admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Protect againt cross scripting attack

Browse source 
correct bug with predef operation in misc ledger
correct bug when modifying tva
correct bug add a parent account = 0
correct bug budget
improve warning message to request patch for database
This commit is contained in:
Dany De Bontridder 2008-12-19 21:34:15 +00:00
parent 1ac5401bf1
commit 6abd5c6e9e
43 changed files with 274 additions and 197 deletions
Download patch file Download diff file Expand all files Collapse all files

52
html/admin/sql/patch/upgrade53.sql Normal file
View file

@ -0,0 +1,52 @@
begin;
CREATE OR REPLACE FUNCTION html_quote(p_string text)
RETURNS text AS
$BODY$
declare
r text;
begin
r:=p_string;
r:=replace(r,'<','&lt;');
r:=replace(r,'>','&gt;');
r:=replace(r,'''','&quot;');
return r;
end;$BODY$
LANGUAGE plpgsql;
COMMENT ON FUNCTION html_quote(text) IS 'remove harmfull HTML char';
CREATE OR REPLACE FUNCTION tva_modify(integer, text, numeric, text, text)
RETURNS integer AS
$BODY$
declare
p_tva_id alias for $1;
p_tva_label alias for $2;
p_tva_rate alias for $3;
p_tva_comment alias for $4;
p_tva_poste alias for $5;
debit text;
credit text;
nCount integer;
begin
if length(trim(p_tva_label)) = 0 then
return 3;
end if;
if length(trim(p_tva_poste)) != 0 then
if position (',' in p_tva_poste) = 0 then return 4; end if;
debit = split_part(p_tva_poste,',',1);
credit = split_part(p_tva_poste,',',2);
select count(*) into nCount from tmp_pcmn where pcm_val=debit::poste_comptable;
if nCount = 0 then return 4; end if;
select count(*) into nCount from tmp_pcmn where pcm_val=credit::poste_comptable;
if nCount = 0 then return 4; end if;
end if;
update tva_rate set tva_label=p_tva_label,tva_rate=p_tva_rate,tva_comment=p_tva_comment,tva_poste=p_tva_poste
where tva_id=p_tva_id;
return 0;
end;
$BODY$
LANGUAGE plpgsql;
update version set val=54;
commit;