From 22b3512167542d196d073384b4029b7b3d103ed1 Mon Sep 17 00:00:00 2001
From: sparkyx <danydb@noalyss.eu>
Date: Thu, 12 Nov 2020 08:54:11 +0100
Subject: [PATCH] Security

---
 include/export/export_fiche_detail_pdf.php | 10 +++++-----
 include/export/export_fiche_pdf.php        | 19 ++++++++++++-------
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/include/export/export_fiche_detail_pdf.php b/include/export/export_fiche_detail_pdf.php
index de21a96ff..713de2af4 100644
--- a/include/export/export_fiche_detail_pdf.php
+++ b/include/export/export_fiche_detail_pdf.php
@@ -109,12 +109,12 @@ for ($e=0;$e<count($array);$e++)
             $diff_solde=bcsub($tot_deb,$tot_cred);
             if ( $diff_solde < 0 )
             {
-                $solde=" créditeur ";
+                $solde=" "._("créditeur")." ";
                 $diff_solde=bcmul($diff_solde,-1);
             }
             else
             {
-                 $solde=" débiteur ";
+                 $solde=" "._('débiteur')." ";
             }
             $str_diff_solde=sprintf("%12.2f €",$diff_solde);
 
@@ -129,7 +129,7 @@ for ($e=0;$e<count($array);$e++)
             /*
             * reset total and current_exercice
             */
-            $prog=0;
+            $progress=0;
             $current_exercice=$row['p_exercice'];
             $tot_deb=0;$tot_cred=0;    
             $pdf->SetFont('DejaVuCond','',8);
@@ -213,12 +213,12 @@ $str_credit=sprintf("% 12.2f €",$tot_cred);
 $diff_solde=$tot_deb-$tot_cred;
 if ( $diff_solde < 0 )
 {
-    $solde=" créditeur ";
+    $solde=" "._("créditeur")." ";
     $diff_solde*=-1;
 }
 else
 {
-    $solde=" débiteur ";
+    $solde=" "._('débiteur')." ";
 }
 $str_diff_solde=sprintf("%12.2f €",$diff_solde);
 
diff --git a/include/export/export_fiche_pdf.php b/include/export/export_fiche_pdf.php
index 03585e55a..567cf1727 100644
--- a/include/export/export_fiche_pdf.php
+++ b/include/export/export_fiche_pdf.php
@@ -48,23 +48,29 @@ $pdf->SetFont('DejaVu','BI',14);
 $pdf->write_cell(0,8,$name,0,1,'C');
 $pdf->SetTitle($name,1);
 $pdf->SetAuthor('NOALYSS');
+$http=new HttpInput();
+$start=$http->request('start');
+$end=$http->request('end');
+if ( isDate($start) == null || isDate ($end) == null ) 	 return;
+
 /* balance */
 if ( $_GET['histo'] == 4 )
 {
-    $fd=new Fiche_Def($cn,$_REQUEST['cat']);
+    $cat=$http->request('cat');
+    $fd=new Fiche_Def($cn,$cat);
     if ( $fd->hasAttribute(ATTR_DEF_ACCOUNT) == false )
     {
-        $pdf->write_cell(0,10, "Cette catégorie n'ayant pas de poste comptable n'a pas de balance");
+        $pdf->write_cell(0,10, _("Cette catégorie n'ayant pas de poste comptable n'a pas de balance"));
         //Save PDF to file
         $fDate=date('dmy-Hi');
         $pdf->Output("category-$fDate.pdf", 'D');
         exit;
     }
-    $aCard=$cn->get_array("select f_id,ad_value from fiche join fiche_Detail using (f_id)  where ad_id=1 and fd_id=$1 order by 2 ",array($_REQUEST['cat']));
+    $aCard=$cn->get_array("select f_id,ad_value from fiche join fiche_Detail using (f_id)  where ad_id=1 and fd_id=$1 order by 2 ",array($cat));
 
     if ( empty($aCard))
     {
-        $pdf->write_cell(0,10, "Aucune fiche trouvée");//Save PDF to file
+        $pdf->write_cell(0,10, _("Aucune fiche trouvée"));//Save PDF to file
         $fDate=date('dmy-Hi');
         $pdf->Output("category-$fDate.pdf", 'D');
         exit;
@@ -78,11 +84,10 @@ if ( $_GET['histo'] == 4 )
     $pdf->write_cell(20,7,'D/C',0,0,'C',0);
     $pdf->line_new();
     $idx=0;
+    $filter= " (j_date >= to_date('".$start."','DD.MM.YYYY') ".
+             " and  j_date <= to_date('".$end."','DD.MM.YYYY')) ";
     for ($i=0;$i < count($aCard);$i++)
     {
-        if ( isDate($_REQUEST['start']) == null || isDate ($_REQUEST['end']) == null ) 	 exit;
-        $filter= " (j_date >= to_date('".$_REQUEST['start']."','DD.MM.YYYY') ".
-                 " and  j_date <= to_date('".$_REQUEST['end']."','DD.MM.YYYY')) ";
         $oCard=new Fiche($cn,$aCard[$i]['f_id']);
         $solde=$oCard->get_solde_detail($filter);
         if ( $solde['debit'] == 0 && $solde['credit']==0) continue;