admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix Cosmetic bug : analytic plan

Browse source 
Change : the class widget SELECT do not protect against Cross scripting
Fix Bug : the quick writing doesn't have a "use predefined operation"
Change : after computing the internal code the data member jr_internal is set
Bug : protect against CS in fiche_search.php
This commit is contained in:
Dany De Bontridder 2008-12-31 11:26:04 +00:00
parent 686c303a1a
commit d7473602cb
6 changed files with 13 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

4
html/fiche_search.php
View file

@ -214,9 +214,9 @@ if (
$row['tva_label'] ,
$qcode
);
$r.=" ".$row['vw_name'];
$r.=" ".h($row['vw_name']);
if ( $row['vw_addr'] !="")
$r.="<br><font size=-1>Adresse:&nbsp;".$row['vw_addr']."&nbsp;".$row['vw_cp']."</font>";
$r.="<br><font size=-1>Adresse:&nbsp;".h($row['vw_addr'])."&nbsp;".h($row['vw_cp'])."</font>";
$r.="</span>";
}
}

4
include/class_acc_ledger.php
View file

@ -1184,7 +1184,8 @@ class Acc_Ledger {
}
/*!
* \brief
* \brief compute the internal code of the saved operation and set the $this->jr_internal to
* the computed value
*
* \param $p_grpt id in jr_grpt_
*
@ -1200,6 +1201,7 @@ class Acc_Ledger {
$type=$atype['jrn_def_code'];
$internal_code=sprintf("%d%s-%s",dossier::id(),$type,$num);
echo_debug (__FILE__,__LINE__,"internal_code = $internal_code");
$this->jr_internal=$internal_code;
return $internal_code;
}

2
include/class_anc_operation.php
View file

@ -390,7 +390,7 @@ function get_balance($p_from,$p_to,$p_plan_id)
$result.='<table id="'.$table_id.'">';
else
$result.='<table>';
$result.="<tr>".h($plan->header())."<th>montant</th></tr>";
$result.="<tr>".$plan->header()."<th>montant</th></tr>";

2
include/class_anc_plan.php
View file

@ -165,7 +165,7 @@ class Anc_Plan
if ( empty($a_plan)) return "";
foreach ($a_plan as $r_plan)
{
$res.="<th>".$r_plan['name']."</th>";
$res.="<th>".h($r_plan['name'])."</th>";
}
return $res;
}

2
include/class_widget.php
View file

@ -162,7 +162,7 @@ class widget {
{
$checked=($this->selected==$this->value[$i]['value'])?"SELECTED":"";
$r.='<OPTION VALUE="'.$this->value[$i]['value'].'" '.$checked.'>';
$r.=h($this->value[$i]['label']);
$r.=$this->value[$i]['label'];
}
$r.="</SELECT>";
}

7
include/quick_writing.inc.php
View file

@ -65,14 +65,17 @@ function show_direct_form($cn,$ledger,$p_array) {
// Show the predef operation
// Don't forget the p_jrn
echo '<form>';
echo '<form method="get">';
echo widget::hidden('p_action',$_REQUEST['p_action']);
echo dossier::hidden();
echo widget::hidden('p_jrn',$_REQUEST['p_jrn']);
$op=new Pre_operation($cn);
$op->p_jrn=$_REQUEST['p_jrn'];
$op->od_direct='t';
if ( $op->count() > 0 ) {
echo "Utilisez une operation ";
echo $op->show_button();
echo widget::submit('use_opd','Utilisez une operation');
}
echo '</form>';
@ -231,7 +234,7 @@ if ( isset($_POST['save_it' ])) {
try {
$ledger->save($array);
echo '<h2> Op&eacute;ration enregistr&eacute;e</h2>';
echo '<h2> Op&eacute;ration enregistr&eacute;e '.$ledger->jr_internal.'</h2>';
echo widget::button_href('Autre opération dans ce journal',
"?".dossier::get().
'&show_form'.