Bug : fiche.inc.php protect against CS

Bug : add the synchro of attributes
Bug : fix order problem of the attribute 
Cosmetic : move the columns saldo of the card to the end of the table
Improve : create_doc doesn't create the doc for postgresql

doc/developper/create_doc.sh

@@ -1,7 +1,8 @@
 doxygen
 cd html; sed -i "s/utf-8/utf-8/g" *
+cd ..
 if [ ! -z "$PGUSER" ] ; then
 	postgresql_autodoc -u $PGUSER --password $PGPASSWORD -h localhost -d mod1
 	postgresql_autodoc  -u $PGUSER --password $PGPASSWORD  -h localhost -d account_repository
 fi
-cd ../../../ && dev/compose_list.sh
+cd ../../ && dev/compose_list.sh

html/admin/sql/patch/upgrade54.sql

@@ -0,0 +1,52 @@
+begin;
+create or replace function fiche_attribut_synchro (p_fd_id fiche_def.fd_id%TYPE) returns void as
+$BODY$
+declare
+	-- this sql gives the f_id and the missing attribute (ad_id)
+	list_missing cursor for select f_id,fd_id,ad_id,jnt_order from jnt_fic_attr join fiche as A using (fd_id) where fd_id=p_fd_id and ad_id not in (select ad_id from fiche join jnt_fic_att_value using (f_id) where fd_id=jnt_fic_attr.fd_id and A.f_id=f_id);
+	rec record;
+	-- value of the last insert
+	jnt jnt_fic_att_value%ROWTYPE;
+begin
+	open list_missing;
+	loop
+	
+	fetch list_missing into rec;
+	IF NOT FOUND then
+		exit;
+	end if;
+	-- insert a value into jnt_fic_att_value
+	insert 	into jnt_fic_att_value (f_id,ad_id) values (rec.f_id,rec.ad_id) returning * into jnt;
+
+	-- now we insert into attr_value
+	insert into attr_value values (jnt.jft_id,'');
+	end loop;
+	close list_missing;
+end; 
+$BODY$ language plpgsql;
+
+create or replace function attribute_correct_order () returns void as
+$BODY$
+declare
+    crs_correct cursor for select A.jnt_id,A.jnt_order from jnt_fic_attr as A join jnt_fic_attr as B using (fd_id) where A.jnt_order=B.jnt_order and A.jnt_id > B.jnt_id;
+    rec record;
+begin
+	open crs_correct;
+	loop
+	fetch crs_correct into rec;
+	if NOT FOUND then
+		close crs_correct;
+		return;
+	end if;
+	update jnt_fic_attr set jnt_order=jnt_order + 1 where jnt_id = rec.jnt_id;
+	end loop;
+	close crs_correct;
+	perform attribute_correct_order ();
+end;
+$BODY$ language plpgsql;
+
+select fiche_attribut_synchro(fd_id) from fiche_def;
+select attribute_correct_order();
+update version set val=55;
+
+commit;

include/class_fiche_def.php

@@ -79,6 +79,9 @@ class fiche_def {
   function Get() {
     if ( $this->id == 0 ) 
       return 0;
+    ExecSqlParam($this->cn,'select fiche_attribut_synchro($1)',
+		 array($this->id));
+
     $sql="select * from fiche_def ".
       " where fd_id=".$this->id;
     $Ret=ExecSql($this->cn,$sql);
@@ -350,8 +353,8 @@ class fiche_def {
 
 		$span_mod='<TD><A href="?p_action=fiche&'.$str_dossier.'&action=detail&fiche_id='.$l_line['f_id'].$str.'&fiche='.$_GET['fiche'].'">'.$l_line['quick_code'].'</A></TD>';
 	
-	echo $span_mod.'<TD>'.$l_line['vw_name']."</TD>";
-	echo '</tr>';
+		echo $span_mod.'<TD>'.h($l_line['vw_name'])."</TD>";
+		echo '</tr>';
       }
       echo '</table>';
       echo '<FORM METHOD="POST" action="?p_action=fiche&action=vue'.$str.'">';
@@ -370,6 +373,9 @@ class fiche_def {
       echo_debug("class_fiche_def",__LINE__,"DisplayAttribut");
       if ( $this->id == 0 )
 	return ;
+      ExecSqlParam($this->cn,'select fiche_attribut_synchro($1)',
+		   array($this->id));
+
       $MaxLine=sizeof($this->attribut);
       echo_debug("class_fiche_def",__LINE__,"MaxLine = ".$MaxLine);
       $r="<TABLE>";
@@ -517,7 +523,10 @@ class fiche_def {
 	 ExecSqlParam($this->cn,$sql,array(${'jnt_order'.$row->ad_id},
 					   $this->id,
 					   $row->ad_id));
+	 
        }
+       /* correct the order */
+       ExecSql($this->cn,'select attribute_correct_order()');
      }
 
 

include/constant.php

@@ -25,7 +25,7 @@
  */
 require_once ('config.inc.php');
 
-define ("DBVERSION",54);
+define ("DBVERSION",55);
 
 define ("MAX_COMPTE",4);
 define ('MAX_BUD_DETAIL',20);

include/fiche.inc.php

@@ -74,7 +74,7 @@ function ShowFicheDefInput($p_fiche_def)
   $p_fiche_def->GetAttribut();
   if (isset ($_REQUEST['label']) )
         $p_fiche_def->SaveLabel($_REQUEST['label']);
-  $r.= '<H2 class="info">'.$p_fiche_def->label.'</H2>';
+  $r.= '<H2 class="info">'.h($p_fiche_def->label).'</H2>';
   
   $r.= '<FORM action="?p_action=fiche" method="POST">';
   $r.=dossier::hidden();

include/impress_fiche.inc.php

@@ -89,17 +89,18 @@ if  ( isset ($_REQUEST['fd_id'])) {
   echo "<TABLE border=1 class=\"result\">";
   echo "<TR>";
   $fiche_def->GetAttribut();
+  $r='';
   foreach ($fiche_def->attribut as $attribut) {
     echo "<TH>".$attribut->ad_text."</TH>";
     // si solde demandé affiche la col
     //--
     if ($attribut->ad_id==ATTR_DEF_ACCOUNT 
 	&& $with_amount==true) {
-      echo "<TH  >Débit</TH>";
-      echo "<TH  >Crédit</TH>";
-      echo "<TH  >Solde</TH>";
+      $r='<TH  >Débit</TH><TH  >Crédit</TH><TH  >Solde</TH>';
     }
   }
+  echo $r;
+
 
   echo "<TR></TR>";
   $e=$fiche_def->GetByType($fiche_def->id);
@@ -120,12 +121,13 @@ if  ( isset ($_REQUEST['fd_id'])) {
 	  $sql_periode=sql_filter_per($cn,$_REQUEST['from_periode'],$_REQUEST['to_periode'],'p_id','j_tech_per');
 	  $solde=  $detail->get_solde_detail($sql_periode);
 
-	  printf ("<td align=\"right\">% 10.2f</td>",$solde['debit']);
-	  printf ("<td align=\"right\">% 10.2f</td>",$solde['credit']);
-	  printf ("<td align=\"right\">% 10.2f</td>",$solde['solde']);
 			      
 	}
       }
+      printf ("<td align=\"right\">% 10.2f</td>",$solde['debit']);
+      printf ("<td align=\"right\">% 10.2f</td>",$solde['credit']);
+      printf ("<td align=\"right\">% 10.2f</td>",$solde['solde']);
+
     }
     echo "</TR>";
   }