diff --git a/html/access.php b/html/access.php index 6bc73d3b7..a24713b49 100644 --- a/html/access.php +++ b/html/access.php @@ -40,10 +40,10 @@ if ($user->AccessJrn($cn,dossier::id()) == false ){ } if ( DBVERSION!=dossier::get_version($cn)) { - echo "Votre base de données n'est pas à jour, "; + echo '

Votre base de données n\'est pas à jour, '; $a="cliquez ici pour appliquer le patch"; $base=dirname($_SERVER['REQUEST_URI']).'/admin/setup.php'; - echo ''.$a.''; + echo ''.$a.'

'; } html_page_start($_SESSION['g_theme']); diff --git a/html/admin/sql/patch/upgrade53.sql b/html/admin/sql/patch/upgrade53.sql new file mode 100644 index 000000000..c422c5a0d --- /dev/null +++ b/html/admin/sql/patch/upgrade53.sql @@ -0,0 +1,52 @@ +begin; +CREATE OR REPLACE FUNCTION html_quote(p_string text) + RETURNS text AS +$BODY$ +declare + r text; +begin + r:=p_string; + r:=replace(r,'<','<'); + r:=replace(r,'>','>'); + r:=replace(r,'''','"'); + return r; +end;$BODY$ + LANGUAGE plpgsql; + +COMMENT ON FUNCTION html_quote(text) IS 'remove harmfull HTML char'; + +CREATE OR REPLACE FUNCTION tva_modify(integer, text, numeric, text, text) + RETURNS integer AS +$BODY$ +declare +p_tva_id alias for $1; +p_tva_label alias for $2; +p_tva_rate alias for $3; +p_tva_comment alias for $4; +p_tva_poste alias for $5; +debit text; +credit text; +nCount integer; +begin +if length(trim(p_tva_label)) = 0 then + return 3; +end if; + +if length(trim(p_tva_poste)) != 0 then + if position (',' in p_tva_poste) = 0 then return 4; end if; + debit = split_part(p_tva_poste,',',1); + credit = split_part(p_tva_poste,',',2); + select count(*) into nCount from tmp_pcmn where pcm_val=debit::poste_comptable; + if nCount = 0 then return 4; end if; + select count(*) into nCount from tmp_pcmn where pcm_val=credit::poste_comptable; + if nCount = 0 then return 4; end if; + +end if; +update tva_rate set tva_label=p_tva_label,tva_rate=p_tva_rate,tva_comment=p_tva_comment,tva_poste=p_tva_poste + where tva_id=p_tva_id; +return 0; +end; +$BODY$ + LANGUAGE plpgsql; +update version set val=54; +commit; diff --git a/html/comptanalytic.php b/html/comptanalytic.php index 5838777bf..e0290719b 100644 --- a/html/comptanalytic.php +++ b/html/comptanalytic.php @@ -99,8 +99,8 @@ if ( $_REQUEST['p_action'] == "pref" ) // Plan Analytique if ($_REQUEST['p_action'] == 'ca_pa' ) { - require_once('anc_pa.inc.php'); - exit(); + require_once('anc_pa.inc.php'); + exit(); } // Operations Diverses @@ -119,6 +119,10 @@ if ($_REQUEST['p_action'] == 'ca_groupe' ) // Impression if ($_REQUEST['p_action'] == 'ca_imp' ) { - require_once('anc_imp.inc.php'); - exit(); + echo '
'; + + require_once('anc_imp.inc.php'); + echo '
'; + + exit(); } diff --git a/html/line_update.php b/html/line_update.php index f22992709..1c79f2b2a 100644 --- a/html/line_update.php +++ b/html/line_update.php @@ -81,8 +81,8 @@ if ( isset ($_POST["update"] ) ) { } /* Parent existe */ $Ret=ExecSqlParam($cn,"select pcm_val from tmp_pcmn where pcm_val=$1",array($p_parent)); - if ( pg_NumRows($Ret) == 0 || $p_parent==$old_line ) { - echo ''; + if ( ($p_parent != 0 && pg_NumRows($Ret) == 0) || $p_parent==$old_line ) { + echo ''; } else { $acc->update($old_line); } diff --git a/html/poste_search.php b/html/poste_search.php index 4c7e589ab..9bfa12a82 100644 --- a/html/poste_search.php +++ b/html/poste_search.php @@ -143,7 +143,7 @@ echo ''; echo '

Nombre de lignes affichées est limité

'; // if request search if ( isset($_GET['search']) || isset($_GET['filter']) ) { - $Res=ExecSql($cn,"select pcm_val,pcm_lib from tmp_pcmn $condition order by pcm_val::text ". + $Res=ExecSql($cn,"select pcm_val,html_quote(pcm_lib) from tmp_pcmn $condition order by pcm_val::text ". " limit 70"); $MaxLine=pg_NumRows($Res); diff --git a/include/ac_common.php b/include/ac_common.php index f591a6ca9..eb4900f37 100644 --- a/include/ac_common.php +++ b/include/ac_common.php @@ -27,6 +27,11 @@ include_once("debug.php"); include_once("constant.php"); require_once('preference.php'); require_once ("postgres.php"); +/*!\brief to protect again bad characters which can lead to a cross scripting attack + the string to be diplayed must be protected +*/ +function h($p_string) { return htmlspecialchars($p_string);} + /*! * \brief log error into the /tmp/phpcompta_error.log it doesn't work on windows * diff --git a/include/anc_group.inc.php b/include/anc_group.inc.php index 6b6d49b72..f6b740d7e 100644 --- a/include/anc_group.inc.php +++ b/include/anc_group.inc.php @@ -57,9 +57,9 @@ echo ''; echo ''; foreach ($array as $idx=>$m) { echo ''; - echo ''; - echo ''; - echo ''; + echo ''; + echo ''; + echo ''; echo ''; echo ''; } diff --git a/include/anc_pa.inc.php b/include/anc_pa.inc.php index 62dd694d1..56a8e11e4 100644 --- a/include/anc_pa.inc.php +++ b/include/anc_pa.inc.php @@ -220,13 +220,13 @@ if ( isset($_REQUEST['sa'])) $ret.=""; $ret.=""; - $ret.=""; + $ret.=""; $ret.=""; - $ret.=""; + $ret.=""; $ret.=""; } @@ -275,7 +275,7 @@ if ( empty($list) ) echo ''; echo ''; echo '". "". "". - "". + "". "". "". ""; diff --git a/include/class_acc_ledger.php b/include/class_acc_ledger.php index 65a82c231..0dd86bef1 100644 --- a/include/class_acc_ledger.php +++ b/include/class_acc_ledger.php @@ -33,6 +33,7 @@ require_once ('class_acc_reconciliation.php'); require_once ('class_periode.php'); require_once ('class_gestion_purchase.php'); require_once ('class_acc_account.php'); +require_once('ac_common.php'); /*!\file * \brief Class for jrn, class acc_ledger for manipulating the ledger @@ -278,7 +279,7 @@ class Acc_Ledger { 'internal'=>$line['jr_internal'], 'deb_montant'=>'', 'cred_montant'=>' ', - 'description'=>''.$line['jr_comment'].' ['.$tot_op.'] ', + 'description'=>''.h($line['jr_comment']).' ['.$tot_op.'] ', 'poste' => $line['oc'], 'qcode' => $line['j_qcode'], 'periode' =>$line['periode'] ); @@ -318,7 +319,7 @@ class Acc_Ledger { $a=array($array,$tot_deb,$tot_cred); return $a; } - /* \brief Get simplified row from ledger + /*! \brief Get simplified row from ledger * * \param from periode * \param to periode @@ -796,7 +797,7 @@ class Acc_Ledger { foreach ( $array as $value) { $ret[$idx]['value']=$value['jrn_def_id']; - $ret[$idx]['label']=$value['jrn_def_name']; + $ret[$idx]['label']=h($value['jrn_def_name']); $idx++; } @@ -864,7 +865,7 @@ class Acc_Ledger { $ret=""; $ret.="
Code Plan Description
'.$m->ga_id.''.$m->pa_name.''.$m->ga_description.''.h($m->ga_id).''.h($m->pa_name).''.h($m->ga_description).' Effacer '.'
". ''. - $obj->name. + h($obj->name). ''; "".$obj->amount."".$obj->description."".h($obj->description)."".$obj->ga_id."".$new->name."".h($new->name)."
'. ''. - $line['name']. + h($line['name']). ''. ''. diff --git a/include/bud_card.inc.php b/include/bud_card.inc.php index 113b3ca42..5ecb470da 100644 --- a/include/bud_card.inc.php +++ b/include/bud_card.inc.php @@ -29,7 +29,7 @@ require_once ('class_widget.php'); echo '
'; $wHypo=new widget("select","","bh_id"); -$wHypo->value=make_array($cn,"select bh_id,bh_name from bud_hypothese"); +$wHypo->value=make_array($cn,"select bh_id,html_quote(bh_name) from bud_hypothese"); $wHypo->selected=(isset($_REQUEST['bh_id']))?$_REQUEST['bh_id']:""; $wHypo->javascript='onChange="this.form.submit();"'; echo "Hypothèse ".$wHypo->IOValue(); @@ -73,8 +73,8 @@ if (! empty ($list)) { $row=array(); foreach ($list as $r ) { $row[]=array('?'.$str_dossier.'&p_action=fiche&sa=detail&bc_id='.$r->bc_id.'&bh_id='.$r->bh_id, - $r->bc_code, - $r->bc_description, + h($r->bc_code), + h($r->bc_description), $r->bc_id ); diff --git a/include/bud_detail.inc.php b/include/bud_detail.inc.php index 135415650..a4b063777 100644 --- a/include/bud_detail.inc.php +++ b/include/bud_detail.inc.php @@ -119,7 +119,7 @@ echo '
'; // Show 20 lines by default //---------------------------------------------------------------------- require_once ('class_bud_data.php'); -echo JS_PROTOTYPE_JS; +echo JS_PROTOTYPE; echo JS_BUD_SCRIPT; extract($_GET); $obj=new Bud_Data($cn,$bh_id,$po_id); diff --git a/include/bud_hypo.inc.php b/include/bud_hypo.inc.php index 46ad49fe4..670c3e0fa 100644 --- a/include/bud_hypo.inc.php +++ b/include/bud_hypo.inc.php @@ -57,8 +57,8 @@ if (! empty ($list)) { $row=array(); foreach ($list as $r ) { $row[]=array('?'.$str_dossier.'&p_action=hypo&sa=detail&bh_id='.$r->bh_id, - $r->bh_name, - $r->bh_description, + h($r->bh_name), + h($r->bh_description), $r->bh_id); } diff --git a/include/central_inc.php b/include/central_inc.php index 3d60d1db8..e1e084beb 100644 --- a/include/central_inc.php +++ b/include/central_inc.php @@ -157,6 +157,7 @@ $sql="insert into centralized( c_j_id, return NOERROR; } /*! + ************************************************** * \brief test if e jrn_jr.id is centralize or not * \param $p_cn database connx * \param $p_jrn_id jrn.jr_id diff --git a/include/class_acc_account.php b/include/class_acc_account.php index 72c58825c..a5dafdf8d 100644 --- a/include/class_acc_account.php +++ b/include/class_acc_account.php @@ -108,7 +108,7 @@ class Acc_Account { else return true; } else if ( strcmp ($p_member,'pcm_val_parent') == 0 ) { - if ( is_numeric($p_value) == 0 || $this->count($p_value) == 0) + if ( is_numeric($p_value) == 0 || ($this->count($p_value) == 0 && $p_value !=0)) throw new AcException('Poste comptable parent incorrect '.$p_value); else return true; @@ -167,7 +167,7 @@ class Acc_Account { $ret=''; $ret.=sprintf ('',$this->pcm_val); $ret.=""; - $ret.=sprintf('',urldecode($this->pcm_lib)); + $ret.=sprintf('',h($this->pcm_lib)); $ret.= ""; $ret.=sprintf ('',$this->pcm_val_parent); $ret.=''; @@ -176,7 +176,7 @@ class Acc_Account { $ret.= ''; $ret.="
Numéro de classe
Libellé Libellé
Classe Parent
'.$wType->IOValue().'
"; $ret.=dossier::hidden(); - print_r($this); + return $ret; } } @@ -190,7 +190,7 @@ class Acc_Account { } function update($p_old) { - $this->pcm_lib=substr(FormatString ($this->pcm_lib),0,50); + $this->pcm_lib=substr(FormatString ($this->pcm_lib),0,150); $this->check(); $sql="update tmp_pcmn set pcm_val=$1, pcm_lib=$2,pcm_val_parent=$3,pcm_type=$4 where pcm_val=$5"; $Ret=ExecSqlParam($this->db,$sql,array($this->pcm_val, diff --git a/include/class_acc_account_ledger.php b/include/class_acc_account_ledger.php index 79d855dd5..125a4eca1 100644 --- a/include/class_acc_account_ledger.php +++ b/include/class_acc_account_ledger.php @@ -252,7 +252,7 @@ function get_solde_detail($p_cond="") { echo "
".$op['jr_internal']."".$op['j_date']."".$op['description']."".h($op['description'])."".$op['deb_montant']."".$op['cred_montant']."
"; $ret.=""; - $ret.=""; + $ret.=""; $ret.='
Date : $date
Description $desc
Description ".h($desc)."
'; $ret.=""; $ret.=""; @@ -902,14 +903,14 @@ class Acc_Ledger { if ( trim(${'qc_'.$i})=="" && trim(${'poste'.$i}) != "") { $oposte=new Acc_Account_Ledger($this->db,${'poste'.$i}); $strPoste=$oposte->id; - $ret.="'; } if ( trim(${'qc_'.$i})=="" && trim(${'poste'.$i}) == "") continue; - $ret.=""; + $ret.=""; $ret.=""; $ret.="'; $this->id=$p_jrn; $r.=''; $r.=''; @@ -405,7 +406,7 @@ class Acc_Ledger_Fin extends Acc_Ledger { $r.=''; // Extrait //-- - $r.=''.$ext_no; + $r.=''.h($ext_no); $r.=''; $r.=''; $r.=''; @@ -436,7 +437,7 @@ class Acc_Ledger_Fin extends Acc_Ledger { $tiers_label=""; $tiers_amount=round(${"e_other$i"."_amount"},2); $tot_amount=bcadd($tot_amount,$tiers_amount); - $tiers_comment=${"e_other$i"."_comment"}; + $tiers_comment=h(${"e_other$i"."_comment"}); // If $tiers has a value $fTiers=new fiche($this->db); $fTiers->get_by_qcode($tiers); diff --git a/include/class_acc_ledger_info.php b/include/class_acc_ledger_info.php index 41cd2a56b..9afe1b7bb 100644 --- a/include/class_acc_ledger_info.php +++ b/include/class_acc_ledger_info.php @@ -21,6 +21,7 @@ // Copyright Author Dany De Bontridder ddebontridder@yahoo.fr require_once ('class_dossier.php'); require_once ('postgres.php'); +require_once('ac_common.php'); /*!\file * \brief Manage additional info for Accountancy diff --git a/include/class_acc_ledger_purchase.php b/include/class_acc_ledger_purchase.php index 4fbd415de..17396ad04 100644 --- a/include/class_acc_ledger_purchase.php +++ b/include/class_acc_ledger_purchase.php @@ -29,6 +29,7 @@ require_once('class_anc_operation.php'); require_once('user_common.php'); require_once('class_acc_parm_code.php'); require_once('class_acc_payment.php'); +require_once('ac_common.php'); /*!\brief Handle the ledger of purchase, * * @@ -876,10 +877,10 @@ class Acc_Ledger_Purchase extends Acc_Ledger { $client=new fiche($this->db); $client->get_by_qcode($e_client,true); - $client_name=$client->getName(). + $client_name=h($client->getName(). ' '.$client->strAttribut(ATTR_DEF_ADRESS).' '. $client->strAttribut(ATTR_DEF_CP).' '. - $client->strAttribut(ATTR_DEF_CITY); + $client->strAttribut(ATTR_DEF_CITY)); $lPeriode=new Periode($this->db); $date_limit=$lPeriode->get_date_limit($periode); $r=""; @@ -891,13 +892,13 @@ class Acc_Ledger_Purchase extends Acc_Ledger { $r.=''; $r.=''; $r.=''; - $r.=''; + $r.=''; $r.=''; $r.=''; - $r.=''; + $r.=''; $r.=''; $r.=''; - $r.=''; + $r.=''; $r.=''; $r.='
".${"poste".$i}." - ". - $oposte->get_name().$hidden->IOValue('poste'.$i,${'poste'.$i}). + $ret.="".h(${"poste".$i}." - ". + $oposte->get_name()).$hidden->IOValue('poste'.$i,${'poste'.$i}). '".${"ld".$i}.$hidden->IOValue('ld'.$i,${'ld'.$i})."".h(${"ld".$i}).$hidden->IOValue('ld'.$i,${'ld'.$i})."".${"amount".$i}.$hidden->IOValue('amount'.$i,${'amount'.$i}).""; $ret.=(isset(${"ck$i"}))?"D":"C"; @@ -1352,91 +1353,7 @@ class Acc_Ledger { return $all[0]; } - /*! - * \brief this function is intended to test this class - */ - static function test_me() - { - echo Acc_Reconciliation::$javascript; - html_page_start(); - $cn=DbConnect(dossier::id()); - $_SESSION['g_user']='phpcompta'; - $_SESSION['g_pass']='phpcompta'; - $id=(isset ($_REQUEST['p_jrn']))?$_REQUEST['p_jrn']:-1; - $a=new Acc_Ledger($cn,$id); - $a->with_concerned=true; - // Vide - echo ''; - echo $a->select_ledger()->IOValue(); - echo widget::submit('go','Test it'); - echo ''; - if ( isset($_POST['go'])) { - echo "Ok "; - echo '
'; - echo $a->show_form(); - echo widget::submit('post_id','Try me'); - echo '
'; - // Show the predef operation - // Don't forget the p_jrn - echo '
'; - echo dossier::hidden(); - echo ''; - $op=new Pre_operation($cn); - $op->p_jrn=$id; - $op->od_direct='t'; - if ($op->count() != 0 ) - echo widget::submit('use_opd','Utilisez une op.prédéfinie'); - echo $op->show_button(); - echo '
'; - exit(); - } - - if ( isset($_POST['post_id' ])) { - - echo '
'; - echo $a->show_form($_POST,1); - echo widget::button('add','Ajout d\'une ligne','onClick="quick_writing_add_row()"'); - echo widget::submit('save_it',"Sauver"); - echo '
'; - exit(); - } - if ( isset($_POST['save_it' ])) { - print 'saving'; - $array=$_POST; - $array['save_opd']=1; - try { - $a->save($array); - } catch (AcException $e) { - echo '"; - echo '
'; - - echo $a->show_form($_POST); - echo widget::submit('post_id','Try me'); - echo '
'; - - } - exit(); - } - // The GET at the end because automatically repost when you don't - // specify the url in the METHOD field - if ( isset ($_GET['use_opd'])) { - $op=new Pre_op_advanced($cn); - $op->set_od_id($_REQUEST['pre_def']); - //$op->p_jrn=$id; - - $p_post=$op->compute_array(); - - echo '
'; - - echo $a->show_form($p_post); - echo widget::submit('post_id','Use predefined operation'); - echo '
'; - exit(); - - } - - } /*!\brief Update the paiment in the list of operation *\param $p_array is normally $_GET */ @@ -1597,4 +1514,91 @@ function get_last_date() } } } + /*! + * \brief this function is intended to test this class + */ + static function test_me() + { + echo Acc_Reconciliation::$javascript; + html_page_start(); + $cn=DbConnect(dossier::id()); + $_SESSION['g_user']='phpcompta'; + $_SESSION['g_pass']='phpcompta'; + + $id=(isset ($_REQUEST['p_jrn']))?$_REQUEST['p_jrn']:-1; + $a=new Acc_Ledger($cn,$id); + $a->with_concerned=true; + // Vide + echo '
'; + echo $a->select_ledger()->IOValue(); + echo widget::submit('go','Test it'); + echo '
'; + if ( isset($_POST['go'])) { + echo "Ok "; + echo '
'; + echo $a->show_form(); + echo widget::submit('post_id','Try me'); + echo '
'; + // Show the predef operation + // Don't forget the p_jrn + echo '
'; + echo dossier::hidden(); + echo ''; + $op=new Pre_operation($cn); + $op->p_jrn=$id; + $op->od_direct='t'; + if ($op->count() != 0 ) { + print_r("Count != 0"); + echo widget::submit('use_opd','Utilisez une op.prédéfinie'); + echo $op->show_button(); + } + echo '
'; + exit(); + } + + if ( isset($_POST['post_id' ])) { + + echo '
'; + echo $a->show_form($_POST,1); + echo widget::button('add','Ajout d\'une ligne','onClick="quick_writing_add_row()"'); + echo widget::submit('save_it',"Sauver"); + echo '
'; + exit(); + } + if ( isset($_POST['save_it' ])) { + print 'saving'; + $array=$_POST; + $array['save_opd']=1; + try { + $a->save($array); + } catch (AcException $e) { + echo '"; + echo '
'; + + echo $a->show_form($_POST); + echo widget::submit('post_id','Try me'); + echo '
'; + + } + exit(); + } + // The GET at the end because automatically repost when you don't + // specify the url in the METHOD field + if ( isset ($_GET['use_opd'])) { + $op=new Pre_op_advanced($cn); + $op->set_od_id($_REQUEST['pre_def']); + //$op->p_jrn=$id; + + $p_post=$op->compute_array(); + + echo '
'; + + echo $a->show_form($p_post); + echo widget::submit('post_id','Use predefined operation'); + echo '
'; + exit(); + + } + + } } diff --git a/include/class_acc_ledger_fin.php b/include/class_acc_ledger_fin.php index 81c83968b..91e6d78d6 100644 --- a/include/class_acc_ledger_fin.php +++ b/include/class_acc_ledger_fin.php @@ -26,6 +26,7 @@ */ require_once('class_acc_ledger.php'); require_once('poste.php'); +require_once('ac_common.php'); class Acc_Ledger_Fin extends Acc_Ledger { /*!\brief verify that the data are correct before inserting or confirming @@ -368,7 +369,7 @@ class Acc_Ledger_Fin extends Acc_Ledger { $r.='		 Journal '; - $r.=$this->get_name(); + $r.=h($this->get_name()); $r.='
Numéro d\'extrait Numéro d\'extraitSolde début extrait '.$first_sold.'Solde fin extrait Echeance '.$e_ech.' Période Comptable '.$date_limit['p_start'].'-'.$date_limit['p_end'].'
Journal '.$this->get_name().' Journal '.h($this->get_name()).'
Description '.$e_comm.' Description '.h($e_comm).'
Fournisseur '.$e_client.':'.$client_name.' Fournisseur '.h($e_client.':'.$client_name).'
'; $r.=''; @@ -922,7 +923,7 @@ class Acc_Ledger_Purchase extends Acc_Ledger { /* retrieve information for card */ $fiche=new fiche($this->db); $fiche->get_by_qcode(${"e_march".$i}); - $fiche_name=$fiche->getName(); + $fiche_name=h($fiche->getName()); $idx_tva=${"e_march".$i."_tva_id"}; $oTva=new Acc_Tva($this->db); $oTva->set_parameter('id',$idx_tva); diff --git a/include/class_acc_ledger_sold.php b/include/class_acc_ledger_sold.php index 0a3b7fe37..3c9bd3607 100644 --- a/include/class_acc_ledger_sold.php +++ b/include/class_acc_ledger_sold.php @@ -28,6 +28,7 @@ require_once('class_acc_compute.php'); require_once('class_anc_operation.php'); require_once('user_common.php'); require_once('class_acc_payment.php'); +require_once('ac_common.php'); /*!\brief Handle the ledger of sold, * * @@ -548,7 +549,7 @@ class Acc_Ledger_Sold extends Acc_Ledger { $label=" Description ".widget::infobulle(1) ; $r.=""; $r.=''.$label.''. - ''.$Commentaire->IOValue("e_comm",$e_comm).""; + ''.$Commentaire->IOValue("e_comm",h($e_comm)).""; $r.=""; // Display the customer @@ -769,13 +770,13 @@ class Acc_Ledger_Sold extends Acc_Ledger { $r.='Echeance '.$e_ech.''; $r.=' Période Comptable '.$date_limit['p_start'].'-'.$date_limit['p_end'].''; $r.=''; - $r.=' Journal '.$this->get_name().''; + $r.=' Journal '.h($this->get_name()).''; $r.=''; $r.=''; - $r.=' Description '.$e_comm.''; + $r.=' Description '.h($e_comm).''; $r.=''; $r.=''; - $r.=' Client '.$e_client.':'.$client_name.''; + $r.=' Client '.h($e_client.':'.$client_name).''; $r.=''; $r.=''; $r.=''; @@ -800,7 +801,7 @@ class Acc_Ledger_Sold extends Acc_Ledger { /* retrieve information for card */ $fiche=new fiche($this->db); $fiche->get_by_qcode(${"e_march".$i}); - $fiche_name=$fiche->getName(); + $fiche_name=h($fiche->getName()); $oTva=new Acc_Tva($this->db); $idx_tva=${"e_march".$i."_tva_id"}; @@ -824,7 +825,7 @@ class Acc_Ledger_Sold extends Acc_Ledger { $r.=${"e_march".$i}; $r.=''; $r.=''; - $r.=$fiche_name; + $r.=h($fiche_name); $r.=''; $r.=''; $r.=${"e_march".$i."_price"}; @@ -904,6 +905,7 @@ class Acc_Ledger_Sold extends Acc_Ledger { $r.=widget::hidden('nb_item',$nb_item); $r.=widget::hidden('p_jrn',$p_jrn); $r.=widget::hidden('periode',$periode); + /*\todo comment les types hidden gérent ils des contenus avec des quotes, double quote ou < > ??? */ $r.=widget::hidden('e_comm',$e_comm); $r.=widget::hidden('e_date',$e_date); $r.=widget::hidden('e_ech',$e_ech); @@ -957,7 +959,8 @@ class Acc_Ledger_Sold extends Acc_Ledger { $doc_gen=new widget("select"); $doc_gen->name="gen_doc"; $doc_gen->value=make_array($this->db, - "select md_id,md_name from document_modele where md_type=4"); + "select md_id,html_quote(md_name) ". + " from document_modele where md_type=4"); $r.=$doc_gen->IOValue().'
'; } $r.='
'; diff --git a/include/class_acc_operation.php b/include/class_acc_operation.php index 925baf21d..749e52ff2 100644 --- a/include/class_acc_operation.php +++ b/include/class_acc_operation.php @@ -206,7 +206,7 @@ function get_internal() { $r.=''; $a=($l['vw_name']=="")?$l['j_qcode']:$l['pcm_lib']; $r_notable.=$a; - $r.=$a; + $r.=h($a); $csv.='"'.$a.'";'; $r.=''; diff --git a/include/class_acc_parm_code.php b/include/class_acc_parm_code.php index da754818d..2fedba8f0 100644 --- a/include/class_acc_parm_code.php +++ b/include/class_acc_parm_code.php @@ -104,7 +104,7 @@ class Acc_Parm_Code { { $r=""; $r.= ''.$this->p_code.''; - $r.= ''.$this->p_comment.''; + $r.= ''.h($this->p_comment).''; $r.= ''.$this->p_value.''; return $r; diff --git a/include/class_anc_balance_double.php b/include/class_anc_balance_double.php index f763c1de6..9d543db93 100644 --- a/include/class_anc_balance_double.php +++ b/include/class_anc_balance_double.php @@ -59,8 +59,7 @@ class Anc_Balance_Double extends Anc_Print $odd++; $r.=($odd%2==0)?'':''; - // the name and po_id - // $r.=sprintf("%s",$row['po_id']); + if ( $old == $row['a_po_name'] ) { $r.=''; } else { @@ -94,7 +93,7 @@ class Anc_Balance_Double extends Anc_Print $tot_deb+=$row['a_d']; $tot_cred+=$row['a_c']; - $r.=sprintf("%s",$row['b_po_name']); + $r.=sprintf("%s",h($row['b_po_name'])); $r.=sprintf("%12.2f",$row['a_d']); $r.=sprintf("%12.2f",$row['a_c']); $r.=sprintf("%12.2f",$row['a_solde']); diff --git a/include/class_anc_balance_simple.php b/include/class_anc_balance_simple.php index 11c9f105b..102be6f81 100644 --- a/include/class_anc_balance_simple.php +++ b/include/class_anc_balance_simple.php @@ -135,7 +135,7 @@ class Anc_Balance_Simple extends Anc_Print { $r.=($odd%2==0)?'':''; // the name and po_id // $r.=sprintf("%s",$row['po_id']); - $r.=sprintf("%s",$row['po_name']); + $r.=sprintf("%s",h($row['po_name'])); $r.=sprintf("%12.2f",$row['sum_deb']); $r.=sprintf("%12.2f",$row['sum_cred']); $r.=sprintf("%12.2f",$row['solde']); diff --git a/include/class_anc_group_operation.php b/include/class_anc_group_operation.php index 9c8f1766f..940ad758e 100644 --- a/include/class_anc_group_operation.php +++ b/include/class_anc_group_operation.php @@ -100,7 +100,8 @@ class Anc_Group_Operation { $idx=$d['id']; /* array of possible value for the select */ - $aPoste[$idx]=make_array($this->db,"select po_id as value,po_name||':'||po_description as label". + $aPoste[$idx]=make_array($this->db,"select po_id as value,". + " html_quote(po_name||':'||po_description) as label ". " from poste_analytique ". " where pa_id = ".$idx. " order by po_name "); diff --git a/include/class_anc_listing.php b/include/class_anc_listing.php index 34d87ad55..512a709a6 100644 --- a/include/class_anc_listing.php +++ b/include/class_anc_listing.php @@ -79,8 +79,8 @@ class Anc_Listing extends Anc_Print { $r.= ''; $r.= ''.$row['oa_date'].''. - ''.$row['po_name'].''. - ''.$row['oa_description'].''. + ''.h($row['po_name']).''. + ''.h($row['oa_description']).''. ''.$row['oa_amount'].''. ''.(($row['oa_debit']=='f')?'CREDIT':'DEBIT').''; $r.= ''; diff --git a/include/class_anc_operation.php b/include/class_anc_operation.php index f0f907625..3a9ec48b5 100644 --- a/include/class_anc_operation.php +++ b/include/class_anc_operation.php @@ -214,7 +214,7 @@ class Anc_Operation $row['oa_date']. "". "". - $row['oa_description']. + h($row['oa_description']). ""; $ret.="". @@ -233,7 +233,7 @@ class Anc_Operation if ( $cred=='CREDIT') $ret.=''; $ret.= "". - $row['po_name']. + h($row['po_name']). ""; if ( $cred=='DEBIT') $ret.=''; @@ -390,7 +390,7 @@ function get_balance($p_from,$p_to,$p_plan_id) $result.=''; else $result.='
'; - $result.="".$plan->header().""; + $result.="".h($plan->header()).""; @@ -407,7 +407,7 @@ function get_balance($p_from,$p_to,$p_plan_id) $array=make_array($this->db, "select pa_id||'_'||po_id as value,". - " po_name as label from poste_analytique ". + " html_quote(po_name) as label from poste_analytique ". " where pa_id = ".$r_plan['id']. " order by po_name",$p_null); $select = new widget("select","","ta_".$p_seq."o".$count."row_".$i,$array); diff --git a/include/class_customer.php b/include/class_customer.php index 7d87666e1..343eedbf4 100644 --- a/include/class_customer.php +++ b/include/class_customer.php @@ -56,8 +56,8 @@ class Customer extends fiche{ */ function get_by_account($p_poste=0) { $this->poste=($p_poste==0)?$this->poste:$p_poste; - $sql="select * from vw_client where poste_comptable=".$this->poste; - $Res=ExecSql($this->cn,$sql); + $sql="select * from vw_client where poste_comptable=$1"; + $Res=ExecSqlParam($this->cn,$sql,array($this->poste)); if ( pg_NumRows($Res) == 0) return null; // There is only _one_ row by customer $row=pg_fetch_array($Res,0); @@ -247,10 +247,10 @@ where $script,$client->id,$str_dossier,$url); $r.=""; - $r.=""; - $r.=""; + $r.=""; diff --git a/include/class_document_modele.php b/include/class_document_modele.php index 3aca40d2d..ed914ea01 100644 --- a/include/class_document_modele.php +++ b/include/class_document_modele.php @@ -60,7 +60,7 @@ class Document_modele { foreach ( $all as $row) { $r.=""; $r.=""; $r.="". "". "". - "". + "". "". "". ""; @@ -959,7 +959,7 @@ class fiche { if ( $p_array == null) $p_array=$_REQUEST; - $name=$this->getName(); + $name=h($this->getName()); list($array,$tot_deb,$tot_cred)=$this->get_row( $p_array['from_periode'], $p_array['to_periode'] @@ -984,7 +984,7 @@ class fiche { echo "". "". "". - "". + "". "". "". ""; diff --git a/include/class_pre_operation.php b/include/class_pre_operation.php index 5fab3b624..1c4425c69 100644 --- a/include/class_pre_operation.php +++ b/include/class_pre_operation.php @@ -117,7 +117,7 @@ class Pre_operation function show_button() { $select=new widget("select"); - $value=make_array($this->db,"select od_id,od_name from op_predef ". + $value=make_array($this->db,"select od_id,html_quote(od_name) from op_predef ". " where jrn_def_id=".$this->p_jrn. " and od_direct ='".$this->od_direct."'". " order by od_name"); @@ -125,6 +125,7 @@ class Pre_operation if ( empty($value)==true) return ""; $select->value=$value; $r=$select->IOValue("pre_def"); + return $r; } /*!\brief count the number of pred operation for a ledger */ @@ -178,10 +179,10 @@ class Pre_operation_detail { $r.=dossier::hidden(); $r.=$hid->IOValue("p_jrn",$this->get("ledger")); $r.=$hid->IOValue("jrn_type",$this->get("ledger_type")); - - // if ($this->count() != 0 ) + if ($this->count() != 0 ) { $r.= widget::submit('use_opd','Utilisez une op.prédéfinie'); - $r.= $this->show_button(); + $r.= $this->show_button(); + } return $r; } @@ -205,7 +206,7 @@ class Pre_operation_detail { return $r; } public function get_operation() { - $value=make_array($this->db,"select od_id,od_name from op_predef ". + $value=make_array($this->db,"select od_id,html_quote(od_name) from op_predef ". " where jrn_def_id=".FormatString($this->jrn_def_id). " and od_direct ='".FormatString($this->od_direct)."'". " order by od_name"); diff --git a/include/class_supplier.php b/include/class_supplier.php index cd7202a61..075f74830 100644 --- a/include/class_supplier.php +++ b/include/class_supplier.php @@ -128,10 +128,10 @@ class Supplier extends fiche{ $script,$supplier->id,$url); $r.=""; - $r.=""; - $r.=""; + $r.=""; diff --git a/include/constant.php b/include/constant.php index 077b0a9e6..2b5d9901c 100644 --- a/include/constant.php +++ b/include/constant.php @@ -25,7 +25,7 @@ */ require_once ('config.inc.php'); -define ("DBVERSION",53); +define ("DBVERSION",54); define ("MAX_COMPTE",4); define ('MAX_BUD_DETAIL',20); diff --git a/include/dossier.inc.php b/include/dossier.inc.php index d7b4e8822..1bcd7a763 100644 --- a/include/dossier.inc.php +++ b/include/dossier.inc.php @@ -170,8 +170,8 @@ if ( $sa == 'list' ) { $cl='class="even"'; echo "". - "". + ""; foreach ( $detail->attribut as $dattribut ) { - echo ""; + echo ""; // if amount requested //--- if ( $dattribut->ad_id == ATTR_DEF_ACCOUNT && diff --git a/include/impress_jrn.inc.php b/include/impress_jrn.inc.php index 0ef84e431..35ac183a1 100644 --- a/include/impress_jrn.inc.php +++ b/include/impress_jrn.inc.php @@ -56,7 +56,7 @@ require_once("class_acc_ledger.php"); $submit=new widget(); $hid=new widget("hidden"); echo '
'; - echo '

'.$Jrn->name.'

'; + echo '

'.h($Jrn->name).'

'; echo "
montant
montant
$e".$client->strAttribut(ATTR_DEF_QUICKCODE)."".$client->strAttribut(ATTR_DEF_NAME)."".$client->strAttribut(ATTR_DEF_ADRESS). + $r.="".h($client->strAttribut(ATTR_DEF_NAME))."".h($client->strAttribut(ATTR_DEF_ADRESS). " ".$client->strAttribut(ATTR_DEF_CP). - " ".$client->strAttribut(ATTR_DEF_PAYS). + " ".$client->strAttribut(ATTR_DEF_PAYS)). "
"; - $r.=$row['md_name']; + $r.=h($row['md_name']); $r.=""; $r.=$row['dt_value']; diff --git a/include/class_fiche.php b/include/class_fiche.php index 4af19d82a..f7892e652 100644 --- a/include/class_fiche.php +++ b/include/class_fiche.php @@ -927,7 +927,7 @@ class fiche { echo "
".$op['jr_internal']."".$op['j_date']."".$op['description']."".h($op['description'])."".""."
".$op['jr_internal']."".$op['j_date']."".$op['description']."".h($op['description'])."".$op['deb_montant']."".$op['cred_montant']."
$e".$supplier->strAttribut(ATTR_DEF_QUICKCODE)."".$supplier->strAttribut(ATTR_DEF_NAME)."".$supplier->strAttribut(ATTR_DEF_ADRESS). + $r.="".h($supplier->strAttribut(ATTR_DEF_NAME))."".h($supplier->strAttribut(ATTR_DEF_ADRESS). " ".$supplier->strAttribut(ATTR_DEF_CP). - " ".$supplier->strAttribut(ATTR_DEF_PAYS). + " ".$supplier->strAttribut(ATTR_DEF_PAYS)). "
". - $Dossier['dos_id']." ".$Dossier['dos_name']." ".$Dossier['dos_description']." + $Dossier['dos_id']." ".h($Dossier['dos_name'])." ".h($Dossier['dos_description'])." "; echo widget::button_href('Effacer','?action=dossier_mgt&sa=del&d='.$Dossier['dos_id']); @@ -211,7 +211,7 @@ if ( $sa == 'list' ) { $template='"; }// if count = 0 @@ -311,7 +311,7 @@ if ( $sa == 'remove' ) { $sql="delete from ac_dossier where dos_id=$1"; ExecSqlParam($cn,$sql,array($_REQUEST['d'])); print '

'; - print "Voilà le dossier $name est effacé

"; + print "Voilà le dossier ".h($name)." est effacé"; echo widget::button_href('Retour','?action=dossier_mgt'); } ?> diff --git a/include/impress_fiche.inc.php b/include/impress_fiche.inc.php index 12f43ee38..752012944 100644 --- a/include/impress_fiche.inc.php +++ b/include/impress_fiche.inc.php @@ -110,7 +110,7 @@ if ( isset ($_REQUEST['fd_id'])) { foreach ($e as $detail) { echo "
".$dattribut->av_text."".h($dattribut->av_text)."
"; echo ''; echo '"; echo ""; echo ""; - echo ""; + echo ""; echo ""; // echo ""; // If the ledger is financial : diff --git a/include/impress_poste.inc.php b/include/impress_poste.inc.php index 903cc7bfa..bb88ea945 100644 --- a/include/impress_poste.inc.php +++ b/include/impress_poste.inc.php @@ -145,12 +145,12 @@ if ( isset( $_REQUEST['bt_html'] ) ) { if ( empty($Poste->row)) exit(); $Poste->load(); echo '
'.dossier::hidden(). @@ -141,7 +141,7 @@ require_once("class_acc_ledger.php"); echo "
".$line['num']."".$line['date']."".$line['comment']."".h($line['comment'])."".$line['jr_internal']."".$line['pj']."
'; - echo ''; + echo ''; foreach ($Poste->row as $a) { $detail=$a; - echo ''; + echo ''; $op=new Acc_Operation($cn); $op->jr_id=$a['jr_id']; @@ -216,13 +216,13 @@ if ( isset( $_REQUEST['bt_html'] ) ) { $Poste->load(); $Poste->get_row( $_GET['from_periode'], $_GET['to_periode']); if ( empty($Poste->row)) continue; - echo ''; + echo ''; $detail=$Poste->row[0]; foreach ($Poste->row as $a) { - echo ''; + echo ''; $op=new Acc_Operation($cn); $op->poste=$poste_id['pcm_val']; diff --git a/include/impress_rapport.inc.php b/include/impress_rapport.inc.php index 1763275a3..81023f5b1 100644 --- a/include/impress_rapport.inc.php +++ b/include/impress_rapport.inc.php @@ -224,7 +224,7 @@ echo ''; $class= ( $i % 2 == 0 )?' class="odd"':""; echo "". - "". + "". "". ""; } diff --git a/include/param_pcmn.inc.php b/include/param_pcmn.inc.php index 8c9325fac..8d75d53b5 100644 --- a/include/param_pcmn.inc.php +++ b/include/param_pcmn.inc.php @@ -111,17 +111,17 @@ if ( isset ( $_POST["Ajout"] ) ) { } /* Parent existe */ $Ret=ExecSqlParam($cn,"select pcm_val from tmp_pcmn where pcm_val=$1",array($p_parent)); - if ( pg_NumRows($Ret) == 0 ) { - echo ''; + if ( $p_parent != 0 && pg_NumRows($Ret) == 0 ) { + echo ''; } else { // Check if the account already exists - + $Count=CountSql($cn,"select * from tmp_pcmn where pcm_val='".$p_val."'"); if ( $Count != 0 ) { // Alert message account already exists echo ''; - + } else { $Ret=ExecSqlParam($cn,"insert into tmp_pcmn (pcm_val,pcm_lib,pcm_val_parent,pcm_type) values ($1,$2,$3,$4)",array($p_val,$p_lib,$p_parent,$p_type)); @@ -181,7 +181,7 @@ for ($i=0; $i <$MaxRow; $i++) { $A['pcm_type'], $_REQUEST['PHPSESSID'], dossier::id()); - echo $A['pcm_lib']; + echo h($A['pcm_lib']); echo $td; echo $A['pcm_val_parent']; diff --git a/include/quick_writing.inc.php b/include/quick_writing.inc.php index a8fc4db7d..feaeb0f93 100644 --- a/include/quick_writing.inc.php +++ b/include/quick_writing.inc.php @@ -67,11 +67,13 @@ function show_direct_form($cn,$ledger,$p_array) { // Don't forget the p_jrn echo ''; echo widget::hidden('p_action',$_REQUEST['p_action']); - $op=new Pre_operation_detail($cn); - $op->set('ledger',$_REQUEST ['p_jrn']); - $op->set('ledger_type',$ledger->get_type()); - $op->set('direct','t'); - echo $op->form_get(); + $op=new Pre_operation($cn); + $op->p_jrn=$_REQUEST['p_jrn']; + $op->od_direct='t'; + if ( $op->count() > 0 ) { + echo "Utilisez une operation "; + echo $op->show_button(); + } echo ''; diff --git a/include/tva.inc.php b/include/tva.inc.php index b485a8504..7fb43f8e1 100644 --- a/include/tva.inc.php +++ b/include/tva.inc.php @@ -115,7 +115,7 @@ echo '
'; echo "
"; echo ""; echo ""; echo ""; // Amount diff --git a/include/user_menu.php b/include/user_menu.php index 9d192793a..8278c3ce2 100644 --- a/include/user_menu.php +++ b/include/user_menu.php @@ -57,11 +57,11 @@ function u_ShowDossier($p_user,$p_admin,$p_filtre="") $result.=""; $desc=($desc=="")?"Aucune description":$desc; - $desc="".$desc.""; + $desc="".h($desc).""; $result.=""; $result.=""; @@ -797,7 +797,7 @@ $r.='

'. $_GET['poste_id'].' '.$Poste->label.'

'. $_GET['poste_id'].' '.h($Poste->label).'

'.$detail['j_date'].' '.$detail['jr_internal'].$detail['description'].'
'.$detail['j_date'].' '.$detail['jr_internal'].h($detail['description']).'

'. $poste_id['pcm_val'].' '.$Poste->label.'

'. $poste_id['pcm_val'].' '.h($Poste->label).'

'. $detail['j_date'].' '.$detail['jr_internal'].$detail['description'].'
'. $detail['j_date'].' '.$detail['jr_internal'].h($detail['description']).'
".$op['desc']."".h($op['desc'])."".sprintf("% 8.2f",$op['montant'])."
"; echo widget::hidden('tva_id',$row['tva_id']); - echo $row['tva_label']; + echo h($row['tva_label']); echo ""; @@ -123,7 +123,7 @@ echo '
'; echo "
"; - echo $row['tva_comment']; + echo h($row['tva_comment']); echo ""; diff --git a/include/user_common.php b/include/user_common.php index b7676b556..3b8a2f43d 100644 --- a/include/user_common.php +++ b/include/user_common.php @@ -18,7 +18,12 @@ */ - +/*!\todo remove the function + - InsertRapt + - deleterapt + - GetConcerned) + - GetTvaRate + */ /* $Revision$ */ @@ -384,7 +389,7 @@ $own=new Own($p_cn); // comment $r.=""; - $r.=$row['jr_comment']; + $r.=h($row['jr_comment']); $r.=""; $result.=""; - $result.=$id." $name"; + $result.=$id." ".h($name).""; $result.=""; $result.="".$desc; $result.="