From d7473602cb38f05e5d4f613ddc4ad78df1eef4b5 Mon Sep 17 00:00:00 2001
From: Dany De Bontridder <dany@alchimerys.be>
Date: Wed, 31 Dec 2008 11:26:04 +0000
Subject: [PATCH] Fix Cosmetic bug : analytic plan Change : the class widget
 SELECT do not protect against Cross scripting Fix Bug : the quick writing
 doesn't have a "use predefined operation" Change : after computing the
 internal code the data member jr_internal is set Bug : protect against CS in
 fiche_search.php

---
 html/fiche_search.php           | 4 ++--
 include/class_acc_ledger.php    | 4 +++-
 include/class_anc_operation.php | 2 +-
 include/class_anc_plan.php      | 2 +-
 include/class_widget.php        | 2 +-
 include/quick_writing.inc.php   | 7 +++++--
 6 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/html/fiche_search.php b/html/fiche_search.php
index d0616cf92..05722099a 100644
--- a/html/fiche_search.php
+++ b/html/fiche_search.php
@@ -214,9 +214,9 @@ if (
 	       $row['tva_label']  ,
 	       $qcode
 	       );
-  $r.="&nbsp;".$row['vw_name'];
+  $r.="&nbsp;".h($row['vw_name']);
   if ( $row['vw_addr'] !="")
-    $r.="<br><font size=-1>Adresse:&nbsp;".$row['vw_addr']."&nbsp;".$row['vw_cp']."</font>";
+    $r.="<br><font size=-1>Adresse:&nbsp;".h($row['vw_addr'])."&nbsp;".h($row['vw_cp'])."</font>";
   $r.="</span>";
  }
 }
diff --git a/include/class_acc_ledger.php b/include/class_acc_ledger.php
index 0dd86bef1..3ae76bede 100644
--- a/include/class_acc_ledger.php
+++ b/include/class_acc_ledger.php
@@ -1184,7 +1184,8 @@ class Acc_Ledger {
        
   }
   /*!
-   * \brief
+   * \brief compute the internal code of the saved operation and set the $this->jr_internal to
+   *  the computed value
    *
    * \param $p_grpt id in jr_grpt_
    *
@@ -1200,6 +1201,7 @@ class Acc_Ledger {
     $type=$atype['jrn_def_code'];
     $internal_code=sprintf("%d%s-%s",dossier::id(),$type,$num);
     echo_debug (__FILE__,__LINE__,"internal_code = $internal_code");
+    $this->jr_internal=$internal_code;
     return $internal_code;
   }
 
diff --git a/include/class_anc_operation.php b/include/class_anc_operation.php
index 3a9ec48b5..0c9b5913b 100644
--- a/include/class_anc_operation.php
+++ b/include/class_anc_operation.php
@@ -390,7 +390,7 @@ function get_balance($p_from,$p_to,$p_plan_id)
      $result.='<table id="'.$table_id.'">';
    else 
         $result.='<table>';
-   $result.="<tr>".h($plan->header())."<th>montant</th></tr>";
+   $result.="<tr>".$plan->header()."<th>montant</th></tr>";
 
 
 
diff --git a/include/class_anc_plan.php b/include/class_anc_plan.php
index 4a5fa35ca..e4fc846d0 100644
--- a/include/class_anc_plan.php
+++ b/include/class_anc_plan.php
@@ -165,7 +165,7 @@ class Anc_Plan
 	if ( empty($a_plan)) return "";
 	  foreach ($a_plan as $r_plan)
 		{
-		  $res.="<th>".$r_plan['name']."</th>";
+		  $res.="<th>".h($r_plan['name'])."</th>";
 		}
 	  return $res;
   }
diff --git a/include/class_widget.php b/include/class_widget.php
index 6cd0fca61..68b69b7c8 100644
--- a/include/class_widget.php
+++ b/include/class_widget.php
@@ -162,7 +162,7 @@ class widget {
 	    {
 	      $checked=($this->selected==$this->value[$i]['value'])?"SELECTED":"";
 	      $r.='<OPTION VALUE="'.$this->value[$i]['value'].'" '.$checked.'>';
-	      $r.=h($this->value[$i]['label']);
+	      $r.=$this->value[$i]['label'];
 	    }
 	  $r.="</SELECT>";
 	} 
diff --git a/include/quick_writing.inc.php b/include/quick_writing.inc.php
index feaeb0f93..54c334ef5 100644
--- a/include/quick_writing.inc.php
+++ b/include/quick_writing.inc.php
@@ -65,14 +65,17 @@ function show_direct_form($cn,$ledger,$p_array) {
 
   // Show the predef operation
   // Don't forget the p_jrn 
-  echo '<form>';
+  echo '<form method="get">';
   echo widget::hidden('p_action',$_REQUEST['p_action']);
+  echo dossier::hidden();
+  echo widget::hidden('p_jrn',$_REQUEST['p_jrn']);
   $op=new Pre_operation($cn);
   $op->p_jrn=$_REQUEST['p_jrn'];
   $op->od_direct='t';
   if ( $op->count() > 0 ) {
     echo "Utilisez une operation ";
     echo $op->show_button();
+    echo widget::submit('use_opd','Utilisez une operation');
   }
   echo '</form>';
   
@@ -231,7 +234,7 @@ if ( isset($_POST['save_it' ])) {
 
   try {
     $ledger->save($array);
-    echo '<h2> Op&eacute;ration enregistr&eacute;e</h2>';
+    echo '<h2> Op&eacute;ration enregistr&eacute;e '.$ledger->jr_internal.'</h2>';
     echo widget::button_href('Autre opération dans ce journal',
 			     "?".dossier::get().
 			     '&show_form'.