From aa110fac08ca304d0699bf2dcd8921f46f34bb31 Mon Sep 17 00:00:00 2001
From: Dany De Bontridder <dany@alchimerys.be>
Date: Fri, 19 Dec 2008 23:06:14 +0000
Subject: [PATCH] Protect againt crossed scripting

---
 include/class_acc_ledger_sold.php | 2 +-
 include/class_pre_operation.php   | 4 ++--
 include/class_widget.php          | 6 +++---
 include/jrn.php                   | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/include/class_acc_ledger_sold.php b/include/class_acc_ledger_sold.php
index 3c9bd3607..7bf3e3ac1 100644
--- a/include/class_acc_ledger_sold.php
+++ b/include/class_acc_ledger_sold.php
@@ -959,7 +959,7 @@ class  Acc_Ledger_Sold extends Acc_Ledger {
 	$doc_gen=new widget("select");
 	$doc_gen->name="gen_doc";
 	$doc_gen->value=make_array($this->db,
-				   "select md_id,html_quote(md_name) ".
+				   "select md_id,md_name ".
 				   " from document_modele where md_type=4");
 	$r.=$doc_gen->IOValue().'<br>';  
       }
diff --git a/include/class_pre_operation.php b/include/class_pre_operation.php
index 1c4425c69..9508c4d60 100644
--- a/include/class_pre_operation.php
+++ b/include/class_pre_operation.php
@@ -117,7 +117,7 @@ class Pre_operation
   function show_button() {
 
 	$select=new widget("select");
-	$value=make_array($this->db,"select od_id,html_quote(od_name) from op_predef ".
+	$value=make_array($this->db,"select od_id,od_name from op_predef ".
 			  " where jrn_def_id=".$this->p_jrn.
 			  " and od_direct ='".$this->od_direct."'".
 			  " order by od_name");
@@ -206,7 +206,7 @@ class Pre_operation_detail {
 	return $r;
   }
   public function   get_operation() {
-	$value=make_array($this->db,"select od_id,html_quote(od_name) from op_predef ".
+	$value=make_array($this->db,"select od_id,od_name from op_predef ".
 			  " where jrn_def_id=".FormatString($this->jrn_def_id).
 			  " and od_direct ='".FormatString($this->od_direct)."'".
 			  		  " order by od_name");
diff --git a/include/class_widget.php b/include/class_widget.php
index 6d773e359..6cd0fca61 100644
--- a/include/class_widget.php
+++ b/include/class_widget.php
@@ -162,7 +162,7 @@ class widget {
 	    {
 	      $checked=($this->selected==$this->value[$i]['value'])?"SELECTED":"";
 	      $r.='<OPTION VALUE="'.$this->value[$i]['value'].'" '.$checked.'>';
-	      $r.=$this->value[$i]['label'];
+	      $r.=h($this->value[$i]['label']);
 	    }
 	  $r.="</SELECT>";
 	} 
@@ -175,7 +175,7 @@ class widget {
 	      echo_debug('class_widget.php',__LINE__,"check for ".$this->value[$i]['value']);
 	      if ($this->selected==$this->value[$i]['value'] ) 
 		{
-		  $r=$this->value[$i]['label'];
+		  $r=h($this->value[$i]['label']);
  	
 		}
 	    }
@@ -252,7 +252,7 @@ class widget {
 	$r.="</TEXTAREA>";
       } else {
 	$r='<p>';
-	$r.=$this->value;
+	$r.=h($this->value);
 	$r.=sprintf('<input type="hidden" name="%s" value="%s">',
 		    $this->name,urlencode($this->value));
 	$r.='</p>';
diff --git a/include/jrn.php b/include/jrn.php
index ee7898888..1a6e652d9 100644
--- a/include/jrn.php
+++ b/include/jrn.php
@@ -122,9 +122,9 @@ function ShowOperationExpert($p_cn,$p_jr_id,$p_mode=1)
       if ( $content['j_debit'] == 't' ) $r.=$col_vide;
       $qc=($content['j_qcode'] != "")?"  [".$content['j_qcode']."]":"";
       if ( $content['j_text'] == '') 
-	$r.="<TD>".$qc.$content['vw_name']."</td>";
+	$r.="<TD>".$qc.h($content['vw_name'])."</td>";
       else
-	$r.="<TD>".$qc.$content['j_text']."</td>";
+	$r.="<TD>".$qc.h($content['j_text'])."</td>";
       if ( $content['j_debit'] == 'f' ) $r.=$col_vide;
       $r.="<TD>".$content['j_montant']."</td>";
       if ( $content['j_debit'] == 't' ) $r.=$col_vide;