admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Security : direct access to GLOBALS

Browse source
This commit is contained in:
Dany De Bontridder 2019-09-08 15:42:09 +02:00
parent f987e9b3c7
commit 2a46b2cd6e
6 changed files with 43 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

13
include/customer.inc.php
View file

@ -74,7 +74,7 @@ if ($low_action == "list")
<form method="get" action="<?php echo $href;?>">
<?php
echo '<h2>' . "Exercice " . $g_user->get_exercice() . '</h2>';
$a=(isset($_GET['query']))?$_GET['query']:"";
$a=$http->get("query","string","");
echo _("Cherche ").HtmlInput::filter_table_form("tiers_tb", '0,1,2', 1,"query",$a);
$choice_cat=$http->request("choice_cat", "",1);
@ -85,7 +85,7 @@ if ($low_action == "list")
$sel_card->value=$cn->make_array('select fd_id, fd_label from fiche_def '.
' where frd_id='.FICHE_TYPE_CLIENT.
' order by fd_label ',1);
$sel_card->selected=(isset($_GET['cat']))?$_GET['cat']:-1;
$sel_card->selected=$http->get("cat","number",-1);
$sel_card->javascript=' onchange="submit(this);"';
echo _('Catégorie :').$sel_card->input();
} else
@ -101,17 +101,18 @@ if ($low_action == "list")
echo _('Inclure les clients sans opération :') . $nooperation->input();
?>
<input type="submit" class="button" name="submit_query" value="<?php echo _('recherche')?>">
<input type="hidden" name="ac" value="<?php echo $_REQUEST['ac']?>">
<input type="hidden" name="ac" value="<?php echo $http->request('ac')?>">
</form>
</div>
<?php
$client = new Customer($cn);
$search = (isset($_GET['query'])) ? $_GET['query'] : "";
$search=$http->get("query","string","");
$sql = "";
if (isset($_GET['cat']))
{
if ($_GET['cat'] != -1)
$sql = sprintf(" and fd_id = %d", $_GET['cat']);
$cat=$http->get("cat","number");
if ($cat!= -1)
$sql = sprintf(" and fd_id = %s", $cat);
}
$noop = (isset($_GET['noop'])) ? false : true;
echo '<div class="content">';