diff --git a/doc/bnb.sxw b/doc/bnb.sxw
index ad3275600..8f291d99a 100644
Binary files a/doc/bnb.sxw and b/doc/bnb.sxw differ
diff --git a/html/form.php b/html/form.php
index d3094dc1e..c03b27f70 100644
--- a/html/form.php
+++ b/html/form.php
@@ -18,7 +18,6 @@
*/
/* $Revision$ */
// Copyright Author Dany De Bontridder ddebontridder@yahoo.fr
-/* $Revision$ */
include_once ("ac_common.php");
include_once ("user_menu.php");
@@ -53,6 +52,11 @@ if ( isset ($_POST["record"] )) {
AddForm($cn,$HTTP_POST_VARS);
echo "";
}
+if ( isset ($_POST["del_form"]) ) {
+ echo '';
+ DeleteForm($cn,$_POST['fr_id']);
+ echo "
";
+}
ShowMenuComptaForm($_SESSION['g_dossier']);
@@ -94,6 +98,8 @@ if ( isset ($_POST["add_line"]) ) {
if ( isset ($_POST["update"]) ) {
echo '';
UpdateForm($cn,$HTTP_POST_VARS);
+ ViewForm($cn,$sessid,$_POST["fr_id"]);
+
echo "
";
}
diff --git a/include/class_form.php b/include/class_form.php
index e281c259e..5a4c61156 100644
--- a/include/class_form.php
+++ b/include/class_form.php
@@ -50,12 +50,12 @@ class formulaire {
$col=array();
for ($i=0;$i<$Max;$i++) {
$l_line=pg_fetch_array($Res,$i);
- $col[]=ParseFormula($this->db,
- $l_line['fo_label'],
- $l_line['fo_formula'],
- $p_start,
- $p_end
- );
+ $col[]=ParseFormula($this->db,
+ $l_line['fo_label'],
+ $l_line['fo_formula'],
+ $p_start,
+ $p_end
+ );
} //for ($i
$this->row=$col;
diff --git a/include/form_inc.php b/include/form_inc.php
index 8e9b25705..e81189db5 100644
--- a/include/form_inc.php
+++ b/include/form_inc.php
@@ -20,7 +20,7 @@
// Copyright Author Dany De Bontridder ddebontridder@yahoo.fr
//$Revision$
-
+include_once("impress_inc.php");
/* function EncodeForm
* Purpose :
* Encoding Form
@@ -104,6 +104,8 @@ if ( isset ($fr_id)) printf ('';
}
echo '';
+ echo '';
+
echo "";
}
@@ -129,6 +131,23 @@ function ViewForm($p_cn,$p_sessid,$p_id) {
EncodeForm($l_line,$p_sessid,$array);
}
+/* function ViewForm
+ * Purpose : Show the details of a form
+ *
+ * parm :
+ * - $p_cn connection
+ * - $p_id gives the formdef.fr_id
+ * - sessid for the search window
+ * gen :
+ * - none
+ * return:
+ * - none
+ *
+ */
+function DeleteForm($p_cn,$p_id) {
+ ExecSql($p_cn,"delete from form where fo_fr_id=$p_id");
+ ExecSql($p_cn,"delete from formdef where fr_id=$p_id");
+}
/* function GetDataForm
* Purpose :
* Get data from a form
@@ -218,7 +237,7 @@ function UpdateForm($p_cn,$p_array) {
echo_debug ("UpdateForm $key = $element");
${"$key"}=$element;
}
- $Res=ExecSql($p_cn,"update formdef set fr_label='".$form_nom."' where fr_id=".$fr_id);
+ $Res=ExecSql($p_cn,"update formdef set fr_label='".FormatString($form_nom)."' where fr_id=".$fr_id);
$Res=ExecSql($p_cn,"delete from form where fo_fr_id=".$fr_id);
// Test les positions
for ($i =0; $i <$line;$i++) {
@@ -243,6 +262,9 @@ function UpdateForm($p_cn,$p_array) {
${"text$i"}=FormatString(${"text$i"});
${"form$i"}=FormatString(${"form$i"});
if ( ${"text$i"} != null ) {
+ if ( CheckFormula(${"form$i"}) == false )
+ ${"form$i"}="!!!!!!! FORMULE INVALIDE ".${"form$i"};
+
${"form$i"}=(${"form$i"}==null)?"null":"'".${"form$i"}."'";
$sql=sprintf("insert into form (fo_fr_id,
fo_pos,
@@ -252,7 +274,9 @@ function UpdateForm($p_cn,$p_array) {
%d,
'%s',
%s)",
- $fr_id,${"pos$i"},${"text$i"},${"form$i"}
+ $fr_id,${"pos$i"},
+ ${"text$i"},
+ ${"form$i"}
);
$Res=ExecSql($p_cn,$sql);
}
@@ -283,7 +307,7 @@ function AddForm($p_cn,$p_array) {
echo_error("Nom ou ligne non défini");
return;
}
- $sql="insert into formdef (fr_label) values ('".$form_nom."')";
+ $sql="insert into formdef (fr_label) values ('".FormatString($form_nom)."')";
$Res=ExecSql($p_cn,$sql);
$n=GetSequence($p_cn,"s_formdef");
@@ -291,7 +315,9 @@ function AddForm($p_cn,$p_array) {
${"text$i"}=FormatString(${"text$i"});
${"form$i"}=FormatString(${"form$i"});
if ( ${"text$i"} != null ) {
- ${"form$i"}=(${"form$i"}==null)?${"form$i"}:"'".${"form$i"}."'";
+ // ${"form$i"}=(${"form$i"}==null)?${"form$i"}:"'".${"form$i"}."'";
+ ${"form$i"}=(${"form$i"}==null)?"null":"'".${"form$i"}."'";
+ CheckFormula(${"form$i"});
$sql=sprintf("insert into form (fo_fr_id,
fo_pos,
fo_label,
diff --git a/include/impress_inc.php b/include/impress_inc.php
index 49dd0381e..fc0f94d82 100644
--- a/include/impress_inc.php
+++ b/include/impress_inc.php
@@ -718,10 +718,15 @@ function GetRappel($p_cn,$p_jrnx_id,$p_jrn_id,$p_exercice,$which,$p_type,$p_cent
* - array
*
*
- * NOTE: problem: the formulas don't take date range parameters into account....TODO.
- * --> I would like to get the sum of operations between two specified dates.
*/
function ParseFormula($p_cn,$p_label,$p_formula,$p_start,$p_end) {
+ if ( CheckFormula($p_formula) == false) {
+ $aret=array('desc'=>$p_label.' Erreur Formule!',
+ 'montant'=>0);
+ return $aret;
+
+ }
+
if ( $p_start == $p_end )
$cond=" j_tech_per = $p_start ";
else
@@ -822,4 +827,24 @@ function GetFormulaValue($p_cn,$p_label,$p_formula,$p_cond)
}
return $aret;
}
+/* function CheckFormula
+ **************************************************
+ * Purpose : Check if formula doesn't contain
+ * php injection
+ *
+ * parm :
+ * - string
+ * gen :
+ * -
+ * return: none : stop on error
+ */
+function CheckFormula($p_string) {
+ if ( ereg ("^((\[{0,1}[0-9]+\.*[0-9]*%{0,1}\]{0,1})+ *([+-\*/])* *(\[{0,1}[0-9]+\.*[0-9]*%{0,1}\]{0,1})*)*( *FROM=[0-9][0-0].20[0-9][0-9]){0,1}$",$p_string) == false)
+ {
+ return false;
+ } else {
+ return true;
+ }
+}
+
?>