'") : "NULL");
		$sql .= ", note_public=".(!empty($this->note_public) ? ("'".$this->db->escape($this->note_public)."'") : "NULL");
		$sql .= ", datedon='".$this->db->idate($this->date)."'";
		$sql .= ", date_valid=".($this->date_valid ? "'".$this->db->idate($this->date)."'" : "null");
		$sql .= ", email='".$this->db->escape(trim($this->email))."'";
		$sql .= ", phone='".$this->db->escape(trim($this->phone))."'";
		$sql .= ", phone_mobile='".$this->db->escape(trim($this->phone_mobile))."'";
		$sql .= ", fk_statut=".((int) $this->statut);