admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Protect againt crossed scripting

Browse source
This commit is contained in:
Dany De Bontridder 2008-12-19 23:06:14 +00:00
parent 6abd5c6e9e
commit aa110fac08
4 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
include/class_acc_ledger_sold.php
View file

@ -959,7 +959,7 @@ class Acc_Ledger_Sold extends Acc_Ledger {
$doc_gen=new widget("select");
$doc_gen->name="gen_doc";
$doc_gen->value=make_array($this->db,
"select md_id,html_quote(md_name) ".
"select md_id,md_name ".
" from document_modele where md_type=4");
$r.=$doc_gen->IOValue().'<br>';
}

4
include/class_pre_operation.php
View file

@ -117,7 +117,7 @@ class Pre_operation
function show_button() {
$select=new widget("select");
$value=make_array($this->db,"select od_id,html_quote(od_name) from op_predef ".
$value=make_array($this->db,"select od_id,od_name from op_predef ".
" where jrn_def_id=".$this->p_jrn.
" and od_direct ='".$this->od_direct."'".
" order by od_name");
@ -206,7 +206,7 @@ class Pre_operation_detail {
return $r;
}
public function get_operation() {
$value=make_array($this->db,"select od_id,html_quote(od_name) from op_predef ".
$value=make_array($this->db,"select od_id,od_name from op_predef ".
" where jrn_def_id=".FormatString($this->jrn_def_id).
" and od_direct ='".FormatString($this->od_direct)."'".
" order by od_name");

6
include/class_widget.php
View file

@ -162,7 +162,7 @@ class widget {
{
$checked=($this->selected==$this->value[$i]['value'])?"SELECTED":"";
$r.='<OPTION VALUE="'.$this->value[$i]['value'].'" '.$checked.'>';
$r.=$this->value[$i]['label'];
$r.=h($this->value[$i]['label']);
}
$r.="</SELECT>";
}
@ -175,7 +175,7 @@ class widget {
echo_debug('class_widget.php',__LINE__,"check for ".$this->value[$i]['value']);
if ($this->selected==$this->value[$i]['value'] )
{
$r=$this->value[$i]['label'];
$r=h($this->value[$i]['label']);
}
}
@ -252,7 +252,7 @@ class widget {
$r.="</TEXTAREA>";
} else {
$r='<p>';
$r.=$this->value;
$r.=h($this->value);
$r.=sprintf('<input type="hidden" name="%s" value="%s">',
$this->name,urlencode($this->value));
$r.='</p>';

4
include/jrn.php
View file

@ -122,9 +122,9 @@ function ShowOperationExpert($p_cn,$p_jr_id,$p_mode=1)
if ( $content['j_debit'] == 't' ) $r.=$col_vide;
$qc=($content['j_qcode'] != "")?" [".$content['j_qcode']."]":"";
if ( $content['j_text'] == '')
$r.="<TD>".$qc.$content['vw_name']."</td>";
$r.="<TD>".$qc.h($content['vw_name'])."</td>";
else
$r.="<TD>".$qc.$content['j_text']."</td>";
$r.="<TD>".$qc.h($content['j_text'])."</td>";
if ( $content['j_debit'] == 'f' ) $r.=$col_vide;
$r.="<TD>".$content['j_montant']."</td>";
if ( $content['j_debit'] == 't' ) $r.=$col_vide;