0028088: Errors on the PaidReceiptsHeader when filtering using some characters on the ticket selector on the webpos

Openbravo Issue Tracking System - Retail Modules

View Issue Details

Project

Category

View Status

Date Submitted

Last Update

0028088

Retail Modules

Web POS

public

2014-11-05 11:19

2014-11-17 15:31

Reporter

egoitz

Assigned To

szapata

Priority

immediate

Severity

major

Reproducibility

have not tried

Status

closed

Resolution

fixed

Platform

OS Version

Product Version

Target Version

RR15Q1

Fixed in Version

RR15Q1

Merge Request Status

Review Assigned To

mtaal

OBNetwork customer

OBPS

Support ticket

32190

Regression level

Regression date

Regression introduced in release

Regression introduced by commit

Triggers an Emergency Pack

Summary

0028088: Errors on the PaidReceiptsHeader when filtering using some characters on the ticket selector on the webpos

Description

When filtering on the ticket selector on the posterminal using for example a ' at the enf of a string an error is raised on the org/openbravo/retail/posterminal/PaidReceiptsHeader.java file

This is because the filter inputs json.getString("filterText") at PaidReceiptsHeader.java are not sanitized

Steps To Reproduce

- Log in in Web POS.
- Go to Menu > Receipts
- Filter the documentno with a ' at the end for example 100086'.
- An error occurs.

3cb725a7 2014-11-01 10:37:57,795 [TP-Processor36] ERROR org.openbravo.mobile.core.process.ProcessHQLQuery - Error when generating query
org.hibernate.QueryException: expecting ''', found '<EOF>' [select ord.id as id, ord.documentNo as documentNo, ord.orderDate as orderDate, ord.businessPartner.name as
businessPartner, ord.grandTotalAmount as totalamount, ord.documentType.id as documentTypeId, 'false' as isLayaway from Order as ord where
ord.client='3AFE04DCE6EE4C5A9912EDFF5517C3A7' and ord.organization='3C0F8E1BD0694E719E55C0A5DEB0AC46' and ord.obposApplications is not null and
(ord.documentNo like '%100086'%' or REPLACE(ord.documentNo, '/', '') like '%100086'%' or upper(ord.businessPartner.name) like upper('%100086'%')) and (
ord.documentType.id='511A9371A0F74195AA3F6D66C722729D' or ord.documentType.id='B0745E66713C49199CE719BF5B88AF5C' ) and ((select
count(deliveredQuantity) from ord.orderLineList where deliveredQuantity != 0) > 0 and (select count(orderedQuantity) from ord.orderLineList where orderedQuantity > 0) >
0) order by ord.orderDate desc, ord.documentNo desc]
at org.hibernate.hql.ast.QueryTranslatorImpl.doCompile(QueryTranslatorImpl.java:229)
at org.hibernate.hql.ast.QueryTranslatorImpl.compile(QueryTranslatorImpl.java:136)
at org.hibernate.engine.query.HQLQueryPlan.<init>(HQLQueryPlan.java:101)
at org.hibernate.engine.query.HQLQueryPlan.<init>(HQLQueryPlan.java:80)
at org.hibernate.engine.query.QueryPlanCache.getHQLQueryPlan(QueryPlanCache.java:124)
at org.hibernate.impl.AbstractSessionImpl.getHQLQueryPlan(AbstractSessionImpl.java:156)
at org.hibernate.impl.AbstractSessionImpl.createQuery(AbstractSessionImpl.java:135)
at org.hibernate.impl.SessionImpl.createQuery(SessionImpl.java:1770)
at org.openbravo.mobile.core.process.ProcessHQLQuery.exec(ProcessHQLQuery.java:70)
at org.openbravo.mobile.core.process.SecuredJSONProcess.secureExec(SecuredJSONProcess.java:39)
at org.openbravo.mobile.core.process.MobileService.execClassName(MobileService.java:154)
at org.openbravo.mobile.core.process.MobileService.doGetOrPost(MobileService.java:77)
at org.openbravo.mobile.core.process.MobileService.doPost(MobileService.java:48)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
at org.openbravo.base.HttpBaseServlet.serviceInitialized(HttpBaseServlet.java:225)
at org.openbravo.base.secureApp.HttpSecureAppServlet.service(HttpSecureAppServlet.java:445)
at org.openbravo.client.kernel.BaseKernelServlet.callServiceInSuper(BaseKernelServlet.java:87)
at org.openbravo.mobile.core.process.WebServiceAuthenticatedServlet.service(WebServiceAuthenticatedServlet.java:52)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)

Proposed Solution

Additional Information