From 2e844abc39434a2f0682af2dc6aa1d9e78a2ffaa Mon Sep 17 00:00:00 2001
From: Dany De Bontridder <danydb@noalyss.eu>
Date: Fri, 8 Dec 2017 20:11:22 +0100
Subject: [PATCH] Protect queryString with encodeURI

---
 html/js/acc_ledger.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/html/js/acc_ledger.js b/html/js/acc_ledger.js
index 2238219b1..73d1dcc43 100644
--- a/html/js/acc_ledger.js
+++ b/html/js/acc_ledger.js
@@ -162,7 +162,7 @@ function update_row(ctl)
     {
         var jrn = g('p_jrn').value;
         var dossier = g('gDossier').value;
-        var qs = 'gDossier=' + dossier + '&op=minrow&j=' + jrn + '&ctl=' + ctl;
+        var qs = encodeURI('gDossier=' + dossier + '&op=minrow&j=' + jrn + '&ctl=' + ctl);
         var action = new Ajax.Request(
                 "ajax_misc.php",
                 {
@@ -917,7 +917,7 @@ function filter_card(obj, queryString)
     {
         queryString = queryString + '&j=' + jrn;
     }
-    return queryString;
+    return encodeURI(queryString);
 }
 /**
  *@brief to display the lettering for the operation, call
@@ -1058,7 +1058,7 @@ function op_save(obj)
             var action = new Ajax.Request('ajax_misc.php',
                     {
                         method: 'post',
-                        parameters: queryString,
+                        parameters: encodeURI(queryString),
                         onFailure: null,
                         onSuccess: infodiv
                     }