From 376aab00b2b490dec471bac65f72a051dc89e16f Mon Sep 17 00:00:00 2001
From: Dany De Bontridder <danydb@noalyss.eu>
Date: Wed, 10 Jun 2020 10:45:43 +0200
Subject: [PATCH] Code : not direct access to $_GET Bug : javascript didn't
 work

---
 html/recherche.php | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/html/recherche.php b/html/recherche.php
index f9f47c17e..f34549a23 100644
--- a/html/recherche.php
+++ b/html/recherche.php
@@ -74,7 +74,7 @@ window.onload=function ()
 {
     create_anchor_up();
     init_scroll();
-    sorttable.init
+    sorttable.init();
 }
 </script>
 <?php
@@ -123,10 +123,17 @@ if ( isset ($_GET['viewsearch']))
     /*
      * Export to csv
      */
-    $r=HtmlInput::get_to_hidden(array('l','date_start','date_end','desc','amount_min','amount_max','qcode','accounting','unpaid','gDossier','ledger_type'));
+    $r=HtmlInput::get_to_hidden(array('l','date_start','date_end','desc','amount_min','amount_max',
+        'qcode','accounting','unpaid','gDossier','ledger_type'));
     if (isset($_GET['r_jrn'])) {
-      foreach ($_GET['r_jrn'] as $k=>$v)
-	$r.=HtmlInput::hidden('r_jrn['.$k.']',$v);
+        $http=new HttpInput();
+        $a_rjrn=$http->get("r_jrn","array");
+      foreach ($a_rjrn as $k=>$v) {
+          // Protect : check that $k and $v are numeric
+        if (isNumber($k)&&isNumber($v)) {
+            $r.=HtmlInput::hidden('r_jrn['.$k.']',$v);
+        }
+      }
     }
     echo '<form action="export.php" method="get">';
     echo $r;