From 59c3ffdf0eeb85c9ac4ac464f30578eb9276e844 Mon Sep 17 00:00:00 2001
From: sparkyx <danydb@noalyss.eu>
Date: Fri, 27 Feb 2026 14:42:07 +0100
Subject: [PATCH] remove direct access to $_GET

---
 include/ajax/ajax_card.php | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/include/ajax/ajax_card.php b/include/ajax/ajax_card.php
index 7009598e7..f52bc70e3 100644
--- a/include/ajax/ajax_card.php
+++ b/include/ajax/ajax_card.php
@@ -88,7 +88,6 @@ $html=var_export($_REQUEST,true);
 // For storing extra information , example the HTML elt id to update
 // after creating
 $extra="";
-$http=new \HttpInput();
 switch($op2)
 {
     case 'attribute':
@@ -717,7 +716,7 @@ case 'upc':
     }
   else
     {
-      if ($cn->get_value('select count(*) from fiche where f_id=$1',array($_GET['f_id'])) == '0' )
+      if ($cn->get_value('select count(*) from fiche where f_id=$1',array($http->get('f_id'))) == '0' )
 	{
 	  $html.=alert(_('Fiche non valide'),true);
 	  }
@@ -726,7 +725,7 @@ case 'upc':
 	{
 	  $html=HtmlInput::title_box(_('Détail fiche (sauvée)'),$ctl);
 
-	  $f=new Fiche($cn,$_GET['f_id']);
+	  $f=new Fiche($cn,$http->get('f_id'));
 	  ob_start();
 	  $f->update($_GET);
 	  $html.=ob_get_contents();