CVE-2022-0174 (PHP, published 2022-01-10T18:15Z)
Description: value: Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-1284 \u2014 Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Repository: https://github.com/dolibarr/dolibarr
Files changed:
htdocs/don/card.php
htdocs/don/class/don.class.php
Commit message: Fix error management

Vulnerable code:
			$object->amount = price2num(GETPOST("amount", 'alpha'));
			$object->amount = price2num(GETPOST("amount", 'alpha'));
		$sql .= ", ".price2num($this->amount);
		$sql = "UPDATE ".MAIN_DB_PREFIX."don SET ";
		$sql .= "amount = ".price2num($this->amount);
		$sql .= ",fk_payment = ".($this->modepaymentid ? $this->modepaymentid : "null");
		$sql .= ",firstname = '".$this->db->escape($this->firstname)."'";
		$sql .= ",lastname='".$this->db->escape($this->lastname)."'";
		$sql .= ",societe='".$this->db->escape($this->societe)."'";
		$sql .= ",address='".$this->db->escape($this->address)."'";
		$sql .= ",zip='".$this->db->escape($this->zip)."'";
		$sql .= ",town='".$this->db->escape($this->town)."'";
		$sql .= ",fk_country = ".($this->country_id > 0 ? ((int) $this->country_id) : '0');
		$sql .= ",public=".((int) $this->public);
		$sql .= ",fk_projet=".($this->fk_project > 0 ? $this->fk_project : 'null');
		$sql .= ",note_private=".(!empty($this->note_private) ? ("'".$this->db->escape($this->note_private)."'") : "NULL");
		$sql .= ",note_public=".(!empty($this->note_public) ? ("'".$this->db->escape($this->note_public)."'") : "NULL");
		$sql .= ",datedon='".$this->db->idate($this->date)."'";
		$sql .= ",date_valid=".($this->date_valid ? "'".$this->db->idate($this->date)."'" : "null");
		$sql .= ",email='".$this->db->escape(trim($this->email))."'";
		$sql .= ",phone='".$this->db->escape(trim($this->phone))."'";
		$sql .= ",phone_mobile='".$this->db->escape(trim($this->phone_mobile))."'";
		$sql .= ",fk_statut=".((int) $this->statut);

Fixed code:
			$action = 'create';
			$object->amount = price2num(GETPOST("amount", 'alpha'), '', 2);
			} else {
				setEventMessages($object->error, $object->errors, 'errors');
				$action = "create";
			$object->amount = price2num(GETPOST("amount", 'alpha'), '', 2);
				$action = "create";
		$this->amount = price2num($this->amount);

		// Check parameters
		if ($this->amount < 0) {
			$this->error = $langs->trans('FieldCannotBeNegative', $langs->transnoentitiesnoconv("Amount"));
			return -1;
		}
		$sql .= ", ".((float) $this->amount);
		$this->amount = price2num($this->amount);

		// Check parameters
		if ($this->amount < 0) {
			$this->error = $langs->trans('FieldCannotBeNegative', $langs->transnoentitiesnoconv("Amount"));
			return -1;
		}
		$sql = "UPDATE ".MAIN_DB_PREFIX."don SET";
		$sql .= " amount = ".((float) $this->amount);
		$sql .= ", fk_payment = ".($this->modepaymentid ? $this->modepaymentid : "null");
		$sql .= ", firstname = '".$this->db->escape($this->firstname)."'";
		$sql .= ", lastname='".$this->db->escape($this->lastname)."'";
		$sql .= ", societe='".$this->db->escape($this->societe)."'";
		$sql .= ", address='".$this->db->escape($this->address)."'";
		$sql .= ", zip='".$this->db->escape($this->zip)."'";
		$sql .= ", town='".$this->db->escape($this->town)."'";
		$sql .= ", fk_country = ".($this->country_id > 0 ? ((int) $this->country_id) : '0');
		$sql .= ", public=".((int) $this->public);
		$sql .= ", fk_projet=".($this->fk_project > 0 ? $this->fk_project : 'null');
		$sql .= ", note_private=".(!empty($this->note_private) ? ("'".$this->db->escape($this->note_private)."'") : "NULL");
		$sql .= ", note_public=".(!empty($this->note_public) ? ("'".$this->db->escape($this->note_public)."'") : "NULL");
		$sql .= ", datedon='".$this->db->idate($this->date)."'";
		$sql .= ", date_valid=".($this->date_valid ? "'".$this->db->idate($this->date)."'" : "null");
		$sql .= ", email='".$this->db->escape(trim($this->email))."'";
		$sql .= ", phone='".$this->db->escape(trim($this->phone))."'";
		$sql .= ", phone_mobile='".$this->db->escape(trim($this->phone_mobile))."'";
		$sql .= ", fk_statut=".((int) $this->statut);